File name:

817

Full analysis: https://app.any.run/tasks/d725e6b1-5b83-479b-8c19-9a1250723b34
Verdict: Malicious activity
Threats:

Ficker Stealer is a malware that steals passwords, files, credit card details, and other types of sensitive information on Windows systems. It is most often distributed via phishing emails and can perform keylogging, process injection, and browser tracking.

Malware Trends Tracker     >>>
Analysis date: August 23, 2021, 05:22:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
redline
opendir
loader
stealer
autoit
ficker
vidar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

724F01298E921F1F7362AF6B1BC31642

SHA1:

E892F38DA2F930133CF67533E592DED56B7D6154

SHA256:

8174D7D1E9CCF99D8A0164E39DBB7DF725CBD710CF2F611D3CA4F2FDEB434535

SSDEEP:

196608:PafYtJ9mT5kszFw1d4zZkxaZzDaC0b8LP3gt82xHWPM/SJrUliFGpKERxRE50:SCJ9E5kszq4zZqwzD30biPwzUPZUliFm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • 817.exe (PID: 3056)
      • md9_1sjm.exe (PID: 912)
      • Folder.exe (PID: 2400)
      • Intere.exe.com (PID: 2364)
      • Files.exe (PID: 1692)

    • Application was dropped or rewritten from another process

      • SoCleanInst.exe (PID: 740)
      • Lsr.exe (PID: 952)
      • md9_1sjm.exe (PID: 912)
      • Info.exe (PID: 1744)
      • File.exe (PID: 1236)
      • Updbdate.exe (PID: 2840)
      • File.exe (PID: 3752)
      • Folder.exe (PID: 1516)
      • tmpBCA0_tmp.exe (PID: 2152)
      • Folder.exe (PID: 2400)
      • pub2.exe (PID: 2504)
      • Install.exe (PID: 2600)
      • Files.exe (PID: 2372)
      • Files.exe (PID: 1692)
      • Install.exe (PID: 2692)
      • VEEvoZX2PyYsZaBlNDSH1g50.exe (PID: 1668)
      • VEEvoZX2PyYsZaBlNDSH1g50.exe (PID: 2872)
      • Intere.exe.com (PID: 2248)
      • Intere.exe.com (PID: 2364)
      • 504jccsHC07RnRMSjzvMtNeT.exe (PID: 3588)
      • jfiag3g_gg.exe (PID: 2428)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 3296)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 900)
      • jfiag3g_gg.exe (PID: 1736)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)
      • efX7rxCXfVYUzI1uXy2HKW4T.exe (PID: 3532)
      • __WrSzGQXtH88BjDO92QZFob.exe (PID: 2452)
      • 28975421242.exe (PID: 3044)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 2168)
      • 28975421242.exe (PID: 2548)
      • QrzJinnWMAyQtyHTbSRlHMWq.exe (PID: 2436)
      • _t6qKZ1cnUfvraJJk6jkiXIa.exe (PID: 2328)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 3760)
      • n15lI2QeJcffjWJvEY1l3dve.exe (PID: 1684)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 2616)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 3000)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 3024)
      • 58852886416.exe (PID: 4584)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 2276)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 4880)
      • qgx7sz9EiN_cUHDnQbkKeopv.exe (PID: 3452)
      • 60232995282.exe (PID: 3728)
      • md8_8eus.exe (PID: 3024)
      • JqbjRAs0RVpnD4odvZCKrxDd.exe (PID: 1736)
      • IIOCze10ia6C3qcHL8WdIoPn.exe (PID: 2904)
      • OQXLIJWMTsY7UIFTrgzFA6q6.exe (PID: 576)
      • 2spjavkuPys0xLBi9CM9lx28.exe (PID: 4408)
      • aLqMv5BypW7rykh2NgSu_9qQ.exe (PID: 6008)
      • 2622697.exe (PID: 3844)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)

    • Runs injected code in another process

      • rUNdlL32.eXe (PID: 2740)

    • Application was injected by another process

      • svchost.exe (PID: 1772)

    • Runs app for hidden code execution

      • cmd.exe (PID: 568)

