| URL: | https://github.com/ItroublveTSC/ItroublveTSC/releases/download/v6.0/ItroublveTSC-6.0.zip |
| Full analysis: | https://app.any.run/tasks/30577d06-3465-4d17-8cb2-91f3f932526e |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 01, 2024, 03:02:32 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | EA96D829A37DF4AD5C83913EF7A7DC57 |
| SHA1: | EF9BC232A93439B5F99ABD809F9D3A954025B909 |
| SHA256: | 5FB7B5FF5F96FB16D076CE43F5635404A5B30A2FF33122F546566FFD2324EBA2 |
| SSDEEP: | 3:N8tEdSzdU2+jdU2KJMkCp3hdU2bOV:2ukvovSMLvbOV |
MALICIOUS
Drops the executable file immediately after the start
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
DISCORDGRABBER has been detected (YARA)
- RtkBtManServ.exe (PID: 904)
Gets path to any of the special folders (SCRIPT)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Actions looks like stealing of personal data
- RtkBtManServ.exe (PID: 904)
- splwow64.exe (PID: 3084)
- xwizard.exe (PID: 3104)
- snuvcdsm.exe (PID: 2960)
Steals credentials from Web Browsers
- snuvcdsm.exe (PID: 2960)
- hh.exe (PID: 2964)
- xwizard.exe (PID: 3104)
Password recovery utility (NirSoft) for browsers is detected
- snuvcdsm.exe (PID: 2960)
The tool for viewing Chrome cookies (NirSoft) is detected
- winhlp32.exe (PID: 3076)
The tool for viewing Firefox cookies (NirSoft) is detected
- splwow64.exe (PID: 3084)
The tool for viewing Edge cookies (NirSoft) is detected
- hh.exe (PID: 2964)
Web Browser History Viewer utility (NirSoft) is detected
- xwizard.exe (PID: 3104)
SUSPICIOUS
Process drops legitimate windows executable
- chrome.exe (PID: 3960)
- WinRAR.exe (PID: 1012)
Executable content was dropped or overwritten
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
Reads security settings of Internet Explorer
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
Reads the Internet Settings
- RtkBtManServ.exe (PID: 904)
- wscript.exe (PID: 2444)
- ItroublveTSC.exe (PID: 2716)
- wscript.exe (PID: 2756)
- wscript.exe (PID: 2896)
The process executes VB scripts
- RtkBtManServ.exe (PID: 904)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Executing commands from a ".bat" file
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Reads browser cookies
- RtkBtManServ.exe (PID: 904)
Reads settings of System Certificates
- RtkBtManServ.exe (PID: 904)
The executable file from the user directory is run by the CMD process
- snuvcdsm.exe (PID: 2960)
- splwow64.exe (PID: 3084)
- winhlp32.exe (PID: 3076)
- hh.exe (PID: 2964)
- xwizard.exe (PID: 3104)
Runs shell command (SCRIPT)
- wscript.exe (PID: 2444)
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 2896)
- wscript.exe (PID: 2756)
- RtkBtManServ.exe (PID: 904)
- wscript.exe (PID: 2444)
Loads DLL from Mozilla Firefox
- splwow64.exe (PID: 3084)
INFO
Application launched itself
- chrome.exe (PID: 3960)
Drops the executable file immediately after the start
- chrome.exe (PID: 3960)
- chrome.exe (PID: 2268)
- WinRAR.exe (PID: 1012)
The process uses the downloaded file
- WinRAR.exe (PID: 1012)
- chrome.exe (PID: 2528)
Executable content was dropped or overwritten
- chrome.exe (PID: 2268)
- WinRAR.exe (PID: 1012)
Checks supported languages
- ItroublveTSC.exe (PID: 2716)
- wmpnscfg.exe (PID: 2252)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
- winhlp32.exe (PID: 3076)
- splwow64.exe (PID: 3084)
- hh.exe (PID: 2964)
- xwizard.exe (PID: 3104)
Manual execution by a user
- wmpnscfg.exe (PID: 2252)
- ItroublveTSC.exe (PID: 2716)
- verclsid.exe (PID: 3356)
- notepad.exe (PID: 1244)
Reads the computer name
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
- wmpnscfg.exe (PID: 2252)
Reads the machine GUID from the registry
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
Create files in a temporary directory
- ItroublveTSC.exe (PID: 2716)
- RtkBtManServ.exe (PID: 904)
- snuvcdsm.exe (PID: 2960)
- hh.exe (PID: 2964)
- winhlp32.exe (PID: 3076)
- splwow64.exe (PID: 3084)
- xwizard.exe (PID: 3104)
Reads Environment values
- RtkBtManServ.exe (PID: 904)
Creates files in the program directory
- RtkBtManServ.exe (PID: 904)
Reads the software policy settings
- RtkBtManServ.exe (PID: 904)
Creates files or folders in the user directory
- splwow64.exe (PID: 3084)
- xwizard.exe (PID: 3104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
73
Monitored processes
32
Malicious processes
11
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 904 | "C:\Users\admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6yFNWE5NnUCCXQIubRI9rZaOa8V31v+LWYEqDLsbfyjy6qS07EfLHzCCRI4729HmGY60lcWMd86WunmSRB2mgunEgpVP5kkzIqNe4FytaiFj7QixVE/C6TyOexZnp+XCE= | C:\Users\admin\AppData\Local\Temp\RtkBtManServ.exe | ItroublveTSC.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: RtkBtManServ Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1012 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\ItroublveTSC-6.0.zip" | C:\Program Files\WinRAR\WinRAR.exe | chrome.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 1072 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3516 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1516 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1244 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\admin_Cookies.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1468 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3488 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1764 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2036 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1772 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2016 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1800 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1260 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2104 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1152,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
Total events
22 669
Read events
22 519
Write events
143
Delete events
7
Modification events
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3960) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
22
Suspicious files
34
Text files
69
Unknown types
30
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF103de5.TMP | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:FA25AF7098FC1571F24F200A9D105D58 | SHA256:4F40C87070B7A151FB241CCF36E7027AA703C15CA0ACB0A1759DA07B2C318574 | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:9C016064A1F864C8140915D77CF3389A | SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787 | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF103e05.TMP | text | |
MD5:358570F689377CE6838812643E03734B | SHA256:5B41FCC2E1A843AEAB9437B06E27B798870FF10D86A51B163BF48862BCD32590 | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:825B582C78EC88D54C215EFDF1EAD639 | SHA256:367995D01A8F13E5C30C79499F86B034775BFD009D83DC97635DE438D47DFA37 | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF1043e1.TMP | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\026753c0-677d-4892-9bc7-c8f578846551.tmp | binary | |
MD5:5058F1AF8388633F609CADB75A75DC9D | SHA256:— | |||
| 3960 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:456D3EF989973A7C218E338A6CFFAD25 | SHA256:75631D994431F254B94255C50038A3657BFC45D76FCE9D794D514E57CA678872 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
18
DNS requests
16
Threats
9
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3960 | chrome.exe | 239.255.255.250:1900 | — | — | — | unknown |
2108 | chrome.exe | 74.125.71.84:443 | accounts.google.com | GOOGLE | US | unknown |
2108 | chrome.exe | 140.82.121.3:443 | github.com | GITHUB | US | unknown |
2108 | chrome.exe | 185.199.111.133:443 | objects.githubusercontent.com | FASTLY | US | unknown |
3960 | chrome.exe | 224.0.0.251:5353 | — | — | — | unknown |
2108 | chrome.exe | 172.217.16.196:443 | www.google.com | GOOGLE | US | whitelisted |
2108 | chrome.exe | 142.250.186.174:443 | sb-ssl.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
accounts.google.com |
| shared |
github.com |
| shared |
objects.githubusercontent.com |
| shared |
www.google.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |
safebrowsing.google.com |
| whitelisted |
itroublvehacker.gq |
| whitelisted |
dns.msftncsi.com |
| shared |
api64.ipify.org |
| unknown |
discord.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1088 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .gq Domain |
1088 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
— | — | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
1088 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
— | — | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
904 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |