File name:

Multitool.exe

Full analysis: https://app.any.run/tasks/f9a49031-3a23-48f4-9d1a-3f224d9a7505
Verdict: Malicious activity
Analysis date: December 28, 2024, 07:55:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

1DE0A0E89DD233A9ABB8982EF158C34F

SHA1:

548E6F34272710C108B44F009226509B7C026B70

SHA256:

4D5D199527DCE74AF2572D4357E14C442CE4D6F61E1D23DF0DECE0565C33E6BA

SSDEEP:

98304:Myi31QBzvYlDDQHcidEqT4qfku9AgPC4Q5s4BQsMiXVkmA3FBXLf7+WwspXFIFMO:mRNY3haFvH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Word2016 Tables FIX.exe (PID: 6900)

    • Uses Task Scheduler to run other applications

      • Word2016 Tables FIX.exe (PID: 6900)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Multitool.exe (PID: 5592)

    • Executable content was dropped or overwritten

      • Multitool.exe (PID: 5592)
      • Word2016 Tables FIX.exe (PID: 6900)

    • Reads security settings of Internet Explorer

      • Multitool.exe (PID: 5592)
      • m.exe (PID: 6252)
      • Word2016 Tables FIX.exe (PID: 6900)

    • Reads the date of Windows installation

      • Word2016 Tables FIX.exe (PID: 6900)

    • Connects to unusual port

      • Word2016 Tables FIX.exe (PID: 6900)

  • INFO

    • Checks supported languages

      • Multitool.exe (PID: 5592)
      • m.exe (PID: 6252)
      • Word2016 Tables FIX.exe (PID: 6900)

    • Reads the computer name

      • Multitool.exe (PID: 5592)
      • m.exe (PID: 6252)
      • Word2016 Tables FIX.exe (PID: 6900)

    • Create files in a temporary directory

      • Multitool.exe (PID: 5592)
      • m.exe (PID: 6252)

    • Process checks computer location settings

      • Multitool.exe (PID: 5592)
      • Word2016 Tables FIX.exe (PID: 6900)

    • The process uses the downloaded file

      • m.exe (PID: 6252)
      • Multitool.exe (PID: 5592)
      • Word2016 Tables FIX.exe (PID: 6900)

    • The sample compiled with english language support

      • Multitool.exe (PID: 5592)

    • Reads the machine GUID from the registry

      • m.exe (PID: 6252)
      • Word2016 Tables FIX.exe (PID: 6900)

    • Reads Environment values

      • m.exe (PID: 6252)

    • Disables trace logs

      • m.exe (PID: 6252)

    • Checks proxy server information

      • m.exe (PID: 6252)

    • Reads the software policy settings

      • m.exe (PID: 6252)

    • Manual execution by a user

      • Word2016 Tables FIX.exe (PID: 6900)

    • Creates files or folders in the user directory

      • Word2016 Tables FIX.exe (PID: 6900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 434176
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start multitool.exe m.exe no specs m.exe word2016 tables fix.exe schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4704"C:\Users\admin\AppData\Local\Temp\RarSFX0\m.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\m.exe—Multitool.exe
User:
admin
Company:
Reload Corporation Technologies (LCC)
Integrity Level:
MEDIUM
Description:
Likuur`s Multitool
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\m.exe
c:\windows\system32\ntdll.dll
5592"C:\Users\admin\Desktop\Multitool.exe" C:\Users\admin\Desktop\Multitool.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\multitool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6252"C:\Users\admin\AppData\Local\Temp\RarSFX0\m.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\m.exe
Multitool.exe
User:
admin
Company:
Reload Corporation Technologies (LCC)
Integrity Level:
HIGH
Description:
Likuur`s Multitool
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\m.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6900"C:\Users\admin\Desktop\Word2016 Tables FIX.exe" C:\Users\admin\Desktop\Word2016 Tables FIX.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\word2016 tables fix.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6952"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "Word2016 Tables FIX" /tr "C:\Users\admin\AppData\Roaming\Word2016 Tables FIX.exe"C:\Windows\System32\schtasks.exe—Word2016 Tables FIX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6960\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 319
Read events
2 305
Write events
14
Delete events
0

Modification events

(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6252) m.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\m_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
38
Suspicious files
4
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\arm\ManageCIRedist.dllexecutable
MD5:18B9D137001304F997E34F35DDFB3C70
SHA256:401EA63CDAEE0D800D848BE4E5581BE4AE0974B8AA63047E179A8BBAB3B799E4
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\sv\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:8B5253714321A936666336CED59E78B1
SHA256:810274454A98B052FD725A675A618E74D8959EB194D4ACBBC6E6C1D5EECC796A
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\it\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:8BD1ABC15AE080DD9BBD874206F2D888
SHA256:94A2A6F02F6B7F10D163C33F83DEB72D35A55BAAEC5E4C78BC1C4468A8596249
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\es\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:C853F2B6D5D6FC94B676EF80939850F6
SHA256:6F4F7E4CD2165C48754AA64D8530AE1C9DFC7A2704898D1E56C7C45668A28D7C
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\pl\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:127743A93770732C1714D7E306978AEB
SHA256:A52C4C6137F8DBF12A24A75A897CDBB3CC42FC1C99D4B4A918757877B022B727
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\fr\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:D423974FE7526E0BC3509C5CEE442E74
SHA256:9E9F20CE7D814A81E3300374877B5066A3D064BFC4C8D0598F3E24D590DA4491
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\ja\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:E32284BE820E29585A9D02EB8B2AA620
SHA256:83BC6AFEE5802A430C2A04C8BD67B59F1EDA00869F2688D421D6D4052FDDD813
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\ru\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:28192D9A1B77442D3D542D4A8D86960F
SHA256:BCDF2A4CDAFAA8440C316C6C75B3C18BC2A9B9A216CDD1223860D96430B96770
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AnyCPU\Microsoft.ConfigCI.Commands.Redist.dllexecutable
MD5:B737BE0DCC9F23CFBD3431C3620B8AB6
SHA256:77359BE0A3B7F6085A9F150E187C730D7E166DF2DEA4D3EB89CFE6BD74F3C2AD
5592Multitool.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\arm64\ManageCIRedist.dllexecutable
MD5:5D9403F7DD44DF53FF1C1EBA2FFCB245
SHA256:48F9293E50F214C5467CC313714A1DA3A642BEF97250175A34425647C8C5EACA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
17 188
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3988
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6664
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6664
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5448
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
104.126.37.161:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.176
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.177
  • 104.126.37.168
  • 104.126.37.184
  • 104.126.37.162
  • 104.126.37.123
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.74.206
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.22
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Multitool.exe