File name:

Setup_File_KMS_Pico.exe

Full analysis: https://app.any.run/tasks/ae2feaf8-069b-48a9-9d2c-be9df84a9cdf
Verdict: Malicious activity
Threats:

CryptBot is an advanced Windows-targeting infostealer delivered via pirate sites with "cracked" software. It has been first observed in the wild in 2019.

Malware Trends Tracker     >>>
Analysis date: September 26, 2023, 08:38:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
autoit
cryptbot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

541F64D5D78ED7A50017728FEE6F4CE7

SHA1:

866D3056DC235C972087A3E9B7E4972C155DED76

SHA256:

7A79F51660CA4662F0E0B783DE8330F3C1157911968D04D8DD339A4AC0F3B386

SSDEEP:

196608:ZDz6BTdm03Pw4VrqACUdelOWZPrs+PPYJ:d6rm03PJqCdelOMrsqa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2716)

    • Application was dropped or rewritten from another process

      • KMS_pico.exe (PID: 2528)
      • KMS_pico.exe (PID: 1796)
      • consev.exe (PID: 3000)

    • Steals credentials

      • KMS_pico.exe (PID: 2396)

    • Loads dropped or rewritten executable

      • KMS_pico.tmp (PID: 1196)

    • CRYPTBOT detected by memory dumps

      • KMS_pico.exe (PID: 2396)

    • Starts CMD.EXE for self-deleting

      • KMS_pico.exe (PID: 2396)

    • Actions looks like stealing of personal data

      • KMS_pico.exe (PID: 2396)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Setup_File_KMS_Pico.exe (PID: 3564)
      • KMS_pico.exe (PID: 2396)

    • Drops the AutoIt3 executable file

      • KMS_pico.exe (PID: 2396)

    • Starts CMD.EXE for commands execution

      • KMS_pico.exe (PID: 2396)

    • Searches for installed software

      • KMS_pico.exe (PID: 2396)

    • Reads the Windows owner or organization settings

      • KMS_pico.tmp (PID: 1196)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2792)

    • The process executes via Task Scheduler

      • consev.exe (PID: 3000)

    • Reads browser cookies

      • KMS_pico.exe (PID: 2396)

  • INFO

    • Reads product name

      • KMS_pico.exe (PID: 2396)

    • Checks supported languages

      • Setup_File_KMS_Pico.exe (PID: 3564)
      • KMS_pico.exe (PID: 2396)
      • KMS_pico.tmp (PID: 1196)
      • KMS_pico.exe (PID: 1796)
      • KMS_pico.exe (PID: 2528)
      • KMS_pico.tmp (PID: 2288)
      • consev.exe (PID: 3000)

    • Creates files or folders in the user directory

      • KMS_pico.exe (PID: 2396)

    • Reads the computer name

      • Setup_File_KMS_Pico.exe (PID: 3564)
      • KMS_pico.exe (PID: 2396)
      • KMS_pico.tmp (PID: 2288)
      • KMS_pico.tmp (PID: 1196)

    • Create files in a temporary directory

      • Setup_File_KMS_Pico.exe (PID: 3564)
      • KMS_pico.exe (PID: 2396)
      • KMS_pico.exe (PID: 1796)
      • KMS_pico.tmp (PID: 1196)
      • KMS_pico.exe (PID: 2528)

    • Reads Environment values

      • KMS_pico.exe (PID: 2396)

    • Reads Windows Product ID

      • KMS_pico.exe (PID: 2396)

    • Reads the machine GUID from the registry

      • KMS_pico.exe (PID: 2396)

    • Reads CPU info

      • KMS_pico.exe (PID: 2396)

    • Checks proxy server information

      • KMS_pico.exe (PID: 2396)

    • Reads mouse settings

      • consev.exe (PID: 3000)

    • Application was dropped or rewritten from another process

      • KMS_pico.tmp (PID: 2288)
      • KMS_pico.tmp (PID: 1196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CryptBot

(PID) Process(2396) KMS_pico.exe
C2http://sgizfn14.top/gate.php;
Options
CookiesFirefoxfalse
Screenshottrue
Wallettrue
ChromeExttrue
CookiesEdgefalse
HistoryEdgefalse
Desktoptrue
EdgeExttrue
HistoryChromefalse
EdgeDBtrue
CookiesOperafalse
ChromeDBtrue
CookiesChromefalse
Firefoxfalse
HistoryFirefoxfalse
Edgefalse
FirefoxDBtrue
Operafalse
Chromefalse
HistoryOperafalse
ScreenFile$CREEN.PNG
PasswordFile_AllPasswords.txt
FirefoxDBFolder_Firefox
InfoFile_Information.txt
DesktopFolder_Desktop
CookiesFile_AllCookies.txt
ChromeDBFolder_Chrome
DeleteAfterEndtrue
HistoryFile_AllHistory.txt
UserAgentMozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Prefixmrd-
EdgeDBFolder_Edge
MessageAfterEndfalse
WalletFolder_Wallet
ExternalDownload
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