    • Writes to a start menu file

      • Intere.exe.com (PID: 2364)

    • Connects to CnC server

      • md9_1sjm.exe (PID: 912)
      • Files.exe (PID: 1692)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)

    • Changes settings of System certificates

      • md9_1sjm.exe (PID: 912)
      • Install.exe (PID: 2692)
      • File.exe (PID: 1236)

    • Actions looks like stealing of personal data

      • md9_1sjm.exe (PID: 912)
      • Updbdate.exe (PID: 2840)
      • 28975421242.exe (PID: 2548)
      • 58852886416.exe (PID: 4584)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)

    • Steals credentials from Web Browsers

      • md9_1sjm.exe (PID: 912)
      • 28975421242.exe (PID: 2548)

    • Changes the autorun value in the registry

      • Files.exe (PID: 1692)
      • 2622697.exe (PID: 3844)

    • Known privilege escalation attack

      • DllHost.exe (PID: 3488)

    • REDLINE was detected

      • Updbdate.exe (PID: 2840)
      • IIOCze10ia6C3qcHL8WdIoPn.exe (PID: 2904)
      • 2spjavkuPys0xLBi9CM9lx28.exe (PID: 4408)

    • Stealing of credential data

      • Updbdate.exe (PID: 2840)
      • OQXLIJWMTsY7UIFTrgzFA6q6.exe (PID: 576)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 3000)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 4880)

    • Loads dropped or rewritten executable

      • rUNdlL32.eXe (PID: 2740)

    • Disables Windows Defender

      • File.exe (PID: 1236)

    • FICKER was detected

      • 28975421242.exe (PID: 2548)

  • SUSPICIOUS

    • Checks supported languages

      • 817.exe (PID: 3056)
      • Lsr.exe (PID: 952)
      • Info.exe (PID: 1744)
      • Updbdate.exe (PID: 2840)
      • md9_1sjm.exe (PID: 912)
      • SoCleanInst.exe (PID: 740)
      • Folder.exe (PID: 1516)
      • File.exe (PID: 1236)
      • Folder.exe (PID: 2400)
      • tmpBCA0_tmp.exe (PID: 2152)
      • cmd.exe (PID: 568)
      • Intere.exe.com (PID: 2248)
      • cmd.exe (PID: 2388)
      • Intere.exe.com (PID: 2364)
      • IELowutil.exe (PID: 2016)
      • pub2.exe (PID: 2504)
      • Files.exe (PID: 1692)
      • Install.exe (PID: 2600)
      • Files.exe (PID: 2372)
      • jfiag3g_gg.exe (PID: 2428)
      • Install.exe (PID: 2692)
      • jfiag3g_gg.exe (PID: 1736)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 900)
      • efX7rxCXfVYUzI1uXy2HKW4T.exe (PID: 3532)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)
      • VEEvoZX2PyYsZaBlNDSH1g50.exe (PID: 2872)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 3296)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)
      • 504jccsHC07RnRMSjzvMtNeT.exe (PID: 3588)
      • QrzJinnWMAyQtyHTbSRlHMWq.exe (PID: 2436)
      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)
      • __WrSzGQXtH88BjDO92QZFob.exe (PID: 2452)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 2168)
      • cmd.exe (PID: 3924)
      • 28975421242.exe (PID: 3044)
      • _t6qKZ1cnUfvraJJk6jkiXIa.exe (PID: 2328)
      • n15lI2QeJcffjWJvEY1l3dve.exe (PID: 1684)
      • 28975421242.exe (PID: 2548)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 2616)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 3000)
      • qgx7sz9EiN_cUHDnQbkKeopv.exe (PID: 3452)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 2276)
      • VEEvoZX2PyYsZaBlNDSH1g50.exe (PID: 1668)
      • JqbjRAs0RVpnD4odvZCKrxDd.exe (PID: 1736)
      • IIOCze10ia6C3qcHL8WdIoPn.exe (PID: 2904)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 3760)
      • 58852886416.exe (PID: 4584)
      • OQXLIJWMTsY7UIFTrgzFA6q6.exe (PID: 576)
      • 2spjavkuPys0xLBi9CM9lx28.exe (PID: 4408)
      • 4542354.exe (PID: 5560)
      • aLqMv5BypW7rykh2NgSu_9qQ.exe (PID: 6008)
      • 2622697.exe (PID: 3844)
      • cmd.exe (PID: 4212)
      • 60232995282.exe (PID: 3728)
      • cmd.exe (PID: 2644)

    • Drops a file with too old compile date

      • 817.exe (PID: 3056)
      • File.exe (PID: 1236)
      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)

    • Drops a file with a compile date too recent

      • 817.exe (PID: 3056)
      • md9_1sjm.exe (PID: 912)
      • File.exe (PID: 1236)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)

    • Executed via COM

      • iexplore.exe (PID: 3040)
      • DllHost.exe (PID: 3488)

    • Reads the computer name

      • Lsr.exe (PID: 952)
      • 817.exe (PID: 3056)
      • SoCleanInst.exe (PID: 740)
      • md9_1sjm.exe (PID: 912)
      • Updbdate.exe (PID: 2840)
      • Folder.exe (PID: 2400)
      • Folder.exe (PID: 1516)
      • Info.exe (PID: 1744)
      • tmpBCA0_tmp.exe (PID: 2152)
      • File.exe (PID: 1236)
      • Intere.exe.com (PID: 2364)
      • IELowutil.exe (PID: 2016)
      • Install.exe (PID: 2600)
      • Files.exe (PID: 2372)
      • Files.exe (PID: 1692)
      • Install.exe (PID: 2692)
      • jfiag3g_gg.exe (PID: 2428)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 900)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 3296)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)
      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 2168)
      • __WrSzGQXtH88BjDO92QZFob.exe (PID: 2452)
      • 28975421242.exe (PID: 2548)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 2616)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 3000)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 2276)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 3760)
      • JqbjRAs0RVpnD4odvZCKrxDd.exe (PID: 1736)
      • IIOCze10ia6C3qcHL8WdIoPn.exe (PID: 2904)
      • qgx7sz9EiN_cUHDnQbkKeopv.exe (PID: 3452)
      • 2spjavkuPys0xLBi9CM9lx28.exe (PID: 4408)
      • 58852886416.exe (PID: 4584)
      • 4542354.exe (PID: 5560)
      • aLqMv5BypW7rykh2NgSu_9qQ.exe (PID: 6008)
      • 2622697.exe (PID: 3844)
      • OQXLIJWMTsY7UIFTrgzFA6q6.exe (PID: 576)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2968)

    • Drops a file that was compiled in debug mode

      • 817.exe (PID: 3056)
      • Folder.exe (PID: 2400)
      • Files.exe (PID: 1692)
      • File.exe (PID: 1236)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)
      • JqbjRAs0RVpnD4odvZCKrxDd.exe (PID: 1736)
      • Intere.exe.com (PID: 2364)
      • OQXLIJWMTsY7UIFTrgzFA6q6.exe (PID: 576)

    • Executable content was dropped or overwritten

      • 817.exe (PID: 3056)
      • md9_1sjm.exe (PID: 912)
      • Folder.exe (PID: 2400)
      • Lsr.exe (PID: 952)
      • Intere.exe.com (PID: 2364)
      • Files.exe (PID: 1692)
      • File.exe (PID: 1236)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)
      • JqbjRAs0RVpnD4odvZCKrxDd.exe (PID: 1736)
      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)
      • OQXLIJWMTsY7UIFTrgzFA6q6.exe (PID: 576)

    • Reads Environment values

      • Lsr.exe (PID: 952)
      • SoCleanInst.exe (PID: 740)
      • Updbdate.exe (PID: 2840)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 2168)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)
      • __WrSzGQXtH88BjDO92QZFob.exe (PID: 2452)
      • IIOCze10ia6C3qcHL8WdIoPn.exe (PID: 2904)
      • 2spjavkuPys0xLBi9CM9lx28.exe (PID: 4408)
      • 4542354.exe (PID: 5560)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 3000)
      • 28975421242.exe (PID: 2548)

    • Application launched itself

      • Folder.exe (PID: 1516)
      • cmd.exe (PID: 568)
      • Intere.exe.com (PID: 2248)
      • Files.exe (PID: 2372)
      • VEEvoZX2PyYsZaBlNDSH1g50.exe (PID: 1668)
      • obtD_o3p_iEYTndZ1TNy7hPb.exe (PID: 900)
      • 28975421242.exe (PID: 3044)
      • KWOuZjIUsBC5m5NxQU5tJRms.exe (PID: 2616)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 2168)
      • KkKG8d5DduZbXt0AbBNJQJNL.exe (PID: 2276)

    • Executed via WMI

      • rUNdlL32.eXe (PID: 2740)

    • Starts CMD.EXE for commands execution

      • tmpBCA0_tmp.exe (PID: 2152)
      • cmd.exe (PID: 568)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)

    • Reads mouse settings

      • Intere.exe.com (PID: 2248)
      • Intere.exe.com (PID: 2364)

    • Starts application with an unusual extension

      • Intere.exe.com (PID: 2248)
      • cmd.exe (PID: 2388)

    • Creates files in the user directory

      • Intere.exe.com (PID: 2364)
      • File.exe (PID: 1236)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)
      • 2622697.exe (PID: 3844)

    • Drop AutoIt3 executable file

      • Intere.exe.com (PID: 2364)

    • Reads the cookies of Google Chrome

      • md9_1sjm.exe (PID: 912)

    • Reads the cookies of Mozilla Firefox

      • md9_1sjm.exe (PID: 912)

    • Adds / modifies Windows certificates

      • md9_1sjm.exe (PID: 912)
      • Install.exe (PID: 2692)
      • File.exe (PID: 1236)

    • Searches for installed software

      • Updbdate.exe (PID: 2840)
      • 28975421242.exe (PID: 2548)

    • Checks for external IP

      • Files.exe (PID: 1692)
      • File.exe (PID: 1236)
      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)
      • 28975421242.exe (PID: 2548)

    • Reads the Windows organization settings

      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)

    • Reads Windows owner or organization settings

      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)

    • Creates files in the program directory

      • 28975421242.exe (PID: 2548)
      • aLqMv5BypW7rykh2NgSu_9qQ.exe (PID: 6008)

    • Reads CPU info

      • 58852886416.exe (PID: 4584)
      • 28975421242.exe (PID: 2548)

    • Creates a directory in Program Files

      • aLqMv5BypW7rykh2NgSu_9qQ.exe (PID: 6008)

    • Creates a software uninstall entry

      • aLqMv5BypW7rykh2NgSu_9qQ.exe (PID: 6008)

    • Starts itself from another location

      • 2622697.exe (PID: 3844)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2968)
      • iexplore.exe (PID: 3040)
      • rUNdlL32.eXe (PID: 2740)
      • dllhost.exe (PID: 3180)
      • PING.EXE (PID: 1660)
      • findstr.exe (PID: 3244)
      • DllHost.exe (PID: 3488)

    • Reads the computer name

      • iexplore.exe (PID: 2968)
      • iexplore.exe (PID: 3040)
      • rUNdlL32.eXe (PID: 2740)
      • PING.EXE (PID: 1660)
      • DllHost.exe (PID: 3488)

    • Changes internet zones settings

      • iexplore.exe (PID: 3040)

    • Application launched itself

      • iexplore.exe (PID: 3040)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2968)
      • File.exe (PID: 1236)
      • iexplore.exe (PID: 3040)
      • Install.exe (PID: 2692)

    • Reads settings of System Certificates

      • Lsr.exe (PID: 952)
      • SoCleanInst.exe (PID: 740)
      • iexplore.exe (PID: 2968)
      • md9_1sjm.exe (PID: 912)
      • File.exe (PID: 1236)
      • iexplore.exe (PID: 3040)
      • Updbdate.exe (PID: 2840)
      • Install.exe (PID: 2692)
      • Files.exe (PID: 1692)
      • QrzJinnWMAyQtyHTbSRlHMWq.tmp (PID: 3172)
      • pJkWt033jWcTaTCRTe35ziNj.exe (PID: 1404)
      • vwxa4WWiZNwIOgD8hgqfZ9xL.exe (PID: 2168)
      • duPQbECLL5fmGlsDVBUJJqIa.exe (PID: 400)
      • __WrSzGQXtH88BjDO92QZFob.exe (PID: 2452)
      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)

