File name:

zbot.exe

Full analysis: https://app.any.run/tasks/511c672b-8f5a-4ac3-98ee-6c477a53eda2
Verdict: Malicious activity
Analysis date: January 10, 2025, 19:33:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

34510CEB373808C65949CBBE111BF2E3

SHA1:

A7BCF10B90014353744F43C010B27B764AF4D179

SHA256:

591BE7D2050CD4F7946B22B42575F108EA8B3299519774118FE4ABB8051C5CF5

SSDEEP:

3072:/caqyte61V77snHLLxtLyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONmI:/caBtT77snHRAY7PNNW4IxZ7zbC0rONR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • WinMail.exe (PID: 2244)

    • Application was injected by another process

      • dwm.exe (PID: 388)

    • Runs injected code in another process

      • itydu.exe (PID: 116)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • zbot.exe (PID: 1916)

    • Starts itself from another location

      • zbot.exe (PID: 1916)

    • Executable content was dropped or overwritten

      • zbot.exe (PID: 1916)
      • WinMail.exe (PID: 2244)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 1108)

    • Reads Microsoft Outlook installation path

      • WinMail.exe (PID: 2244)

    • Detected use of alternative data streams (AltDS)

      • WinMail.exe (PID: 2244)

    • Reads the Internet Settings

      • WinMail.exe (PID: 2244)
      • itydu.exe (PID: 116)
      • dwm.exe (PID: 388)
      • zbot.exe (PID: 1916)
      • cmd.exe (PID: 3000)

    • Reads Internet Explorer settings

      • WinMail.exe (PID: 2244)

    • Checks Windows Trust Settings

      • WinMail.exe (PID: 2244)

    • Reads settings of System Certificates

      • WinMail.exe (PID: 2244)

    • Reads security settings of Internet Explorer

      • WinMail.exe (PID: 2244)

    • Starts CMD.EXE for commands execution

      • zbot.exe (PID: 1916)

    • Executing commands from a ".bat" file

      • zbot.exe (PID: 1916)

  • INFO

    • Creates files or folders in the user directory

      • zbot.exe (PID: 1916)
      • WinMail.exe (PID: 2244)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1404)
      • itydu.exe (PID: 116)
      • zbot.exe (PID: 1916)
      • WinMail.exe (PID: 2244)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1404)
      • zbot.exe (PID: 1916)
      • itydu.exe (PID: 116)
      • WinMail.exe (PID: 2244)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1404)

    • Reads the machine GUID from the registry

      • WinMail.exe (PID: 2244)

    • Checks proxy server information

      • WinMail.exe (PID: 2244)

    • Process checks Internet Explorer phishing filters

      • itydu.exe (PID: 116)
      • zbot.exe (PID: 1916)

    • Reads the software policy settings

      • WinMail.exe (PID: 2244)

    • Create files in a temporary directory

      • WinMail.exe (PID: 2244)
      • zbot.exe (PID: 1916)

    • The sample compiled with english language support

      • WinMail.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.5)
.exe | DOS Executable Borland Pascal 7.0x (19.2)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: 1
OSVersion: 5.1
EntryPoint: 0x1d470
UninitializedDataSize: -
InitializedDataSize: 14848
CodeSize: 132608
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2011:04:14 15:07:12+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start zbot.exe wmpnscfg.exe no specs itydu.exe no specs svchost.exe winmail.exe cmd.exe no specs dwm.exe

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1916"C:\Users\admin\AppData\Local\Temp\zbot.exe" C:\Users\admin\AppData\Local\Temp\zbot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\zbot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1404"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
116"C:\Users\admin\AppData\Roaming\Nipem\itydu.exe"C:\Users\admin\AppData\Roaming\Nipem\itydu.exe—zbot.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\nipem\itydu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2244"C:\Program Files\Windows Mail\WinMail.exe" -EmbeddingC:\Program Files\Windows Mail\WinMail.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Mail
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows mail\winmail.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3000"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmpb6df59e4.bat"C:\Windows\System32\cmd.exe—zbot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 110
Read events
5 033
Write events
66
Delete events
11

Modification events

(PID) Process:(1108) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\IAM\Accounts
Operation:writeName:ConnectionSettingsMigrated
Value:
1
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Settings
Operation:writeName:Always Use My Colors
Value:
0
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Settings
Operation:writeName:Always Use My Font Face
Value:
0
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Settings
Operation:writeName:Always Use My Font Size
Value:
0
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Main
Operation:writeName:Move System Caret
Value:
no
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:StoreMigratedV5
Value:
1
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:Settings Upgraded
Value:
10
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Mail
Operation:writeName:Safe Attachments
Value:
1
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Mail
Operation:writeName:Secure Safe Attachments
Value:
1
Executable files
2
Suspicious files
19
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.logbinary
MD5:2147D5072337BB0896143252863BE341
SHA256:63513725FD1AB1D23963FAC93463C090FCEC6A8DE2556005298DBF3666623663
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edbtmp.logbinary
MD5:85EFD41061551F83F832C32AFEA1B141
SHA256:FC837737CD8040F78B5D62154CFB41CE6449016CEC6FD247EF407E886BA22B06
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.patbinary
MD5:70E1416F606621C4CC6941288E338025
SHA256:E9F24AE1D1D548098938EF907536792C926102A0961E3DF226229AE03306D5E4
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStorebinary
MD5:64482876619424CEAB5094CB64E302DF
SHA256:49CE1D5F8BAEEC8892144AC0C9C7BB678C97A1BB7ECB2B7811C1BF386CBD30B2
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb.chkbinary
MD5:3840FB03EE72CB424CBCDF687F4DA45F
SHA256:84E6112722190E9498C42FC6AE8A259F7A87D9DFAA05E9BABBDC9C326EE6044E
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.patbinary
MD5:70E1416F606621C4CC6941288E338025
SHA256:E9F24AE1D1D548098938EF907536792C926102A0961E3DF226229AE03306D5E4
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb00002.logbinary
MD5:2147D5072337BB0896143252863BE341
SHA256:63513725FD1AB1D23963FAC93463C090FCEC6A8DE2556005298DBF3666623663
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStorebinary
MD5:8E4C659C7347171ABC1FEA6DB0DDAD1C
SHA256:A80ACA25D08B755E0A97E2CA945A3625CC56E223E37B44D616F3ECE6C358E38C
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Microsoft Communities\account{30CE7C98-AA27-4327-91CA-78FA20FFA850}.oeaccountxml
MD5:55E3E8579DB5F3CE6A7355D8AD8B84B9
SHA256:5EA5B63A0EEB81C9EE0A52213D43125C2E3CEBAC97CFAD811EEF9F45A282E6BE
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb.logbinary
MD5:09F9EC30C43F61C1B4E3CF574CEF1740
SHA256:3A2C8485989DE3437B107D5459308E6984CC2D0F029B25CA74DFA0BC4B754054
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
root-me-dans-ton.onion
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
zbot.exe