Analysis date (UTC): 27 January 2023, 09:03Analysis environment: Windows 7 Pro, build 7601, x64

file

MD5:531981FA2658977F0ECDAD58E88F3037

SHA1:A32FBF450455E965B54506DEA14438E0598A8E08

SHA256:3ECD4763FFC944FDC67A9027E459CD4F448B1A8D1B36147977AFAF86BBF2A261

Analysis result

Threat level:Malicious activity

Full analysis:Analysis file (MD5: 531981FA2658977F0ECDAD58E88F3037) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

file.exe (PID: 2032)
Install.exe (PID: 2028)
Install.exe (PID: 1988)
CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)

Uses Task Scheduler to run other applications

Install.exe (PID: 1988)
CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)
rundll32.exe (PID: 2972)

Application was dropped or rewritten from another process

Install.exe (PID: 1988)
CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)

Creates a writable file the system directory

CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)

Modifies exclusions in Windows Defender

reg.exe (PID: 2216)
reg.exe (PID: 2652)
reg.exe (PID: 1440)
reg.exe (PID: 620)
reg.exe (PID: 2168)
reg.exe (PID: 2444)
reg.exe (PID: 2992)
reg.exe (PID: 2096)
reg.exe (PID: 2400)

Uses Task Scheduler to autorun other applications

FHYQWsM.exe (PID: 1440)

Steals credentials from Web Browsers

FHYQWsM.exe (PID: 1440)

Loads dropped or rewritten executable

rundll32.exe (PID: 2972)
rundll32.exe (PID: 1892)

Actions looks like stealing of personal data

FHYQWsM.exe (PID: 1440)

Modifies files in the Chrome extension folder

FHYQWsM.exe (PID: 1440)

SUSPICIOUS

Executable content was dropped or overwritten

file.exe (PID: 2032)
Install.exe (PID: 2028)
Install.exe (PID: 1988)
CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)

Reads the BIOS version

Install.exe (PID: 1988)

Starts CMD.EXE for commands execution

forfiles.exe (PID: 1768)
forfiles.exe (PID: 1672)
CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)

Uses REG/REGEDIT.EXE to modify register

cmd.exe (PID: 124)
cmd.exe (PID: 1960)
cmd.exe (PID: 3068)
cmd.exe (PID: 2544)
cmd.exe (PID: 1804)
cmd.exe (PID: 2660)
cmd.exe (PID: 1708)
wscript.exe (PID: 2480)
cmd.exe (PID: 2088)
cmd.exe (PID: 1820)
cmd.exe (PID: 2232)
cmd.exe (PID: 2748)
cmd.exe (PID: 2692)
cmd.exe (PID: 2748)
cmd.exe (PID: 1672)

Starts itself from another location

file.exe (PID: 2032)

Executes via Task Scheduler

powershell.EXE (PID: 2192)
CiuBamk.exe (PID: 2788)
powershell.EXE (PID: 2276)
powershell.EXE (PID: 2548)
powershell.EXE (PID: 2648)
FHYQWsM.exe (PID: 1440)
rundll32.EXE (PID: 2480)
rundll32.EXE (PID: 1636)

Reads security settings of Internet Explorer

powershell.EXE (PID: 2192)
powershell.EXE (PID: 2276)
powershell.EXE (PID: 2548)
powershell.EXE (PID: 2648)

Executes as Windows Service

RAServer.exe (PID: 2072)
RAServer.exe (PID: 2676)
RAServer.exe (PID: 2364)
RAServer.exe (PID: 2240)

Executes scripts

CiuBamk.exe (PID: 2788)

Checks Windows Trust Settings

FHYQWsM.exe (PID: 1440)

Reads settings of System Certificates

FHYQWsM.exe (PID: 1440)

Creates a software uninstall entry

FHYQWsM.exe (PID: 1440)

INFO

Checks supported languages

file.exe (PID: 2032)
Install.exe (PID: 2028)
Install.exe (PID: 1988)
CiuBamk.exe (PID: 2788)
FHYQWsM.exe (PID: 1440)

Create files in a temporary directory

file.exe (PID: 2032)
Install.exe (PID: 2028)
Install.exe (PID: 1988)
powershell.EXE (PID: 2192)
powershell.EXE (PID: 2276)
powershell.EXE (PID: 2548)
powershell.EXE (PID: 2648)

The process checks LSA protection

Install.exe (PID: 1988)
powershell.EXE (PID: 2192)
powershell.EXE (PID: 2276)
powershell.EXE (PID: 2548)
wscript.exe (PID: 2480)
powershell.EXE (PID: 2648)
FHYQWsM.exe (PID: 1440)
rundll32.exe (PID: 2972)

Reads the computer name

Install.exe (PID: 1988)
FHYQWsM.exe (PID: 1440)

Reads the machine GUID from the registry

Install.exe (PID: 1988)
FHYQWsM.exe (PID: 1440)

Creates files in the program directory

FHYQWsM.exe (PID: 1440)

Dropped object may contain Bitcoin addresses

FHYQWsM.exe (PID: 1440)

Process checks computer location settings

FHYQWsM.exe (PID: 1440)

Creates files or folders in the user directory

FHYQWsM.exe (PID: 1440)

Threats

PID	Process	Class	Message
1440	FHYQWsM.exe	Potentially Bad Traffic	ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2972	rundll32.exe	Potentially Bad Traffic	AV INFO HTTP Request to a *.xyz domain