| URL: | http://aldn.altools.co.kr/setup/ALSee843.exe |
| Full analysis: | https://app.any.run/tasks/6b77ca51-0a4f-48c4-a592-97c280d7aa5f |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | March 30, 2020, 07:48:42 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 7EC1383E7F5FDE2C5D6D5B5298AC0941 |
| SHA1: | 571C76D3F5C070DB825E8392FF73E9B0B3565838 |
| SHA256: | 4065180E2D244FA2F8D1532B07DFE008B1E0D34542E5E048EAC6BD7C015528CA |
| SSDEEP: | 3:N1KfzSY+KWOMLN:CeJ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1760 | "C:\Users\admin\AppData\Local\Temp\nsv2139.tmD\ezt.exe" -needsetSearchProvider | C:\Users\admin\AppData\Local\Temp\nsv2139.tmD\ezt.exe | — | stext.exe | |||||||||||
User: admin Company: ESTsoft Corp. Integrity Level: HIGH Description: ezt Exit code: 1 Version: 19, 12, 11, 0 Modules
| |||||||||||||||
| 2452 | "C:\Users\admin\Downloads\ALSee843.exe" | C:\Users\admin\Downloads\ALSee843.exe | — | iexplore.exe | |||||||||||
User: admin Company: ESTsoft Corp. Integrity Level: MEDIUM Description: 알씨 공개용 설치 프로그램 Exit code: 3221226540 Version: 20.3.12.1 Modules
| |||||||||||||||
| 2644 | "C:\Users\admin\Downloads\ALSee843.exe" | C:\Users\admin\Downloads\ALSee843.exe | iexplore.exe | ||||||||||||
User: admin Company: ESTsoft Corp. Integrity Level: HIGH Description: 알씨 공개용 설치 프로그램 Exit code: 2 Version: 20.3.12.1 Modules
| |||||||||||||||
| 2836 | "C:\Program Files\Internet Explorer\iexplore.exe" http://aldn.altools.co.kr/setup/ALSee843.exe | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3096 | "C:\Users\admin\AppData\Local\Temp\nsv2139.tmD\stext\stext.exe" | C:\Users\admin\AppData\Local\Temp\nsv2139.tmD\stext\stext.exe | ALSee843.exe | ||||||||||||
User: admin Company: ESTsoft corp. Integrity Level: HIGH Description: ALTools Setup Helper Exit code: 2 Version: 19, 12, 17, 1 Modules
| |||||||||||||||
| 3284 | "C:\Users\admin\Downloads\ALSee843.exe" | C:\Users\admin\Downloads\ALSee843.exe | — | iexplore.exe | |||||||||||
User: admin Company: ESTsoft Corp. Integrity Level: MEDIUM Description: 알씨 공개용 설치 프로그램 Exit code: 3221226540 Version: 20.3.12.1 Modules
| |||||||||||||||
| 3740 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2836 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3972 | "C:\Users\admin\Downloads\ALSee843.exe" | C:\Users\admin\Downloads\ALSee843.exe | iexplore.exe | ||||||||||||
User: admin Company: ESTsoft Corp. Integrity Level: HIGH Description: 알씨 공개용 설치 프로그램 Exit code: 0 Version: 20.3.12.1 Modules
| |||||||||||||||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: 3167838536 | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30803559 | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2836) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3740 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ALSee843[1].exe | — | |
MD5:— | SHA256:— | |||
| 3740 | iexplore.exe | C:\Users\admin\Downloads\ALSee843.exe.qcw5v5x.partial | — | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF691A4F3CB5BF2898.TMP | — | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\Downloads\ALSee843.exe.qcw5v5x.partial:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\Downloads\ALSee843.exe | — | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab137C.tmp | — | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar137D.tmp | — | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{E88DFC09-725A-11EA-972D-5254004A04AF}.dat | binary | |
MD5:— | SHA256:— | |||
| 2836 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203 | binary | |
MD5:— | SHA256:— | |||
| 3972 | ALSee843.exe | C:\Users\admin\AppData\Local\Temp\nsv2139.tmD\EstUrl.dll | executable | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3740 | iexplore.exe | GET | 200 | 99.86.7.29:80 | http://aldn.altools.co.kr/setup/ALSee843.exe | US | executable | 35.1 Mb | whitelisted |
2836 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 5.23 Kb | whitelisted |
3096 | stext.exe | POST | 200 | 218.153.8.56:80 | http://ko-KR.altoolsinst.altools.com/start/setupset.aspx | KR | html | 2.09 Kb | malicious |
2836 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
3972 | ALSee843.exe | POST | — | 218.153.8.56:80 | http://ko-kr.altoolsinst.altools.com/data/DisplayedPageData.aspx | KR | — | — | malicious |
3096 | stext.exe | POST | 200 | 218.153.8.56:80 | http://ko-KR.altoolsinst.altools.com/show/public_addin.aspx | KR | html | 3.18 Kb | malicious |
3096 | stext.exe | POST | 200 | 218.153.8.56:80 | http://ko-KR.altoolsinst.altools.com/show/public_addin2.aspx | KR | html | 1.54 Kb | malicious |
3972 | ALSee843.exe | POST | 200 | 218.153.8.56:80 | http://ko-kr.altoolsinst.altools.com/data/DisplayedPageData.aspx | KR | — | — | malicious |
3096 | stext.exe | POST | 200 | 218.153.8.56:80 | http://ko-kr.altoolsinst.altools.com/options/getoptionsxml.ashx | KR | xml | 3.17 Kb | malicious |
2836 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3740 | iexplore.exe | 99.86.7.29:80 | aldn.altools.co.kr | AT&T Services, Inc. | US | suspicious |
2836 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2836 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3972 | ALSee843.exe | 218.153.8.56:80 | ko-kr.altoolsinst.altools.com | Korea Telecom | KR | malicious |
3096 | stext.exe | 218.153.8.56:80 | ko-kr.altoolsinst.altools.com | Korea Telecom | KR | malicious |
2836 | iexplore.exe | 204.79.197.200:443 | ieonline.microsoft.com | Microsoft Corporation | US | whitelisted |
— | — | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
aldn.altools.co.kr |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
ko-kr.altoolsinst.altools.com |
| malicious |
ieonline.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3740 | iexplore.exe | Potentially Bad Traffic | ET POLICY Executable served from Amazon S3 |
3740 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3096 | stext.exe | Misc activity | ADWARE [PTsecurity] ALTools PUA Installation Check-in |
3096 | stext.exe | Misc activity | ADWARE [PTsecurity] ALTools PUA Installation Check-in |
3096 | stext.exe | Misc activity | ADWARE [PTsecurity] ALTools PUA Installation Check-in |
3972 | ALSee843.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) |
3972 | ALSee843.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) |
Process | Message |
|---|---|
ALSee843.exe | called Fucntion .onInit |
ALSee843.exe | called Fucntion .ESTOnGUIInit |
ALSee843.exe | called Fucntion .onInit |
ALSee843.exe | called Fucntion .onguiend |