| URL: | https://github.com/ItroublveTSC/ItroublveTSC/releases/download/v6.0/ItroublveTSC-6.0.zip |
| Full analysis: | https://app.any.run/tasks/30577d06-3465-4d17-8cb2-91f3f932526e |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 01, 2024, 03:02:32 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | EA96D829A37DF4AD5C83913EF7A7DC57 |
| SHA1: | EF9BC232A93439B5F99ABD809F9D3A954025B909 |
| SHA256: | 5FB7B5FF5F96FB16D076CE43F5635404A5B30A2FF33122F546566FFD2324EBA2 |
| SSDEEP: | 3:N8tEdSzdU2+jdU2KJMkCp3hdU2bOV:2ukvovSMLvbOV |
MALICIOUS
Drops the executable file immediately after the start
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
DISCORDGRABBER has been detected (YARA)
- RtkBtManServ.exe (PID: 904)
Actions looks like stealing of personal data
- RtkBtManServ.exe (PID: 904)
- splwow64.exe (PID: 3084)
- snuvcdsm.exe (PID: 2960)
- xwizard.exe (PID: 3104)
Password recovery utility (NirSoft) for browsers is detected
- snuvcdsm.exe (PID: 2960)
Steals credentials from Web Browsers
- snuvcdsm.exe (PID: 2960)
- hh.exe (PID: 2964)
- xwizard.exe (PID: 3104)
Gets path to any of the special folders (SCRIPT)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2756)
The tool for viewing Firefox cookies (NirSoft) is detected
- splwow64.exe (PID: 3084)
The tool for viewing Edge cookies (NirSoft) is detected
- hh.exe (PID: 2964)
The tool for viewing Chrome cookies (NirSoft) is detected
- winhlp32.exe (PID: 3076)
Web Browser History Viewer utility (NirSoft) is detected
- xwizard.exe (PID: 3104)
SUSPICIOUS
Process drops legitimate windows executable
- chrome.exe (PID: 3960)
- WinRAR.exe (PID: 1012)
Executable content was dropped or overwritten
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
Reads security settings of Internet Explorer
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
Reads the Internet Settings
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Reads settings of System Certificates
- RtkBtManServ.exe (PID: 904)
Reads browser cookies
- RtkBtManServ.exe (PID: 904)
The process executes VB scripts
- RtkBtManServ.exe (PID: 904)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
- RtkBtManServ.exe (PID: 904)
The executable file from the user directory is run by the CMD process
- snuvcdsm.exe (PID: 2960)
- winhlp32.exe (PID: 3076)
- splwow64.exe (PID: 3084)
- hh.exe (PID: 2964)
- xwizard.exe (PID: 3104)
Executing commands from a ".bat" file
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Runs shell command (SCRIPT)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2756)
Loads DLL from Mozilla Firefox
- splwow64.exe (PID: 3084)
INFO
Checks supported languages
- wmpnscfg.exe (PID: 2252)
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
- winhlp32.exe (PID: 3076)
- splwow64.exe (PID: 3084)
- hh.exe (PID: 2964)
- xwizard.exe (PID: 3104)
Application launched itself
- chrome.exe (PID: 3960)
Drops the executable file immediately after the start
- chrome.exe (PID: 3960)
- chrome.exe (PID: 2268)
- WinRAR.exe (PID: 1012)
Executable content was dropped or overwritten
- chrome.exe (PID: 2268)
- WinRAR.exe (PID: 1012)
Reads the computer name
- wmpnscfg.exe (PID: 2252)
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
The process uses the downloaded file
- chrome.exe (PID: 2528)
- WinRAR.exe (PID: 1012)
Manual execution by a user
- wmpnscfg.exe (PID: 2252)
- ItroublveTSC.exe (PID: 2716)
- verclsid.exe (PID: 3356)
- notepad.exe (PID: 1244)
Reads the machine GUID from the registry
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
Create files in a temporary directory
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
- winhlp32.exe (PID: 3076)
- hh.exe (PID: 2964)
- splwow64.exe (PID: 3084)
- xwizard.exe (PID: 3104)
Reads Environment values
- RtkBtManServ.exe (PID: 904)
Creates files in the program directory
- RtkBtManServ.exe (PID: 904)
Reads the software policy settings
- RtkBtManServ.exe (PID: 904)
Creates files or folders in the user directory
- splwow64.exe (PID: 3084)
- xwizard.exe (PID: 3104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
73
Monitored processes
32
Malicious processes
11
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 904 | "C:\Users\admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6yFNWE5NnUCCXQIubRI9rZaOa8V31v+LWYEqDLsbfyjy6qS07EfLHzCCRI4729HmGY60lcWMd86WunmSRB2mgunEgpVP5kkzIqNe4FytaiFj7QixVE/C6TyOexZnp+XCE= | C:\Users\admin\AppData\Local\Temp\RtkBtManServ.exe | ItroublveTSC.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: RtkBtManServ Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1012 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\ItroublveTSC-6.0.zip" | C:\Program Files\WinRAR\WinRAR.exe | chrome.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 1072 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3516 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1516 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1244 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\admin_Cookies.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1468 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3488 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1764 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2036 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1772 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2016 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1800 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1260 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2104 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
Total events
22 669
Read events
22 519
Write events
143
Delete events
7
Modification events
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
22
Suspicious files
34
Text files
69
Unknown types
30
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF103de5.TMP | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC | SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655 | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\026753c0-677d-4892-9bc7-c8f578846551.tmp | binary | |
MD5:5058F1AF8388633F609CADB75A75DC9D | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF103e43.TMP | text | |
MD5:ECD3386BCC950E73B86EB128A5F57622 | SHA256:C9A068EAFBC587EDFC89392F64DDD350EEB96C5CF195CDB030BAB8F6DD33833B | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF1043e1.TMP | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF104102.TMP | text | |
MD5:65239F35CB63C76EA1F59EF64F7AAFF4 | SHA256:252EF82CC03FDE4BEF13CF81CD1AC5CE45854212D1A7359035E7A5D6BEDBE229 | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF103f9b.TMP | text | |
MD5:AD0DB8476493577A67FA94A162B646C4 | SHA256:304FB5B4FD83D4A9FF1EF4CF20232A1783169C148297BFE37ED24A1D22A74F2B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
18
DNS requests
16
Threats
9
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3960 | chrome.exe | 239.255.255.250:1900 | — | — | — | unknown |
2108 | chrome.exe | 74.125.71.84:443 | accounts.google.com | GOOGLE | US | unknown |
2108 | chrome.exe | 140.82.121.3:443 | github.com | GITHUB | US | unknown |
2108 | chrome.exe | 185.199.111.133:443 | objects.githubusercontent.com | FASTLY | US | unknown |
3960 | chrome.exe | 224.0.0.251:5353 | — | — | — | unknown |
2108 | chrome.exe | 172.217.16.196:443 | www.google.com | GOOGLE | US | whitelisted |
2108 | chrome.exe | 142.250.186.174:443 | sb-ssl.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
accounts.google.com |
| shared |
github.com |
| shared |
objects.githubusercontent.com |
| shared |
www.google.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |
safebrowsing.google.com |
| whitelisted |
itroublvehacker.gq |
| whitelisted |
dns.msftncsi.com |
| shared |
api64.ipify.org |
| unknown |
discord.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1088 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .gq Domain |
1088 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
— | — | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
1088 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
— | — | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |