| File name: | Find Wallet v3.2-Crack.exe.zip |
| Full analysis: | https://app.any.run/tasks/23d52ef0-e5ae-44c0-8149-956fcc219f19 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 24, 2025, 15:54:09 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | CC6BAF54F3D6AD7463F272D0781CE753 |
| SHA1: | 83B411038A5DE605CB299D69C7B1252859932C22 |
| SHA256: | 7087799FC34BF8538C11CE734E3CD2D31290915D49AF765A1C889E847C0264F4 |
| SSDEEP: | 49152:OuL5792r556LDhdVKXGAcu9oZ8p+c5KVRZ0DptiCHmAge4H9WnO3lsDgP7sOLuHI:L57906LlyXJl9oapL5M0D3iCOH9Wncll |
MALICIOUS
Actions looks like stealing of personal data
- Find Wallet v3.2-Crack.exe (PID: 5968)
- Client.exe (PID: 4188)
NESHTA mutex has been found
- Find Wallet v3.2-Crack.exe (PID: 5968)
SUSPICIOUS
Checks for external IP
- Client.exe (PID: 4188)
- svchost.exe (PID: 2196)
There is functionality for taking screenshot (YARA)
- Find Wallet v3.2-Crack.exe (PID: 5968)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- Client.exe (PID: 4188)
Executable content was dropped or overwritten
- Find Wallet v3.2-Crack.exe (PID: 5968)
- Find Wallet v3.2-Crack.exe (PID: 1128)
Mutex name with non-standard characters
- Find Wallet v3.2-Crack.exe (PID: 5968)
Write to the desktop.ini file (may be used to cloak folders)
- Client.exe (PID: 4188)
INFO
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 4428)
- Client.exe (PID: 4188)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7352)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6620)
Reads the machine GUID from the registry
- Find Wallet v3.2-Crack.exe (PID: 7276)
Manual execution by a user
- Find Wallet v3.2-Crack.exe (PID: 5968)
Create files in a temporary directory
- Client.exe (PID: 4188)
Checks supported languages
- Client.exe (PID: 4188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0009 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2025:03:24 15:05:10 |
| ZipCRC: | 0xf3d22a7a |
| ZipCompressedSize: | 1578798 |
| ZipUncompressedSize: | 3742208 |
| ZipFileName: | Find Wallet v3.2-Crack.exe.bin |
Total processes
146
Monitored processes
13
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1128 | "C:\Users\admin\AppData\Local\Temp\3582-490\Find Wallet v3.2-Crack.exe" | C:\Users\admin\AppData\Local\Temp\3582-490\Find Wallet v3.2-Crack.exe | Find Wallet v3.2-Crack.exe | ||||||||||||
User: admin Company: bitter Integrity Level: MEDIUM Description: sissyaccomplice Exit code: 0 Version: 4.6.11.32 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4188 | "C:\Users\admin\AppData\Roaming\Client.exe" | C:\Users\admin\AppData\Roaming\Client.exe | Find Wallet v3.2-Crack.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: RL Version: 1.0.0.0 Modules
| |||||||||||||||
| 4428 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4652 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4724 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5968 | "C:\Users\admin\Desktop\Find Wallet v3.2-Crack.exe" | C:\Users\admin\Desktop\Find Wallet v3.2-Crack.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6620 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7276 | "C:\Users\admin\AppData\Roaming\Find Wallet v3.2-Crack.exe" | C:\Users\admin\AppData\Roaming\Find Wallet v3.2-Crack.exe | — | Find Wallet v3.2-Crack.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Find-Wallet Version: 3.2 Modules
| |||||||||||||||
| 7352 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Find Wallet v3.2-Crack.exe.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
Total events
7 862
Read events
7 823
Write events
39
Delete events
0
Modification events
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Find Wallet v3.2-Crack.exe.zip | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7352) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (6620) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
11
Suspicious files
19
Text files
42
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4428 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6c4c6cd3-1216-4c79-a3a1-e3fa4f29986f.down_data | — | |
MD5:— | SHA256:— | |||
| 4188 | Client.exe | C:\Users\admin\AppData\Local\Temp\places.raw | — | |
MD5:— | SHA256:— | |||
| 5968 | Find Wallet v3.2-Crack.exe | C:\Users\admin\AppData\Local\Temp\3582-490\Find Wallet v3.2-Crack.exe | executable | |
MD5:68F929DC1286BF7AF65BF056845F9B42 | SHA256:0D20648267D3004BA95B04F9EF01F3F6E40644B46773990807C2741ADBDD3D82 | |||
| 4428 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\55d2f8d5-47dc-4dba-a15c-1cff6ce6b797.up_meta_secure | binary | |
MD5:A899C158460EBC9BE6ABE304426D724B | SHA256:8050E045EAD243F1B9A7DF609FCA1E84479D4301D69D453D1F9DE59D1BC669C5 | |||
| 4428 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\55d2f8d5-47dc-4dba-a15c-1cff6ce6b797.309a4884-6358-41be-b700-d6c7618e1acc.down_meta | binary | |
MD5:D90837837481F644B23506E79BDE5C40 | SHA256:E35230A1D12F0F2DD76FC64D3AB4305CC797A52CB9C0739596B1AC136757DF5D | |||
| 7352 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7352.47040\Find Wallet v3.2-Crack.exe.bin | executable | |
MD5:A5AAD19F2467992040DCE284A1D34016 | SHA256:6131F59ADE95F5AAF4F78C1CBD31F033AE508BAE3418D30AD9B7E35E3F96BEB6 | |||
| 1128 | Find Wallet v3.2-Crack.exe | C:\Users\admin\AppData\Roaming\Find Wallet v3.2-Crack.exe | executable | |
MD5:C309CB9865DFC6DBB7F977F4C0F722C0 | SHA256:51472E512316807270D85560BF6E3030355007C36A4F74D59A286411BB5378B5 | |||
| 4188 | Client.exe | C:\Users\admin\AppData\Local\DESKTOP-JGLLJLD\FileGrabber\Desktop\abovesound.jpg | image | |
MD5:2147C3AA31A9BAD8B7165746C20F2A9A | SHA256:90171245CE14E50C84875E20393FD90365407D2263D3EA7EBA367AD7045B76B3 | |||
| 4188 | Client.exe | C:\Users\admin\AppData\Local\DESKTOP-JGLLJLD\FileGrabber\Desktop\desktop.ini | text | |
MD5:9E36CC3537EE9EE1E3B10FA4E761045B | SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026 | |||
| 1128 | Find Wallet v3.2-Crack.exe | C:\Users\admin\AppData\Roaming\Client.exe | executable | |
MD5:BC5DA83795B587FB1DFCE2D6BEF2D176 | SHA256:D8539AEC2E01D20B840F4C35AE675ECA7F85DE828282D03C4AABAD6034CD8FFB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
42
DNS requests
21
Threats
28
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.124:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7612 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
2420 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4428 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
4188 | Client.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
4188 | Client.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
2420 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4188 | Client.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
4188 | Client.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.168.124:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 40.126.31.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7612 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4188 | Client.exe | Misc activity | ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI) |
4188 | Client.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] SNI External IP Domain Lookup (freegeoip .app) |
4188 | Client.exe | Misc activity | ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI) |
2196 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Checker Domain (freegeoip .app) |
4188 | Client.exe | Potentially Bad Traffic | ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI) |
2196 | svchost.exe | Potentially Bad Traffic | ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com) |
4188 | Client.exe | Misc activity | ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI) |
4188 | Client.exe | Misc activity | ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI) |
4188 | Client.exe | Misc activity | ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI) |
4188 | Client.exe | Misc activity | ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI) |