analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | CryptoTabSetup_EQkJqEX.exe |
| Full analysis: | https://app.any.run/tasks/92fcd5c4-ab2c-47b9-97fb-8984e335c102 |
| Verdict: | Malicious activity |
| Analysis date: | April 25, 2019, 18:17:44 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | C335E3FD6218D622BDAD4F9B1FA3BAC6 |
| SHA1: | E06CE4C13E3ABA92CFC007CDC928A7F020082496 |
| SHA256: | 3C63D911E4F911F2BA6F411E93BA850091AAC9C6C4C962EEE914358AC1AC8E0C |
| SSDEEP: | 24576:31llZmeB0lj3wVOtpjxC+8biFk9ePHSQNzpPWdtJWgO0lS3r33jyNRD4:FllZmeB0egt98rayQNFPWjJW3RbcJ4 |
MALICIOUS
Application was dropped or rewritten from another process
- CryptoTabUpdate.exe (PID: 3664)
- CryptoTabUpdate.exe (PID: 2844)
- CryptoTabUpdate.exe (PID: 1848)
- CryptoTabUpdate.exe (PID: 3860)
- CryptoTabUpdate.exe (PID: 1040)
- CryptoTabUpdate.exe (PID: 3892)
- CryptoTabUpdate.exe (PID: 1688)
- setup.exe (PID: 3364)
- setup.exe (PID: 992)
- CryptoTabCrashHandler.exe (PID: 3816)
Loads dropped or rewritten executable
- CryptoTabUpdate.exe (PID: 3664)
- CryptoTabUpdate.exe (PID: 2844)
- CryptoTabUpdate.exe (PID: 1848)
- CryptoTabUpdate.exe (PID: 1040)
- CryptoTabUpdate.exe (PID: 3892)
- CryptoTabUpdate.exe (PID: 1688)
- CryptoTabUpdate.exe (PID: 3860)
Loads the Task Scheduler COM API
- CryptoTabUpdate.exe (PID: 3664)
Changes settings of System certificates
- CryptoTabUpdate.exe (PID: 3860)
Changes the autorun value in the registry
- setup.exe (PID: 992)
SUSPICIOUS
Executable content was dropped or overwritten
- CryptoTabUpdateSetup.exe (PID: 4068)
- CryptoTabSetup_EQkJqEX.exe (PID: 3640)
- CryptoTabUpdate.exe (PID: 3664)
- mini_installer2_1_6_86.exe (PID: 1868)
- setup.exe (PID: 992)
Creates files in the program directory
- CryptoTabUpdate.exe (PID: 3664)
- CryptoTabUpdateSetup.exe (PID: 4068)
- CryptoTabUpdate.exe (PID: 1688)
- setup.exe (PID: 992)
Starts itself from another location
- CryptoTabUpdate.exe (PID: 3664)
Disables SEHOP
- CryptoTabUpdate.exe (PID: 3664)
Creates COM task schedule object
- CryptoTabUpdate.exe (PID: 3664)
- CryptoTabUpdate.exe (PID: 1848)
Adds / modifies Windows certificates
- CryptoTabUpdate.exe (PID: 3860)
Application launched itself
- setup.exe (PID: 992)
Modifies the open verb of a shell class
- setup.exe (PID: 992)
Creates files in the user directory
- setup.exe (PID: 992)
Creates a software uninstall entry
- setup.exe (PID: 992)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| PrivateBuild: | - |
|---|---|
| LanguageId: | en |
| ProductVersion: | 1.3.99.31 |
| ProductName: | CryptoTab Update |
| OriginalFileName: | CryptoTabUpdateSetup.exe |
| LegalCopyright: | Copyright 2018 CRYPTOCOMPANY OU |
| InternalName: | CryptoTab Update Setup |
| FileVersion: | 1.3.99.31 |
| FileDescription: | CryptoTab Update Setup |
| CompanyName: | CRYPTOCOMPANY OU |
| CharacterSet: | Unicode |
| LanguageCode: | English (U.S.) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Windows NT 32-bit |
| FileFlags: | Private build |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 1.3.99.31 |
| FileVersionNumber: | 1.3.99.31 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 5.1 |
| ImageVersion: | - |
| OSVersion: | 5.1 |
| EntryPoint: | 0xf6ea |
| UninitializedDataSize: | - |
| InitializedDataSize: | 1283584 |
| CodeSize: | 139264 |
| LinkerVersion: | 14 |
| PEType: | PE32 |
| TimeStamp: | 2019:04:17 14:15:25+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 17-Apr-2019 12:15:25 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | CRYPTOCOMPANY OU |
| FileDescription: | CryptoTab Update Setup |
| FileVersion: | 1.3.99.31 |
| InternalName: | CryptoTab Update Setup |
| LegalCopyright: | Copyright 2018 CRYPTOCOMPANY OU |
| OriginalFilename: | CryptoTabUpdateSetup.exe |
| ProductName: | CryptoTab Update |
| ProductVersion: | 1.3.99.31 |
| LanguageId: | en |
| PrivateBuild: | - |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000110 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 6 |
| Time date stamp: | 17-Apr-2019 12:15:25 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00021E1D | 0x00022000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65987 |
.rdata | 0x00023000 | 0x0000EA3C | 0x0000EC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.65476 |
.data | 0x00032000 | 0x0000254C | 0x00000C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.58118 |
.gfids | 0x00035000 | 0x0000014C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.70705 |
.rsrc | 0x00036000 | 0x00127794 | 0x00127800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.97883 |
.reloc | 0x0015E000 | 0x00002250 | 0x00002400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.52868 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.24273 | 1196 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
2 | 3.39591 | 5160 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 3.09921 | 11560 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 7.96819 | 14145 | Latin 1 / Western European | English - United States | RT_ICON |
101 | 2.49052 | 62 | Latin 1 / Western European | English - United States | RT_GROUP_ICON |
102 | 7.99987 | 1153997 | Latin 1 / Western European | UNKNOWN | B |
1321 | 3.75362 | 446 | Latin 1 / Western European | Serbian - Serbia (Cyrillic) | RT_STRING |
Imports
ADVAPI32.dll |
KERNEL32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
Total processes
48
Monitored processes
13
Malicious processes
11
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3640 | "C:\Users\admin\AppData\Local\Temp\CryptoTabSetup_EQkJqEX.exe" | C:\Users\admin\AppData\Local\Temp\CryptoTabSetup_EQkJqEX.exe | explorer.exe | |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: MEDIUM Description: CryptoTab Update Setup Version: 1.3.99.31 | ||||
| 2844 | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdate.exe /installsource taggedmi /install "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers" | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdate.exe | — | CryptoTabSetup_EQkJqEX.exe |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: MEDIUM Description: CryptoTab Update Version: 1.3.99.31 | ||||
| 4068 | "C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdateSetup.exe" /installsource taggedmi /install "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdateSetup.exe | CryptoTabUpdate.exe | |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: HIGH Description: CryptoTab Update Setup Version: 1.3.99.31 | ||||
| 3664 | "C:\Program Files\GUM6F40.tmp\CryptoTabUpdate.exe" /installsource taggedmi /install "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers" /installelevated | C:\Program Files\GUM6F40.tmp\CryptoTabUpdate.exe | CryptoTabUpdateSetup.exe | |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: HIGH Description: CryptoTab Update Version: 1.3.99.31 | ||||
| 1040 | "C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /regsvc | C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe | — | CryptoTabUpdate.exe |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: HIGH Description: CryptoTab Update Exit code: 0 Version: 1.3.99.31 | ||||
| 1848 | "C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /regserver | C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe | — | CryptoTabUpdate.exe |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: HIGH Description: CryptoTab Update Exit code: 0 Version: 1.3.99.31 | ||||
| 3860 | "C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuOTkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy45OS4zMSIgcmVmPSJFUWtKcUVYIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0NGQ0JEMURBLTNERUEtNEJERi04OUUwLTc5QjY3RTlDQTA1Nn0iIHVzZXJpZD0iezA4RkJBMTZCLTJCNzYtNEMwOS05NkM1LTBGMzNCODVBNEJBQ30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InswQzMzMTNCNS00MTYwLTQwNUQtODdEOS03QzIzM0VENEE3QjV9IiBkZWR1cD0iY3IiPjxodyBwaHlzbWVtb3J5PSIzIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIvPjxhcHAgYXBwaWQ9IntDQTY2Q0NCRS03OTgwLTQ5QUItQjUzQy1FNzRGNTkxOEVDQ0N9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuOTkuMzEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjQ2OCIvPjwvYXBwPjwvcmVxdWVzdD4 | C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe | CryptoTabUpdate.exe | |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: HIGH Description: CryptoTab Update Exit code: 0 Version: 1.3.99.31 | ||||
