Find similar analyses in TI Lookup

Analysis date (UTC): 27 June 2019, 08:50Analysis environment: Windows 7 Pro, build 7601, x86

http://aldn.altools.co.kr/setup/ALZip109.exe

MD5:8A2F44D053A750F24F477EFF7F016D8B

SHA1:BA72240E5C25615903F4259A40927DB06B4A39FF

SHA256:7E501279D7547B6804B19D81F1EC414D8864BF1D96FBF08EBC55250AB0461C8B

Analysis result

Threat level:Malicious activity

Tags:

loaderadware

Full analysis:Analysis http://aldn.altools.co.kr/setup/ALZip109.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

ALZip109.exe (PID: 2508)
ALZip109.exe (PID: 1860)
stext.exe (PID: 2680)
stext.exe (PID: 3988)
eventextension.exe (PID: 3472)
eventextension.exe (PID: 2408)
ezt.exe (PID: 1104)

Downloads executable files from the Internet

chrome.exe (PID: 2128)

Loads dropped or rewritten executable

ALZip109.exe (PID: 1860)
stext.exe (PID: 2680)

Connects to CnC server

stext.exe (PID: 2680)
ALZip109.exe (PID: 1860)

Registers / Runs the DLL via REGSVR32.EXE

ALZip109.exe (PID: 1860)

SUSPICIOUS

Uses RUNDLL32.EXE to load library

stext.exe (PID: 2680)

Executable content was dropped or overwritten

ALZip109.exe (PID: 1860)
chrome.exe (PID: 2128)

Creates files in the user directory

rundll32.exe (PID: 2148)
ALZip109.exe (PID: 1860)
eventextension.exe (PID: 2408)

Reads Internet Cache Settings

rundll32.exe (PID: 2148)
rundll32.exe (PID: 3860)
rundll32.exe (PID: 3808)
ALZip109.exe (PID: 1860)
eventextension.exe (PID: 2408)

Reads internet explorer settings

stext.exe (PID: 2680)
ALZip109.exe (PID: 1860)

Changes the started page of IE

ezt.exe (PID: 1104)

Creates COM task schedule object

regsvr32.exe (PID: 2124)

Creates files in the program directory

ALZip109.exe (PID: 1860)

INFO

Application launched itself

chrome.exe (PID: 2128)

Reads Internet Cache Settings

chrome.exe (PID: 2128)

Creates files in the user directory

chrome.exe (PID: 2128)

Threats

PID	Process	Class	Message
2128	chrome.exe	Potentially Bad Traffic	ET POLICY Executable served from Amazon S3
2128	chrome.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2680	stext.exe	Misc activity	ADWARE [PTsecurity] ALTools PUA Installation Check-in
2680	stext.exe	Misc activity	ADWARE [PTsecurity] ALTools PUA Installation Check-in
2680	stext.exe	Misc activity	ADWARE [PTsecurity] ALTools PUA Installation Check-in
1860	ALZip109.exe	Misc activity	ADWARE [PTsecurity] ALTools PUA Installation Check-in