    • Creates files in the user directory

      • iexplore.exe (PID: 2968)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2968)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3040)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3040)

    • Dropped object may contain Bitcoin addresses

      • lbwNHDNb0ZoBXnVzgiOUthaB.exe (PID: 2936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1ec40
UninitializedDataSize: -
InitializedDataSize: 143360
CodeSize: 201216
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:12:01 19:00:55+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 01-Dec-2020 18:00:55
Detected languages:
  • English - United States
  • Process Default Language
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 01-Dec-2020 18:00:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000310EA
0x00031200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.70808
.rdata
0x00033000
0x0000A612
0x0000A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.22174
.data
0x0003E000
0x00023728
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.70882
.didat
0x00062000
0x00000188
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.29825
.rsrc
0x00063000
0x00015168
0x00015200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.24093
.reloc
0x00079000
0x00002268
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.55486

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.25329
1875
Latin 1 / Western European
English - United States
RT_MANIFEST
7
3.1586
482
Latin 1 / Western European
English - United States
RT_STRING
8
3.11685
460
Latin 1 / Western European
English - United States
RT_STRING
9
3.11236
440
Latin 1 / Western European
English - United States
RT_STRING
10
2.99727
326
Latin 1 / Western European
English - United States
RT_STRING
11
3.2036
1094
Latin 1 / Western European
English - United States
RT_STRING
12
3.12889
358
Latin 1 / Western European
English - United States
RT_STRING
13
3.01704
338
Latin 1 / Western European
English - United States
RT_STRING
14
2.94627
266
Latin 1 / Western European
English - United States
RT_STRING
15
2.83619
188
Latin 1 / Western European
English - United States
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
70
Malicious processes
30
Suspicious processes
12

