analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cdn.discordapp.com/attachments/357538837469069325/716045021933207592/Im_a_dolphin_trust_me_cip_cip.exe

Full analysis: https://app.any.run/tasks/9a9696f0-1196-4a72-bcb0-ccb799775706
Verdict: Malicious activity
Analysis date: May 30, 2020, 13:21:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5C763563F4BC735373FD0E11BC6C7976

SHA1:

77EB2B9DEDC4D5775C184988235CEE33612D02B5

SHA256:

686E07D2459157B7336190B2CEDCBFA4998D2F447558B099C8D2F1A2DDF96D67

SSDEEP:

3:N8cCWdy6//Xjal2nAaKUcWASJasHT4KWe5VkA:2cry6XXmkH3J8K75VJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 2116)
      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)
      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 2788)

    • Loads dropped or rewritten executable

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

    • Actions looks like stealing of personal data

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2400)
      • iexplore.exe (PID: 960)
      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

    • Cleans NTFS data-stream (Zone Identifier)

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 2116)

    • Reads Internet Cache Settings

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

    • Application launched itself

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 2116)
      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

    • Reads internet explorer settings

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

    • Reads Environment values

      • Im_a_dolphin_trust_me_cip_cip.exe (PID: 1020)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 2400)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 960)

    • Application launched itself

      • iexplore.exe (PID: 960)

    • Creates files in the user directory

      • iexplore.exe (PID: 2400)

    • Changes internet zones settings

      • iexplore.exe (PID: 960)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2400)

    • Changes settings of System certificates

      • iexplore.exe (PID: 960)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe im_a_dolphin_trust_me_cip_cip.exe no specs im_a_dolphin_trust_me_cip_cip.exe im_a_dolphin_trust_me_cip_cip.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\Program Files\Internet Explorer\iexplore.exe" https://cdn.discordapp.com/attachments/357538837469069325/716045021933207592/Im_a_dolphin_trust_me_cip_cip.exeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2400"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:960 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2116"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe—iexplore.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Lefehonubo Setup
Exit code:
0
Version:
1020"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe" RSF /ppn:YWV4dQ0KChAjb3J1FQUI /ads:1 /mnlC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe
Im_a_dolphin_trust_me_cip_cip.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Lefehonubo Setup
Version:
2788"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe" RSF /ppn:YWV4dQ0KChAjb3J1FQUI /ads:1 /_ShowProgress /mnlC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe—Im_a_dolphin_trust_me_cip_cip.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Lefehonubo Setup
Version:
Total events
4 719
Read events
1 106
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
14
Text files
71
Unknown types
5

Dropped files

PID
Process
Filename
Type
2400iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4 —
MD5:—
SHA256:—
2400iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9F74.tmp —
MD5:—
SHA256:—
2400iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9F75.tmp —
MD5:—
SHA256:—
960iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF16DF7317AAD0848C.TMP —
MD5:—
SHA256:—
960iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Im_a_dolphin_trust_me_cip_cip.exe.ymbcers.partial:Zone.Identifier —
MD5:—
SHA256:—
1020Im_a_dolphin_trust_me_cip_cip.exeC:\Users\admin\AppData\Local\Temp\0013136C.log —
MD5:—
SHA256:—
2400iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_F80805103A05D4F74523519C6EAD8FC0der
MD5:E50B2046F6727465EB15E8C8DD79A152
SHA256:CCEDF886E62CB21492D429BF5D2E9C7006648B134381FD004D510DFCB77A00F1
2400iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4der
MD5:6102793C6007A506C66AF6CF1C60A0A8
SHA256:44A129FC45C89CD13D2032E88977976111041419CC4A2F550104BCE5D54D3B18
2400iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9Fder
MD5:3004632495C436646781AA6DE2F741E3
SHA256:080F9AA444109CA863728A5C765ED0F37C9908BF39098472D0C17C678254C6B3
2400iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9Fbinary
MD5:A108F2D152453B24F7B02B87840BDA18
SHA256:C43DF6A17370A2FFD3C3313422FDF1B3ED9714C7EEBF46A20DDE28647EA843E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
9
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1020
Im_a_dolphin_trust_me_cip_cip.exe
POST
200
13.35.254.76:80
http://www1.bekottff-sos.com/
US
—
—
whitelisted
2400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D
US
der
312 b
whitelisted
2400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D
US
der
312 b
whitelisted
2400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEDJAnJQUGG0bwuno3m2vDJ8%3D
US
der
279 b
whitelisted
2400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEDJAnJQUGG0bwuno3m2vDJ8%3D
US
der
279 b
whitelisted
2400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEBblhnjgcJQ5S9%2FbTvymO98%3D
US
der
471 b
whitelisted
1020
Im_a_dolphin_trust_me_cip_cip.exe
POST
200
13.35.254.45:80
http://www1.bekottff-sos.com/
US
—
—
whitelisted
2400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEBblhnjgcJQ5S9%2FbTvymO98%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2400
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2400
iexplore.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
1020
Im_a_dolphin_trust_me_cip_cip.exe
13.35.254.76:80
www1.bekottff-sos.com
—
US
malicious
1020
Im_a_dolphin_trust_me_cip_cip.exe
13.35.254.45:80
www1.bekottff-sos.com
—
US
malicious
—
—
13.35.254.76:80
www1.bekottff-sos.com
—
US
malicious
—
—
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared

DNS requests

Domain
IP
Reputation
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.135.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.133.233
shared
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.comodoca4.com
  • 151.139.128.14
whitelisted
www1.bekottff-sos.com
  • 13.35.254.76
  • 13.35.254.47
  • 13.35.254.75
  • 13.35.254.45
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.discordapp.com/attachments/357538837469069325/716045021933207592/Im_a_dolphin_trust_me_cip_cip.exe