LanguageId: en
ProductVersion: 1.3.541.1
ProductName: Dropbox Update
OriginalFileName: DropboxUpdateSetup.exe
LegalCopyright: Copyright: Dropbox, Inc. 2015 (Omaha Copyright Google Inc.)
InternalName: Dropbox Update Setup
FileVersion: 1.3.541.1
FileDescription: Dropbox Update Setup
CompanyName: Dropbox, Inc.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.3.541.1
FileVersionNumber: 1.3.541.1
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1ec40
UninitializedDataSize: -
InitializedDataSize: 787968
CodeSize: 201216
LinkerVersion: 14
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2020:12:01 18:00:55+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
12
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start setup_file_kms_pico.exe no specs #CRYPTBOT kms_pico.exe cmd.exe no specs schtasks.exe no specs cmd.exe no specs kms_pico.exe no specs kms_pico.tmp no specs kms_pico.exe kms_pico.tmp no specs cmd.exe no specs timeout.exe no specs consev.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196"C:\Users\admin\AppData\Local\Temp\is-93U10.tmp\KMS_pico.tmp" /SL5="$B0178,2952592,69120,C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe" /SPAWNWND=$40162 /NOTIFYWND=$60184 C:\Users\admin\AppData\Local\Temp\is-93U10.tmp\KMS_pico.tmp—KMS_pico.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-93u10.tmp\kms_pico.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe" /SPAWNWND=$40162 /NOTIFYWND=$60184 C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe
KMS_pico.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\roaming\faxjrc\kms_pico.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2288"C:\Users\admin\AppData\Local\Temp\is-J1D3D.tmp\KMS_pico.tmp" /SL5="$60184,2952592,69120,C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe" C:\Users\admin\AppData\Local\Temp\is-J1D3D.tmp\KMS_pico.tmp—KMS_pico.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-j1d3d.tmp\kms_pico.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2396"C:\Users\admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
Setup_File_KMS_Pico.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
5439627
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\kms_pico.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
CryptBot
(PID) Process(2396) KMS_pico.exe
C2http://sgizfn14.top/gate.php;
Options
CookiesFirefoxfalse
Screenshottrue
Wallettrue
ChromeExttrue
CookiesEdgefalse
HistoryEdgefalse
Desktoptrue
EdgeExttrue
HistoryChromefalse
EdgeDBtrue
CookiesOperafalse
ChromeDBtrue
CookiesChromefalse
Firefoxfalse
HistoryFirefoxfalse
Edgefalse
FirefoxDBtrue
Operafalse
Chromefalse
HistoryOperafalse
ScreenFile$CREEN.PNG
PasswordFile_AllPasswords.txt
FirefoxDBFolder_Firefox
InfoFile_Information.txt
DesktopFolder_Desktop
CookiesFile_AllCookies.txt
ChromeDBFolder_Chrome
DeleteAfterEndtrue
HistoryFile_AllHistory.txt
UserAgentMozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Prefixmrd-
EdgeDBFolder_Edge
MessageAfterEndfalse
WalletFolder_Wallet
ExternalDownload
2528C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe—cmd.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\roaming\faxjrc\kms_pico.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
2716 /C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\admin\AppData\Roaming\faxjrc\consev.exe""" """C:\Users\admin\AppData\Roaming\faxjrc\consev.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /fC:\Windows\System32\cmd.exe—KMS_pico.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\usp10.dll
2760schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\admin\AppData\Roaming\faxjrc\consev.exe""" """C:\Users\admin\AppData\Roaming\faxjrc\consev.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2780 /C "C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe"C:\Windows\System32\cmd.exe—KMS_pico.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2792"C:\Windows\System32\cmd.exe" /c timeout -t 5 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe"C:\Windows\System32\cmd.exe—KMS_pico.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2812timeout -t 5 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
Total events
2 815
Read events
2 795
Write events
20
Delete events
0

Modification events

(PID) Process:(3564) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3564) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3564) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3564) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2396) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2396) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2396) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2396) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2396) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2396) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
5
Suspicious files
28
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
3564Setup_File_KMS_Pico.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe —
MD5:—
SHA256:—
2396KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\consev.dattext
MD5:532B7CC788160997EA22DEEC6F7D69F8
SHA256:DFB8264953A5D0D7DB1EB289430285B488A147F44DDEBAEC70B6EC7D7219FAF0
2396KMS_pico.exeC:\Users\admin\AppData\Local\Temp\E431.tmpbinary
MD5:FBD34F0AB5E3F18371CF71395F40C3C5
SHA256:17C9F4CB0FA71685013A864174352D87B1FE35CC3F3B499DF92EEDA3ABB8F862
2396KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exeexecutable
MD5:A02164371A50C5FF9FA2870EF6E8CFA3
SHA256:64C731ADBE1B96CB5765203B1E215093DCF268D020B299445884A4AE62ED2D3A
2396KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\consev.exeexecutable
MD5:C56B5F0201A3B3DE53E561FE76912BFD
SHA256:237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
2396KMS_pico.exeC:\Users\admin\AppData\Local\Temp\E472.tmpbinary
MD5:8A7582AF1F2D6B0383C8A955A623AF86
SHA256:DEC597F44990462BF14BCAD05E9D9C20BC636446E62C1671EF4DEE9B151DEF24
2528KMS_pico.exeC:\Users\admin\AppData\Local\Temp\is-J1D3D.tmp\KMS_pico.tmpexecutable
MD5:1778C1F66FF205875A6435A33229AB3C
SHA256:95C06ACAC4FE4598840E5556F9613D43AA1039C52DAC64536F59E45A70F79DA6
2396KMS_pico.exeC:\Users\admin\AppData\Local\Temp\E371.tmptext
MD5:17F95CAF560E05E9B51AA429081A31BC
SHA256:14D3A68B607FFA75CC9285BA0DB474EF3452DCFA1F9E96529C067B194A6F9AF1
2396KMS_pico.exeC:\Users\admin\AppData\Local\Temp\E40F.tmpbinary
MD5:8A7582AF1F2D6B0383C8A955A623AF86
SHA256:DEC597F44990462BF14BCAD05E9D9C20BC636446E62C1671EF4DEE9B151DEF24
2396KMS_pico.exeC:\Users\admin\AppData\Local\Temp\E462.tmpbinary
MD5:F47EB60CDF981C17722D0CE740129927
SHA256:0210071DF12CA42D70DCB679926668AE072264705AC139A24F94BBC5A129DD8F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
sgizfn14.top
  • —
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_File_KMS_Pico.exe