| 3892 | "C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /handoff "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers" /installsource taggedmi /sessionid "{CFCBD1DA-3DEA-4BDF-89E0-79B67E9CA056}" | C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe | — | CryptoTabUpdate.exe |
User: admin Company: CRYPTOCOMPANY OU Integrity Level: HIGH Description: CryptoTab Update Version: 1.3.99.31 | ||||
| 1688 | "C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /svc | C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe | services.exe | |
User: SYSTEM Company: CRYPTOCOMPANY OU Integrity Level: SYSTEM Description: CryptoTab Update Version: 1.3.99.31 | ||||
| 1868 | "C:\Program Files\CryptoCompany\Update\Install\{9F426FA9-3D90-4BA7-9CBC-54003981EC4A}\mini_installer2_1_6_86.exe" --verbose-logging --system-level | C:\Program Files\CryptoCompany\Update\Install\{9F426FA9-3D90-4BA7-9CBC-54003981EC4A}\mini_installer2_1_6_86.exe | CryptoTabUpdate.exe | |
User: admin Company: The Chromium and CryptoTab Browser Authors Integrity Level: HIGH Description: CryptoTab Browser Installer Exit code: 0 Version: 73.0.3683.103 | ||||
Total events
2 760
Read events
771
Write events
0
Delete events
0
Modification events
Executable files
220
Suspicious files
2
Text files
11
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdateHelper.msi | executable | |
MD5:646671B5840B214E79BAC5A3D103C1AF | SHA256:A175C29C116C7814A22DDA2FC542D2A0E1B0CA43C0B95AA56B37AECE4C18C20F | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\goopdateres_bn.dll | executable | |
MD5:2DF2E05AD66CEAD0D190BEAC1A1EDEB8 | SHA256:2F29DED1146695C18DC541B4866984D23E80695958486B80F0E4C48B2FB09EC9 | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdateWebPlugin.exe | executable | |
MD5:7513F13A202D0CCF712CD581B5B49242 | SHA256:26357591FE4A52BC14DDE19A786781E5205CE0F2BA0DFAF481F778668A541D6C | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\goopdateres_ar.dll | executable | |
MD5:FB9FA972DD40A9C5A7910AB03BF3C46B | SHA256:574761E232358066B792F1701A8CC5C4FBA71E8CC211BBE432C10ED2C38B9406 | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\psmachine_64.dll | executable | |
MD5:CBB21655B7EEE7EA8EC2CDC1EBCDC7FE | SHA256:F598DF27F725C637569751EFBB83D4715D69789DB340BFB3ABCF42FC245C557C | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\goopdateres_am.dll | executable | |
MD5:D268C7686367FFD208E1A354D0897747 | SHA256:484B45C99D0886A5B43D589F4679F22F8268922BE7A5A50882B833211A2CE913 | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\goopdateres_bg.dll | executable | |
MD5:65BE52DC4F3B587DEFEE67DD497C47D6 | SHA256:26E770EEF7B5E7DDE3D4177C8418446F2166D7F5768B40BE9DF42273913EE70F | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdate.exe | executable | |
MD5:6346CBB8A24B3DC8393E27181AFD8C09 | SHA256:E448E471C3AE25BA09EC58E97031F9E5BEEBB6F4DBC2D0067F99E37A4A59F04D | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\psuser_64.dll | executable | |
MD5:9A739BD13C08F4ECC4C614E3A4C93EC2 | SHA256:156DA27CA8F4A4CBD7A914D283CB44A1BC2B6C9B415AC58C51B7DA942D661511 | |||
| 3640 | CryptoTabSetup_EQkJqEX.exe | C:\Users\admin\AppData\Local\Temp\GUM65F9.tmp\CryptoTabUpdateOnDemand.exe | executable | |
MD5:DBB427983F95C4BDA31A44F3B414FDF1 | SHA256:3CB68CF5F78F875EBC80F3BE237E9A16EE0F91A57B6FE88EDF1C181F677FFA3A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1688 | CryptoTabUpdate.exe | 190.2.148.55:443 | download.cryptobrowser.today | Scarlet B.V. | CW | malicious |
— | — | 104.25.211.116:443 | cdn.cryptobrowser.today | Cloudflare Inc | US | shared |
3860 | CryptoTabUpdate.exe | 190.2.148.55:443 | download.cryptobrowser.today | Scarlet B.V. | CW | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
download.cryptobrowser.today |
| malicious |
cdn.cryptobrowser.today |
| suspicious |