URL:

http://aldn.altools.co.kr/setup/ALZip109.exe

Full analysis: https://app.any.run/tasks/ca68805b-5817-42b5-905d-4f1cae1d9a3e
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 27, 2019, 08:50:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MD5:

8A2F44D053A750F24F477EFF7F016D8B

SHA1:

BA72240E5C25615903F4259A40927DB06B4A39FF

SHA256:

7E501279D7547B6804B19D81F1EC414D8864BF1D96FBF08EBC55250AB0461C8B

SSDEEP:

3:N1KfzSY+KWOn+VO:CT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • chrome.exe (PID: 2128)

    • Loads dropped or rewritten executable

      • ALZip109.exe (PID: 1860)
      • stext.exe (PID: 2680)

    • Application was dropped or rewritten from another process

      • ALZip109.exe (PID: 2508)
      • stext.exe (PID: 2680)
      • stext.exe (PID: 3988)
      • ALZip109.exe (PID: 1860)
      • eventextension.exe (PID: 3472)
      • ezt.exe (PID: 1104)
      • eventextension.exe (PID: 2408)

    • Connects to CnC server

      • stext.exe (PID: 2680)
      • ALZip109.exe (PID: 1860)

    • Registers / Runs the DLL via REGSVR32.EXE

      • ALZip109.exe (PID: 1860)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2128)
      • ALZip109.exe (PID: 1860)

    • Reads internet explorer settings

      • stext.exe (PID: 2680)
      • ALZip109.exe (PID: 1860)

    • Creates files in the user directory

      • rundll32.exe (PID: 2148)
      • ALZip109.exe (PID: 1860)
      • eventextension.exe (PID: 2408)

    • Uses RUNDLL32.EXE to load library

      • stext.exe (PID: 2680)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 3860)
      • rundll32.exe (PID: 2148)
      • rundll32.exe (PID: 3808)
      • ALZip109.exe (PID: 1860)
      • eventextension.exe (PID: 2408)

    • Changes the started page of IE

      • ezt.exe (PID: 1104)

    • Creates files in the program directory

      • ALZip109.exe (PID: 1860)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2124)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2128)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2128)

    • Creates files in the user directory

      • chrome.exe (PID: 2128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
21
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs alzip109.exe no specs alzip109.exe stext.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs chrome.exe no specs stext.exe no specs eventextension.exe ezt.exe no specs eventextension.exe regsvr32.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1104"C:\Program Files\ESTsoft\Common\ezt.exe" -euppd -regstartrun http://zum.com/?af=alC:\Program Files\ESTsoft\Common\ezt.exe—eventextension.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
HIGH
Description:
ezt
Exit code:
0
Version:
16, 7, 29, 1
Modules
Images
c:\program files\estsoft\common\ezt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1476"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=960,15087736579650055368,10115477344319233266,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=17886513107392092211 --mojo-platform-channel-handle=972 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,15087736579650055368,10115477344319233266,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5269099098497767255 --mojo-platform-channel-handle=1964 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1844"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2500 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1860"C:\Users\admin\Downloads\ALZip109.exe" C:\Users\admin\Downloads\ALZip109.exe
chrome.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
HIGH
Description:
알집 v10.90 공개용 설치 프로그램
Exit code:
0
Version:
19.5.15.2
Modules
Images
c:\users\admin\downloads\alzip109.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2124regsvr32.exe /s "C:\Program Files\ESTsoft\ALZip\AZCTM.dll"C:\Windows\system32\regsvr32.exe—ALZip109.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2128"C:\Program Files\Google\Chrome\Application\chrome.exe" http://aldn.altools.co.kr/setup/ALZip109.exeC:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2148"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—stext.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
2408C:\Users\admin\AppData\Local\Temp\nssB720.tmD\eventextension.exe /cmd=startpage /startpage='http://zum.com/?af=al' /state=1 /code='ALZip' /url='http://ko-kr.install.altools.com/InstallerPattern.aspx?url=%StartPage%&no=%CheckBoxState%&pd=%Product%&cr=%ChangeResult%&sr=%SendResult%&cv=%CoopVer%&ov=%OSVer%&ch=zum' /send='http://zum.com/setpage/?version=%Version%&code=%StartPage%&product=%Product%&sender=nsis&locale=ko-kr&flag=%CheckBoxState%' /urllist='10|naver.com|11|daum.net|12|yahoo.com|13|empas.com|14|nate.com|15|google.com|16|zum.com' /sendCondition='1' /RegBackupChange /EuppDisable /extStartSetter='C:\Program Files\ESTsoft\Common\ezt.exe'/ /sendonly=true /oldStartpage=0 C:\Users\admin\AppData\Local\Temp\nssB720.tmD\eventextension.exe
eventextension.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
LOW
Description:
EventExtension
Exit code:
1
Version:
16, 5, 30, 0
Modules
Images
c:\users\admin\appdata\local\temp\nssb720.tmd\eventextension.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2508"C:\Users\admin\Downloads\ALZip109.exe" C:\Users\admin\Downloads\ALZip109.exe—chrome.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
MEDIUM
Description:
알집 v10.90 공개용 설치 프로그램
Exit code:
3221226540
Version:
19.5.15.2
Modules
Images
c:\users\admin\downloads\alzip109.exe
c:\systemroot\system32\ntdll.dll
Total events
1 651
Read events
1 484
Write events
163
Delete events
4

