analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | b26bc424724a69565af64f70aace5890671254e2 |
| Full analysis: | https://app.any.run/tasks/e2ad6b3d-99e7-4bcc-af0e-cc0c8763aa4f |
| Verdict: | Malicious activity |
| Analysis date: | January 28, 2022, 08:43:40 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
| MD5: | 95EC4DB8796DE0340E08564C839BFBDA |
| SHA1: | B26BC424724A69565AF64F70AACE5890671254E2 |
| SHA256: | 5EAF9684A6F80FCD59AA00228CB5379EC3F026438B3CCDD8D26B25A6F4B53B97 |
| SSDEEP: | 49152:st8E8ctfjU8z7qqcn88R6fcHcTNe4z07rcrLZ:st5fjU83qqq96fMEe4+YrLZ |
MALICIOUS
Loads dropped or rewritten executable
- client32.exe (PID: 3432)
Connects to CnC server
- client32.exe (PID: 3432)
Writes to a start menu file
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
Drops executable file immediately after starts
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
Application was dropped or rewritten from another process
- client32.exe (PID: 3432)
SUSPICIOUS
Reads the computer name
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
- client32.exe (PID: 3432)
Checks supported languages
- client32.exe (PID: 3432)
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
Drops a file that was compiled in debug mode
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
Executable content was dropped or overwritten
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
Creates files in the user directory
- b26bc424724a69565af64f70aace5890671254e2.exe (PID: 3148)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2011:03:02 08:40:24+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 72192 |
| InitializedDataSize: | 67072 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb4b5 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 02-Mar-2011 07:40:24 |
| Detected languages: |
|
| Debug artifacts: |
|
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000E8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 02-Mar-2011 07:40:24 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000118E0 | 0x00011A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.5511 |
.rdata | 0x00013000 | 0x00001C15 | 0x00001E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.86525 |
.data | 0x00015000 | 0x0000FF2C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.51849 |
.CRT | 0x00025000 | 0x00000010 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.213101 |
.rsrc | 0x00026000 | 0x0000E208 | 0x0000E400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.64878 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.20816 | 1464 | Latin 1 / Western European | English - United States | RT_MANIFEST |
7 | 3.24143 | 556 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.26996 | 974 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.04375 | 530 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.16254 | 776 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.06352 | 380 | Latin 1 / Western European | English - United States | RT_STRING |
100 | 1.51664 | 20 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
101 | 4.19099 | 2998 | Latin 1 / Western European | English - United States | RT_BITMAP |
ASKNEXTVOL | 3.42597 | 646 | Latin 1 / Western European | English - United States | RT_DIALOG |
GETPASSWORD1 | 3.33944 | 314 | Latin 1 / Western European | English - United States | RT_DIALOG |
Imports
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
Total processes
37
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3148 | "C:\Users\admin\AppData\Local\Temp\b26bc424724a69565af64f70aace5890671254e2.exe" | C:\Users\admin\AppData\Local\Temp\b26bc424724a69565af64f70aace5890671254e2.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3432 | "C:\Users\admin\AppData\Roaming\WinSup\client32.exe" | C:\Users\admin\AppData\Roaming\WinSup\client32.exe | b26bc424724a69565af64f70aace5890671254e2.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V12.50 Modules
| |||||||||||||||
Total events
1 224
Read events
1 195
Write events
29
Delete events
0
Modification events
| (PID) Process: | (3148) b26bc424724a69565af64f70aace5890671254e2.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR SFX |
| Operation: | write | Name: | C%%Users%admin%AppData%Roaming |
Value: C:\Users\admin\AppData\Roaming | |||
| (PID) Process: | (3148) b26bc424724a69565af64f70aace5890671254e2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3148) b26bc424724a69565af64f70aace5890671254e2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3148) b26bc424724a69565af64f70aace5890671254e2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3148) b26bc424724a69565af64f70aace5890671254e2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3432) client32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3432) client32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3432) client32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3432) client32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3432) client32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
Executable files
9
Suspicious files
2
Text files
4
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autoruns.ini.lnk | lnk | |
MD5:A1B0D609B41EAE1206D56151C7F0D4E8 | SHA256:E95036E043904A1D6AC1A603BBB10232557421CA9551F562748DB5C10FF1F222 | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\client32.exe | executable | |
MD5:F76954B68CC390F8009F1A052283A740 | SHA256:63315DF7981130853D75DC753E5776BDF371811BCFCE351557C1E45AFDD1EBFB | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\NSM.LIC | text | |
MD5:8614C2008044A081E9D26D8DB1571F4A | SHA256:DF622FC8BC605023730D3AD952D69FCBD8383CE5440D63DA0DF20FB139355EC9 | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\pcicapi.dll | executable | |
MD5:DCDE2248D19C778A41AA165866DD52D0 | SHA256:9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917 | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\nskbfltr.inf | binary | |
MD5:26E28C01461F7E65C402BDF09923D435 | SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368 | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\remcmdstub.exe | executable | |
MD5:2A77875B08D4D2BB7B654DB33A88F16C | SHA256:8AD9C598C1FDE52DD2BFCED5F953CA0D013B0C65FEB5DED73585CFC420C95A95 | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\PCICHEK.DLL | executable | |
MD5:A0B9388C5F18E27266A31F8C5765B263 | SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\TCCTL32.DLL | executable | |
MD5:EAB603D12705752E3D268D86DFF74ED4 | SHA256:6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\HTCTL32.DLL | executable | |
MD5:2D3B207C8A48148296156E5725426C7F | SHA256:EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796 | |||
| 3148 | b26bc424724a69565af64f70aace5890671254e2.exe | C:\Users\admin\AppData\Roaming\WinSup\PCICL32.DLL | executable | |
MD5:00587238D16012152C2E951A087F2CC9 | SHA256:63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
2
DNS requests
2
Threats
6
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3432 | client32.exe | POST | 200 | 185.87.49.233:5538 | http://185.87.49.233/fakeurl.htm | RU | binary | 160 b | suspicious |
3432 | client32.exe | GET | 200 | 62.172.138.35:80 | http://geo.netsupportsoftware.com/location/loca.asp | GB | text | 16 b | suspicious |
3432 | client32.exe | POST | 200 | 185.87.49.233:5538 | http://185.87.49.233/fakeurl.htm | RU | binary | 61 b | suspicious |
3432 | client32.exe | POST | — | 185.87.49.233:5538 | http://185.87.49.233/fakeurl.htm | RU | — | — | suspicious |
3432 | client32.exe | POST | — | 185.87.49.233:5538 | http://185.87.49.233/fakeurl.htm | RU | — | — | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3432 | client32.exe | 62.172.138.35:80 | geo.netsupportsoftware.com | British Telecommunications PLC | GB | suspicious |
3432 | client32.exe | 185.87.49.233:5538 | brassaffid.com | MAROSNET Telecommunication Company LLC | RU | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
geo.netsupportsoftware.com |
| suspicious |
brassaffid.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY NetSupport GeoLocation Lookup Request |
5 ETPRO signatures available at the full report