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start 817.exe lsr.exe #REDLINE updbdate.exe iexplore.exe iexplore.exe info.exe no specs folder.exe no specs socleaninst.exe md9_1sjm.exe file.exe no specs file.exe folder.exe rundll32.exe no specs svchost.exe tmpbca0_tmp.exe no specs dllhost.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs intere.exe.com no specs ping.exe no specs intere.exe.com ielowutil.exe no specs install.exe no specs pub2.exe files.exe no specs files.exe jfiag3g_gg.exe no specs CMSTPLUA no specs install.exe jfiag3g_gg.exe no specs veevozx2pyyszablndsh1g50.exe no specs pjkwt033jwctatcrte35zinj.exe obtd_o3p_ieytndz1tny7hpb.exe no specs efx7rxcxfvyuzi1uxy2hkw4t.exe no specs veevozx2pyyszablndsh1g50.exe no specs lbwnhdnb0zobxnvzgiouthab.exe obtd_o3p_ieytndz1tny7hpb.exe no specs 504jccshc07rnrmsjzvmtnet.exe qrzjinnwmayqtyhtbsrlhmwq.exe no specs qrzjinnwmayqtyhtbsrlhmwq.tmp __wrszgqxth88bjdo92qzfob.exe vwxa4wwiznwiogd8hgqfz9xl.exe cmd.exe no specs 28975421242.exe no specs _t6qkz1cnufvrajjk6jkixia.exe no specs kwouzjiusbc5m5nxqu5tjrms.exe no specs n15li2qejcffjwjvey1l3dve.exe no specs #FICKER 28975421242.exe kwouzjiusbc5m5nxqu5tjrms.exe dupqbecll5fmglsdvbujjqia.exe vwxa4wwiznwiogd8hgqfz9xl.exe kkkg8d5dduzbxt0abbnjqjnl.exe no specs qgx7sz9ein_cuhdnqbkkeopv.exe kkkg8d5dduzbxt0abbnjqjnl.exe no specs jqbjras0rvpnd4odvzckrxdd.exe #REDLINE iiocze10ia6c3qchl8wdiopn.exe cmd.exe no specs oqxlijwmtsy7uiftrgzfa6q6.exe #REDLINE 2spjavkupys0xlbi9cm9lx28.exe 58852886416.exe kkkg8d5dduzbxt0abbnjqjnl.exe 4542354.exe no specs alqmv5bypw7rykh2ngsu_9qq.exe no specs cmd.exe no specs 2622697.exe 60232995282.exe no specs jooyu.exe no specs md8_8eus.exe no specs winhoster.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
400"C:\Users\admin\Documents\duPQbECLL5fmGlsDVBUJJqIa.exe" C:\Users\admin\Documents\duPQbECLL5fmGlsDVBUJJqIa.exe
File.exe
User:
admin
Company:
hfghggfgd
Integrity Level:
HIGH
Description:
hfghggfgd
Exit code:
0
Version:
1.0.1.1
Modules
Images
c:\users\admin\documents\dupqbecll5fmglsdvbujjqia.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
568"C:\Windows\System32\cmd.exe" /c cmd < Vedo.csvC:\Windows\System32\cmd.exe—tmpBCA0_tmp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
576"C:\Users\admin\Documents\OQXLIJWMTsY7UIFTrgzFA6q6.exe" C:\Users\admin\Documents\OQXLIJWMTsY7UIFTrgzFA6q6.exe
File.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\documents\oqxlijwmtsy7uiftrgzfa6q6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
740"C:\Users\admin\Desktop\SoCleanInst.exe" C:\Users\admin\Desktop\SoCleanInst.exe
817.exe
User:
admin
Company:
hfghggfgd
Integrity Level:
MEDIUM
Description:
hfghggfgd
Exit code:
0
Version:
1.0.1.1
Modules
Images
c:\users\admin\desktop\socleaninst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
900"C:\Users\admin\Documents\obtD_o3p_iEYTndZ1TNy7hPb.exe" C:\Users\admin\Documents\obtD_o3p_iEYTndZ1TNy7hPb.exe—File.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\documents\obtd_o3p_ieytndz1tny7hpb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
912"C:\Users\admin\Desktop\md9_1sjm.exe" C:\Users\admin\Desktop\md9_1sjm.exe
817.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\users\admin\desktop\md9_1sjm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
952"C:\Users\admin\Desktop\Lsr.exe" C:\Users\admin\Desktop\Lsr.exe
817.exe
User:
admin
Company:
Module Art
Integrity Level:
MEDIUM
Description:
Quick Screen Recorder
Exit code:
0
Version:
1.2.1
Modules
Images
c:\users\admin\desktop\lsr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1236"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe
817.exe
User:
admin
Company:
MMSample Disk
Integrity Level:
HIGH
Description:
MMSample Disk
Exit code:
0
Version:
2.1.1.3
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1404"C:\Users\admin\Documents\pJkWt033jWcTaTCRTe35ziNj.exe" C:\Users\admin\Documents\pJkWt033jWcTaTCRTe35ziNj.exe
File.exe
User:
admin
Company:
Microsoft� Visual Studio�
Integrity Level:
HIGH
Description:
VsJITDebugger.exe
Exit code:
0
Version:
16.0.100.0
Modules
Images
c:\users\admin\documents\pjkwt033jwctatcrte35zinj.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1516"C:\Users\admin\Desktop\Folder.exe" C:\Users\admin\Desktop\Folder.exe—817.exe
User:
admin
Company:
RealVNC Ltd
Integrity Level:
MEDIUM
Description:
VNC� Viewer
Exit code:
0
Version:
6.21.406 (r44671)
Modules
Images
c:\users\admin\desktop\folder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
192 406
Read events
191 683
Write events
709
Delete events
14

Modification events

(PID) Process:(3056) 817.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3056) 817.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3056) 817.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3056) 817.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3056) 817.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214E4-0000-0000-C000-000000000046} 0xFFFF
Value:
0100000000000000791B4CDBDE97D701
(PID) Process:(952) Lsr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(952) Lsr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(952) Lsr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(952) Lsr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
Executable files
96
Suspicious files
30
Text files
48
Unknown types
143

