analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BitToolUltimate.zip

Full analysis: https://app.any.run/tasks/9d149683-65d6-4ae9-86cc-e350e9bbbb3d
Verdict: Malicious activity
Analysis date: August 08, 2020, 20:13:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

68D359796C73A2620A5F6D5066FBDC91

SHA1:

1EA9F7E5ABEF72987C54A62829AD69221A8C5641

SHA256:

7C351BC80B85AA63641F43FC24BA27188963F64B169EAA53684715B0A423DCF3

SSDEEP:

6144:eZp662jsPvGVLUsUUxZbpEV5sqO7TcgW6chh0mBHE+Ts86EZ+oDOw/3Iq:y662UvGVLUsZpc5sqOlbcw05Q86ENa+X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BitTool Ultimate.exe (PID: 3576)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2848)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 3656)
      • chrome.exe (PID: 3708)

    • Manual execution by user

      • BitTool Ultimate.exe (PID: 3576)
      • chrome.exe (PID: 3656)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3708)

    • Dropped object may contain Bitcoin addresses

      • BitTool Ultimate.exe (PID: 3576)

    • Application launched itself

      • chrome.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: BitTool Ultimate.exe
ZipUncompressedSize: 457216
ZipCompressedSize: 350720
ZipCRC: 0x15d78009
ZipModifyDate: 2020:05:29 05:40:17
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
28
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe bittool ultimate.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2848"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\BitToolUltimate.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3576"C:\Users\admin\Desktop\BitTool Ultimate.exe" C:\Users\admin\Desktop\BitTool Ultimate.exe—explorer.exe
User:
admin
Company:
BitTools Inc.
Integrity Level:
MEDIUM
Description:
BitTool Ultimate
Version:
2.5.0.0
3656"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6acea9d0,0x6acea9e0,0x6acea9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3676"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2624 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2964"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1012,1535299903799426148,3909263506786942661,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=12926051643495071736 --mojo-platform-channel-handle=1028 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3708"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1012,1535299903799426148,3909263506786942661,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=947315783363775141 --mojo-platform-channel-handle=1648 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
256"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1012,1535299903799426148,3909263506786942661,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=596904302512009627 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1012,1535299903799426148,3909263506786942661,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17715796521850295079 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1400"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1012,1535299903799426148,3909263506786942661,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6074365554919234609 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
1 247
Read events
1 122
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
64
Text files
90
Unknown types
2

Dropped files

PID
Process
Filename
Type
3576BitTool Ultimate.exeC:\Users\admin\AppData\Local\BitTools_Inc\BitTool_Ultimate.exe_Url_5yrl3lj1svzzqwyafaojmdvsbmvzbgtn\2.5.0.0\j3hsl0fa.newcfg —
MD5:—
SHA256:—
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ca3cae2c-76f2-4412-af09-0b5d90891308.tmp —
MD5:—
SHA256:—
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFe65ab.TMPtext
MD5:1B8E44CB8872BF26BC5219E37A700F8A
SHA256:FD3D4BC8A7D28A05D1321F1D175FB59FC2BCC3532B92274A50133C22F0A0480A
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RFe65da.TMPtext
MD5:D11C35B3D5258F594933332C11C6F0F2
SHA256:DC2EB16E16FA3FB258AC31A481F817208CF0C917AF4224F2832588D3A64ADD05
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:988975E56D776333B46F1BCAE6967C0E
SHA256:22186F0422A02BE70860975EF688A895EEA653C3A7259FFBA9114138A544E05A
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:142AFC7F980CB38310D0680F2E8907CF
SHA256:3D5E5DF95E28CF65C77882748077EC52706AF02F8D869E188B6D16F782F82F44
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:1B8E44CB8872BF26BC5219E37A700F8A
SHA256:FD3D4BC8A7D28A05D1321F1D175FB59FC2BCC3532B92274A50133C22F0A0480A
2848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2848.44269\BitTool Ultimate.exeexecutable
MD5:59F21D4D321475C16B2E07EA8EFB9474
SHA256:D0B092463DB5D12AD840A2706FED4F616A728C5DE99224817ACC1C170060C936
3656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RFe6609.TMPtext
MD5:142AFC7F980CB38310D0680F2E8907CF
SHA256:3D5E5DF95E28CF65C77882748077EC52706AF02F8D869E188B6D16F782F82F44
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
35
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3708
chrome.exe
GET
301
104.23.99.190:80
http://pastebin.com/ULjfGwZm
US
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3708
chrome.exe
172.217.21.195:443
www.gstatic.com
Google Inc.
US
whitelisted
3708
chrome.exe
172.217.23.100:443
www.google.com
Google Inc.
US
whitelisted
3708
chrome.exe
172.217.23.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3708
chrome.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3708
chrome.exe
172.217.16.142:443
clients1.google.com
Google Inc.
US
whitelisted
—
—
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
3708
chrome.exe
216.58.212.174:443
apis.google.com
Google Inc.
US
whitelisted
3708
chrome.exe
104.23.99.190:80
pastebin.com
Cloudflare Inc
US
malicious
3708
chrome.exe
172.217.22.110:443
clients2.google.com
Google Inc.
US
whitelisted
3708
chrome.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.23.100
whitelisted
clientservices.googleapis.com
  • 172.217.23.131
whitelisted
accounts.google.com
  • 216.58.210.13
shared
fonts.googleapis.com
  • 172.217.16.170
whitelisted
www.gstatic.com
  • 172.217.21.195
whitelisted
fonts.gstatic.com
  • 216.58.212.163
whitelisted
apis.google.com
  • 216.58.212.174
whitelisted
ogs.google.com
  • 172.217.23.110
whitelisted
clients2.google.com
  • 172.217.22.110
whitelisted
ssl.gstatic.com
  • 216.58.212.163
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BitToolUltimate.zip