Modification events

(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2128-13206099073494750
Value:
259
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2128) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3488-13197474229333984
Value:
0
(PID) Process:(2128) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
65
Suspicious files
24
Text files
171
Unknown types
10

Dropped files

PID
Process
Filename
Type
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2b4f5552-61c8-44b5-98be-fbb9bf3f097e.tmp —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index —
MD5:—
SHA256:—
2128chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
24
DNS requests
14
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1860
ALZip109.exe
GET
—
218.153.8.60:80
http://ko-kr.alupdateadd.altools.com/icon/halfclub_desktop.ico
KR
—
—
unknown
2680
stext.exe
POST
200
218.153.8.56:80
http://ko-KR.altoolsinst.altools.com/show/public_addin.aspx
KR
html
3.18 Kb
malicious
1860
ALZip109.exe
POST
200
218.153.8.56:80
http://ko-kr.altoolsinst.altools.com/show/public_end_normal.aspx
KR
html
1.21 Kb
malicious
1860
ALZip109.exe
POST
200
218.153.8.56:80
http://ko-kr.altoolsinst.altools.com/show/public_run.aspx
KR
html
1.21 Kb
malicious
2680
stext.exe
POST
200
218.153.8.56:80
http://ko-KR.altoolsinst.altools.com/start/setupset.aspx
KR
html
1.95 Kb
malicious
3472
eventextension.exe
GET
200
218.153.8.57:80
http://ko-kr.install.altools.com/InstallerPattern.aspx?url=0&no=1&pd=ALZip&cr=1&sr=1&cv=2.0&ov=8.2.6.1&ch=zum
KR
html
634 b
unknown
2680
stext.exe
POST
200
218.153.8.56:80
http://ko-kr.altoolsinst.altools.com/options/getoptionsxml.ashx
KR
xml
3.07 Kb
malicious
1860
ALZip109.exe
GET
200
54.230.202.84:80
http://cf-xdn.altools.co.kr/Ex_image/20130717_alcapture_nsis/20130716_alcapture_415210.jpg
US
image
94.3 Kb
shared
1860
ALZip109.exe
GET
200
54.230.202.84:80
http://cf-xdn.altools.co.kr/legacy/new_2018_da/11/190613_rounz2_nsis_middle_493100.jpg
US
image
52.1 Kb
shared
1860
ALZip109.exe
GET
200
218.153.8.60:80
http://ko-kr.alupdateadd.altools.com/icon/wemakeprice.ico
KR
image
106 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2128
chrome.exe
172.217.23.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2128
chrome.exe
216.58.207.45:443
accounts.google.com
Google Inc.
US
whitelisted
2128
chrome.exe
216.58.206.4:443
www.google.com
Google Inc.
US
whitelisted
2128
chrome.exe
54.230.202.29:80
aldn.altools.co.kr
Amazon.com, Inc.
US
suspicious
2128
chrome.exe
172.217.18.99:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2128
chrome.exe
216.58.208.46:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2680
stext.exe
218.153.8.56:80
ko-kr.altoolsinst.altools.com
Korea Telecom
KR
malicious
1860
ALZip109.exe
218.153.8.56:80
ko-kr.altoolsinst.altools.com
Korea Telecom
KR
malicious
1860
ALZip109.exe
218.153.8.60:80
ko-kr.alupdateadd.altools.com
Korea Telecom
KR
unknown
3472
eventextension.exe
218.153.8.57:80
ko-kr.install.altools.com
Korea Telecom
KR
unknown

DNS requests

Domain
IP
Reputation
aldn.altools.co.kr
  • 54.230.202.29
  • 54.230.202.212
  • 54.230.202.8
  • 54.230.202.94
whitelisted
clientservices.googleapis.com
  • 172.217.23.163
whitelisted
accounts.google.com
  • 216.58.207.45
shared
www.google.com
  • 216.58.206.4
malicious
ssl.gstatic.com
  • 172.217.18.99
whitelisted
sb-ssl.google.com
  • 216.58.208.46
whitelisted
ko-kr.altoolsinst.altools.com
  • 218.153.8.56
malicious
cf-xdn.altools.co.kr
  • 54.230.202.84
  • 54.230.202.97
  • 54.230.202.161
  • 54.230.202.205
shared
zum.com
  • 121.189.40.10
shared
ko-kr.alupdateadd.altools.com
  • 218.153.8.60
unknown

Threats

PID
Process
Class
Message
2128
chrome.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
2128
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2680
stext.exe
Misc activity
ADWARE [PTsecurity] ALTools PUA Installation Check-in
2680
stext.exe
Misc activity
ADWARE [PTsecurity] ALTools PUA Installation Check-in
2680
stext.exe
Misc activity
ADWARE [PTsecurity] ALTools PUA Installation Check-in
1860
ALZip109.exe
Misc activity
ADWARE [PTsecurity] ALTools PUA Installation Check-in
7 ETPRO signatures available at the full report
Process
Message
ALZip109.exe
called Fucntion .onInit
ALZip109.exe
called Fucntion .ESTOnGUIInit
ALZip109.exe
URL http://zum.com/?af=al
ALZip109.exe
Name zumÀ» ȨÆäÀÌÁö·Î
ALZip109.exe
checkurl zum.com;zum.co.kr
ALZip109.exe
sendurl http://zum.com/setpage/?version=%Version%&code=%StartPage%&product=%Product%&sender=nsis&locale=ko-kr&flag=%CheckBoxState%
ALZip109.exe
changename zum
ALZip109.exe
default 1
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://aldn.altools.co.kr/setup/ALZip109.exe