Dropped files

PID
Process
Filename
Type
3056817.exeC:\Users\admin\Desktop\md9_1sjm.exeexecutable
MD5:—
SHA256:—
3056817.exeC:\Users\admin\Desktop\Install.exeexecutable
MD5:—
SHA256:—
3056817.exeC:\Users\admin\Desktop\pub2.exeexecutable
MD5:—
SHA256:—
1772svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
3056817.exeC:\Users\admin\Desktop\Updbdate.exeexecutable
MD5:—
SHA256:—
3056817.exeC:\Users\admin\Desktop\Info.exeexecutable
MD5:—
SHA256:—
912md9_1sjm.exeC:\Users\admin\Documents\VlcpVideoV1.0.1\md9_1sjm.exeexecutable
MD5:—
SHA256:—
3056817.exeC:\Users\admin\Desktop\Folder.exeexecutable
MD5:B89068659CA07AB9B39F1C580A6F9D39
SHA256:9D225182E9A8F073E8CF1D60A8258369A394BCAE5FBC52D845D71A0FA440539C
3056817.exeC:\Users\admin\Desktop\pkts.urltext
MD5:—
SHA256:—
3056817.exeC:\Users\admin\Desktop\SoCleanInst.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
166
TCP/UDP connections
307
DNS requests
65
Threats
361

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
iexplore.exe
GET
304
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4e9655a668f5dedb
US
—
—
whitelisted
3040
iexplore.exe
GET
304
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fb906d5c3f15d29
US
—
—
whitelisted
2968
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2968
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
US
der
471 b
whitelisted
2968
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1236
File.exe
GET
304
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bbcf5ed16db864cc
US
—
—
whitelisted
1692
Files.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
280 b
malicious
1236
File.exe
GET
200
37.0.10.237:80
http://37.0.10.237/base/api/statistics.php
NL
binary
96 b
suspicious
2692
Install.exe
GET
200
93.184.220.29:80
http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D
US
der
471 b
whitelisted
1236
File.exe
GET
200
37.0.10.214:80
http://37.0.10.214/proxies.txt
NL
text
2.45 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2968
iexplore.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
912
md9_1sjm.exe
186.2.171.3:80
—
DANCOM LTD
RU
malicious
952
Lsr.exe
95.142.37.102:443
activityhike.com
Servers.com, Inc.
RU
suspicious
2968
iexplore.exe
67.27.159.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2840
Updbdate.exe
193.56.146.78:54955
—
—
—
malicious
1236
File.exe
162.159.135.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
740
SoCleanInst.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
1236
File.exe
37.0.10.237:80
—
—
NL
suspicious
3040
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1236
File.exe
162.159.135.233:80
cdn.discordapp.com
Cloudflare Inc
—
shared

DNS requests

Domain
IP
Reputation
activityhike.com
  • 95.142.37.102
malicious
iplogger.org
  • 88.99.66.31
shared
your-info-services.xyz
  • —
suspicious
ctldl.windowsupdate.com
  • 67.27.159.126
  • 67.27.157.254
  • 67.27.233.126
  • 67.27.159.254
  • 67.27.157.126
whitelisted
webboutiquestudio.xyz
  • 172.67.192.184
  • 104.21.60.65
malicious
google.vrthcobj.com
  • 34.97.69.225
whitelisted
2no.co
  • 88.99.66.31
whitelisted
cdn.discordapp.com
  • 162.159.135.233
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.133.233
  • 162.159.134.233
shared
VNEHmoQrfRTi.VNEHmoQrfRTi
  • —
unknown
ocsp.comodoca.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
952
Lsr.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
1236
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
912
md9_1sjm.exe
A Network Trojan was detected
AV TROJAN Win32/Masson CnC Activity
1236
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
1692
Files.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1692
Files.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1888
svchost.exe
Potential Corporate Privacy Violation
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set
2840
Updbdate.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
1236
File.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
1236
File.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
88 ETPRO signatures available at the full report
No debug info