File name:

zbot.exe

Full analysis: https://app.any.run/tasks/511c672b-8f5a-4ac3-98ee-6c477a53eda2
Verdict: Malicious activity
Analysis date: January 10, 2025, 19:33:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

34510CEB373808C65949CBBE111BF2E3

SHA1:

A7BCF10B90014353744F43C010B27B764AF4D179

SHA256:

591BE7D2050CD4F7946B22B42575F108EA8B3299519774118FE4ABB8051C5CF5

SSDEEP:

3072:/caqyte61V77snHLLxtLyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONmI:/caBtT77snHRAY7PNNW4IxZ7zbC0rONR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • WinMail.exe (PID: 2244)

    • Runs injected code in another process

      • itydu.exe (PID: 116)

    • Application was injected by another process

      • dwm.exe (PID: 388)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • zbot.exe (PID: 1916)

    • Starts itself from another location

      • zbot.exe (PID: 1916)

    • Executable content was dropped or overwritten

      • zbot.exe (PID: 1916)
      • WinMail.exe (PID: 2244)

    • Detected use of alternative data streams (AltDS)

      • WinMail.exe (PID: 2244)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 1108)

    • Reads Microsoft Outlook installation path

      • WinMail.exe (PID: 2244)

    • Reads Internet Explorer settings

      • WinMail.exe (PID: 2244)

    • Reads the Internet Settings

      • WinMail.exe (PID: 2244)
      • itydu.exe (PID: 116)
      • dwm.exe (PID: 388)
      • cmd.exe (PID: 3000)
      • zbot.exe (PID: 1916)

    • Reads security settings of Internet Explorer

      • WinMail.exe (PID: 2244)

    • Checks Windows Trust Settings

      • WinMail.exe (PID: 2244)

    • Reads settings of System Certificates

      • WinMail.exe (PID: 2244)

    • Starts CMD.EXE for commands execution

      • zbot.exe (PID: 1916)

    • Executing commands from a ".bat" file

      • zbot.exe (PID: 1916)

  • INFO

    • Creates files or folders in the user directory

      • zbot.exe (PID: 1916)
      • WinMail.exe (PID: 2244)

    • Reads the computer name

      • zbot.exe (PID: 1916)
      • wmpnscfg.exe (PID: 1404)
      • itydu.exe (PID: 116)
      • WinMail.exe (PID: 2244)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1404)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1404)
      • zbot.exe (PID: 1916)
      • itydu.exe (PID: 116)
      • WinMail.exe (PID: 2244)

    • Reads the machine GUID from the registry

      • WinMail.exe (PID: 2244)

    • Checks proxy server information

      • WinMail.exe (PID: 2244)

    • The sample compiled with english language support

      • WinMail.exe (PID: 2244)

    • Reads the software policy settings

      • WinMail.exe (PID: 2244)

    • Create files in a temporary directory

      • WinMail.exe (PID: 2244)
      • zbot.exe (PID: 1916)

    • Process checks Internet Explorer phishing filters

      • itydu.exe (PID: 116)
      • zbot.exe (PID: 1916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.5)
.exe | DOS Executable Borland Pascal 7.0x (19.2)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: 1
OSVersion: 5.1
EntryPoint: 0x1d470
UninitializedDataSize: -
InitializedDataSize: 14848
CodeSize: 132608
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2011:04:14 15:07:12+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dwm.exe zbot.exe wmpnscfg.exe no specs itydu.exe no specs svchost.exe winmail.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1916"C:\Users\admin\AppData\Local\Temp\zbot.exe" C:\Users\admin\AppData\Local\Temp\zbot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\zbot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1404"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
116"C:\Users\admin\AppData\Roaming\Nipem\itydu.exe"C:\Users\admin\AppData\Roaming\Nipem\itydu.exe—zbot.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\nipem\itydu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2244"C:\Program Files\Windows Mail\WinMail.exe" -EmbeddingC:\Program Files\Windows Mail\WinMail.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Mail
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows mail\winmail.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3000"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmpb6df59e4.bat"C:\Windows\System32\cmd.exe—zbot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 110
Read events
5 033
Write events
66
Delete events
11

Modification events

(PID) Process:(1108) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\IAM\Accounts
Operation:writeName:ConnectionSettingsMigrated
Value:
1
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Settings
Operation:writeName:Always Use My Colors
Value:
0
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Settings
Operation:writeName:Always Use My Font Face
Value:
0
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Settings
Operation:writeName:Always Use My Font Size
Value:
0
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Trident\Main
Operation:writeName:Move System Caret
Value:
no
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:StoreMigratedV5
Value:
1
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:Settings Upgraded
Value:
10
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Mail
Operation:writeName:Safe Attachments
Value:
1
(PID) Process:(2244) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Mail
Operation:writeName:Secure Safe Attachments
Value:
1
Executable files
2
Suspicious files
19
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.logbinary
MD5:2147D5072337BB0896143252863BE341
SHA256:63513725FD1AB1D23963FAC93463C090FCEC6A8DE2556005298DBF3666623663
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb.chkbinary
MD5:3840FB03EE72CB424CBCDF687F4DA45F
SHA256:84E6112722190E9498C42FC6AE8A259F7A87D9DFAA05E9BABBDC9C326EE6044E
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edbtmp.logbinary
MD5:85EFD41061551F83F832C32AFEA1B141
SHA256:FC837737CD8040F78B5D62154CFB41CE6449016CEC6FD247EF407E886BA22B06
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.patbinary
MD5:70E1416F606621C4CC6941288E338025
SHA256:E9F24AE1D1D548098938EF907536792C926102A0961E3DF226229AE03306D5E4
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStorebinary
MD5:8E4C659C7347171ABC1FEA6DB0DDAD1C
SHA256:A80ACA25D08B755E0A97E2CA945A3625CC56E223E37B44D616F3ECE6C358E38C
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.folbinary
MD5:1D1A60631EFCF505795FB06471CB6A48
SHA256:87EED194D869F1DEC6EBF639E985101ABAD37F6E5A347237A1B056B2DCBFC481
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Microsoft Communities\account{30CE7C98-AA27-4327-91CA-78FA20FFA850}.oeaccountxml
MD5:55E3E8579DB5F3CE6A7355D8AD8B84B9
SHA256:5EA5B63A0EEB81C9EE0A52213D43125C2E3CEBAC97CFAD811EEF9F45A282E6BE
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.folbinary
MD5:639576DAA0EC432482ADC290DB5DA4CC
SHA256:B56D2C191A46CB8E816BA1B23DAED89947628DBAEFE28B430412B1E507AD9161
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.folbinary
MD5:4BCBF3AE2DB0F8AEE8E792FD9BA8DA7F
SHA256:1A17F24F9D36E0ABE7E2C7C1AD06E30E9EBE674ED2E2E2E0FB9FD451C4D64B51
2244WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.folbinary
MD5:A5A0F30BE56681F64A28A7BA72226EDE
SHA256:3EEE27C62FC3440D58C3BE414473A41809A372D2F9174CF0DB3059E21CC50225
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
root-me-dans-ton.onion
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
zbot.exe