| File name: | budongsan_form_1001_16105_.zip |
| Full analysis: | https://app.any.run/tasks/44b42844-8485-4ce2-a05c-9b343e7da543 |
| Verdict: | Malicious activity |
| Analysis date: | September 19, 2023, 02:28:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | A573784991FE03177A95BDD0C38FAC1C |
| SHA1: | 5E3156BFF0CC6D0450F548DE0CBE97E5AECC8345 |
| SHA256: | 5623F386024EE396B3366BE3E2C6DD7F13142A4C9AB077E80984DDD129ED74EC |
| SSDEEP: | 24576:dDV+fy/xSBEaKIxPxnyvXiajU2NDCITPQ10YkDChKaDGDHKujLJCYmjDqOgdpBU:dga/kBEalxJyvZHNJeraHK0L/mSO2U |
MALICIOUS
Application was dropped or rewritten from another process
- budongsan_form_1001_16105_.exe (PID: 2480)
- budongsan_form_1001_16105_.exe (PID: 2412)
SUSPICIOUS
Reads the Internet Settings
- budongsan_form_1001_16105_.exe (PID: 2412)
Process requests binary or script from the Internet
- budongsan_form_1001_16105_.exe (PID: 2412)
INFO
Reads the computer name
- budongsan_form_1001_16105_.exe (PID: 2412)
Checks supported languages
- budongsan_form_1001_16105_.exe (PID: 2412)
Checks proxy server information
- budongsan_form_1001_16105_.exe (PID: 2412)
Reads the machine GUID from the registry
- budongsan_form_1001_16105_.exe (PID: 2412)
Creates files or folders in the user directory
- budongsan_form_1001_16105_.exe (PID: 2412)
Create files in a temporary directory
- budongsan_form_1001_16105_.exe (PID: 2412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | budongsan_form_1001_16105_.exe |
|---|---|
| ZipUncompressedSize: | 3162856 |
| ZipCompressedSize: | 1245690 |
| ZipCRC: | 0x44eb374a |
| ZipModifyDate: | 2023:09:19 10:45:04 |
| ZipCompression: | Deflated |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 20 |
Total processes
41
Monitored processes
3
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1872 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\budongsan_form_1001_16105_.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2412 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1872.3670\budongsan_form_1001_16105_.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1872.3670\budongsan_form_1001_16105_.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Project1 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2480 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1872.3670\budongsan_form_1001_16105_.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1872.3670\budongsan_form_1001_16105_.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Project1 Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
1 244
Read events
1 216
Write events
28
Delete events
0
Modification events
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1872) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2412 | budongsan_form_1001_16105_.exe | C:\Users\admin\AppData\Local\Temp\18351$1.tmp | text | |
MD5:8CF1EFD4073CBD116DD456C22FF57583 | SHA256:AC41ACFDDA8C90ABAAB6F94BC5DCF73EF9C4FC8214AD7E874984D602C320AABC | |||
| 1872 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1872.3670\budongsan_form_1001_16105_.exe | executable | |
MD5:EDC51B78BBDE386C92A24E594E221F16 | SHA256:86EF64E6354F4EAF2354D4DF1367266797B96B8A224E9B3BDE01EC53FA477ACB | |||
| 2412 | budongsan_form_1001_16105_.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\module[1].txt | text | |
MD5:8CF1EFD4073CBD116DD456C22FF57583 | SHA256:AC41ACFDDA8C90ABAAB6F94BC5DCF73EF9C4FC8214AD7E874984D602C320AABC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
7
DNS requests
4
Threats
6
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2412 | budongsan_form_1001_16105_.exe | GET | 200 | 13.124.78.43:80 | http://utildown.com/request_update/new_live.php?mac=12:A9:86:6C:77:DE&pcode=1001 | unknown | — | — | unknown |
2412 | budongsan_form_1001_16105_.exe | GET | — | 114.108.129.22:80 | http://down.iconmania.co.kr/setup_icon007_silent.exe | unknown | — | — | unknown |
2412 | budongsan_form_1001_16105_.exe | GET | 200 | 13.124.78.43:80 | http://utildown.com/admin/setup/data/utildown/module.txt?mac=12:A9:86:6C:77:DE&pcode=1001 | unknown | text | 242 b | unknown |
2412 | budongsan_form_1001_16105_.exe | GET | 200 | 13.124.78.43:80 | http://utildown.com/request_update/file_info.php?file_no=16105 | unknown | xml | 335 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3284 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2412 | budongsan_form_1001_16105_.exe | 13.124.78.43:80 | utildown.com | AMAZON-02 | KR | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2412 | budongsan_form_1001_16105_.exe | 114.108.129.22:80 | down.iconmania.co.kr | LG DACOM Corporation | KR | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
utildown.com |
| unknown |
down.iconmania.co.kr |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2412 | budongsan_form_1001_16105_.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .exe file with no User-Agent |
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | A Network Trojan was detected | ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 |
— | — | A Network Trojan was detected | ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 |
1 ETPRO signatures available at the full report