analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://linkvertise.download/download/93270/OpBeeSwarmGUI/V2LqVwOGvM7xh5gh1CUsQWtyCjIsYKeU

Full analysis: https://app.any.run/tasks/2fb25b24-3261-4b4b-8a8f-19781f5b9e12
Verdict: Malicious activity
Analysis date: November 29, 2020, 18:12:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MD5:

F6122BF15933D22CE10A5E22FEF87BDE

SHA1:

96E56B96E1EC2ACF1AF61EC1E39272A7FD064E14

SHA256:

387574FB4B4E52D0279638EC6ABB08A35E1EBABABB7BFBBCA9D7832E2672AB10

SSDEEP:

3:N8MLRBXA1zKXXJkcH1snYXpqSqwWuE0:2MNi1zorynYPqME0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 1268)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3808)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2940)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2824)

    • Loads dropped or rewritten executable

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Actions looks like stealing of personal data

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

  • SUSPICIOUS

    • Application launched itself

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 1268)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2940)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3808)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2944)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Cleans NTFS data-stream (Zone Identifier)

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 1268)

    • Reads Environment values

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Reads internet explorer settings

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Drops a file that was compiled in debug mode

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

  • INFO

    • Reads settings of System Certificates

      • chrome.exe (PID: 1480)
      • chrome.exe (PID: 2944)

    • Reads the hosts file

      • chrome.exe (PID: 1480)
      • chrome.exe (PID: 2944)

    • Application launched itself

      • chrome.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
40
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe bee swarm gui - linkvertise downloader_3829900224.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://linkvertise.download/download/93270/OpBeeSwarmGUI/V2LqVwOGvM7xh5gh1CUsQWtyCjIsYKeU"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3576"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6bf5a9d0,0x6bf5a9e0,0x6bf5a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
700"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2344 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=52845715683128836 --mojo-platform-channel-handle=1048 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
1480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=1692724429807722072 --mojo-platform-channel-handle=1456 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11138362907580588793 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=377709338004389408 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3416"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10495604008178338456 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17646813972784694621 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2964"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16062019776111201554 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
2 643
Read events
2 502
Write events
138
Delete events
3

Modification events

(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:—Key:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2944-13251147165454875
Value:
259
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
9
Suspicious files
109
Text files
202
Unknown types
2

Dropped files

PID
Process
Filename
Type
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FC3E49E-B80.pma —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b824b757-0cfe-4af6-b5ef-bb84c99cf69a.tmp —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE
SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:D4322EEBAC92D1B8F7A6F5E39F6264B7
SHA256:A3EEDF21B850DCC7CE5AE04395ECDD2D29DA4EA549C8A185DD9E8B552A87B8C2
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:E815400F953EA8DB8A98D52737C9A50D
SHA256:E9F064927A191500B7365F51C9CD0763A6A8E68A8B866ACED39AA0E72C3EAD85
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF18d29d.TMPtext
MD5:67F45CAA18C889645F50CD6216C81E65
SHA256:33ED82CDDDFFD55A5059C147C6CD20F66C6712314F890A39576D3C10914D0029
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RF18d2db.TMPtext
MD5:1C97B70A4BAD7C026F79467C7D496AFA
SHA256:C5A02E4984DE3F30DADFC0A89A93F45418C06653C3962EAA94C93909E51D272D
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF18d26e.TMPtext
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE
SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:1C97B70A4BAD7C026F79467C7D496AFA
SHA256:C5A02E4984DE3F30DADFC0A89A93F45418C06653C3962EAA94C93909E51D272D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
209
DNS requests
138
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1480
chrome.exe
GET
301
104.23.99.190:80
http://pastebin.com/
US
—
—
shared
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
GET
200
143.204.214.46:80
http://d9zb3idz53wi.cloudfront.net/Icon_13042020.png
US
image
17.8 Kb
whitelisted
1480
chrome.exe
GET
301
5.255.90.119:80
http://kaas.gg/
NL
html
224 b
suspicious
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.120:80
http://d3qhhf7ctrg6s8.cloudfront.net/
US
binary
778 Kb
whitelisted
1480
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAP%2B7xu1tkg0miCVD4vGl1M%3D
US
der
471 b
whitelisted
1480
chrome.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.5 Kb
whitelisted
3204
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1480
chrome.exe
172.217.21.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
1480
chrome.exe
172.217.12.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1480
chrome.exe
172.217.16.205:443
accounts.google.com
Google Inc.
US
whitelisted
1480
chrome.exe
209.197.3.15:443
stackpath.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
1480
chrome.exe
104.16.18.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
1480
chrome.exe
195.181.175.52:443
maxst.icons8.com
Datacamp Limited
DE
suspicious
1480
chrome.exe
172.67.172.25:443
linkvertise.download
—
US
unknown
1480
chrome.exe
104.108.144.24:443
contextual.media.net
TOT Public Company Limited
US
unknown
1480
chrome.exe
142.250.74.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
1480
chrome.exe
143.204.215.33:443
—
—
US
suspicious

DNS requests

Domain
IP
Reputation
linkvertise.download
  • 172.67.172.25
  • 104.24.110.202
  • 104.24.111.202
suspicious
accounts.google.com
  • 172.217.16.205
shared
cdnjs.cloudflare.com
  • 104.16.18.94
  • 104.16.19.94
whitelisted
fonts.googleapis.com
  • 172.217.12.170
whitelisted
maxst.icons8.com
  • 195.181.175.52
whitelisted
stackpath.bootstrapcdn.com
  • 209.197.3.15
whitelisted
js.chargebee.com
  • 174.137.133.49
shared
contextual.media.net
  • 104.108.144.24
shared
fonts.gstatic.com
  • 172.217.21.195
whitelisted
www.googletagmanager.com
  • 142.250.74.200
whitelisted

Threats

PID
Process
Class
Message
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
A Network Trojan was detected
ADWARE [PTsecurity] InstallCore
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://linkvertise.download/download/93270/OpBeeSwarmGUI/V2LqVwOGvM7xh5gh1CUsQWtyCjIsYKeU