File name:

_Processo 1231506okew.msi

Full analysis: https://app.any.run/tasks/78ab2352-1b2c-4fab-af7f-1350086764a2
Verdict: Malicious activity
Threats:

Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.

Malware Trends Tracker     >>>
Analysis date: July 27, 2022, 15:56:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
danabot
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {0AF3FDE9-7E3E-4B91-A51E-51DFE29C9060}, Number of Words: 10, Subject: Google Chrome, Author: Chrome, Name of Creating Application: Advanced Installer 12.3 build 64631, Template: ;1046, Comments: Google Chrome
MD5:

2A3ABE8A86359364A66AA8CC1031CEBD

SHA1:

73CFC2FBB2FF7EF15726553D8C194479FF16E3C8

SHA256:

845CDFA0D13A1308807FE505EC2DAFBFF7A0E98D90DD0E08BBFF7EEAF1662165

SSDEEP:

49152:T+AuY5A2blFIjKFiguez7buCnIrgmzu6kKWtMpL58ALkdyEKxSnzKxf5j2FVZzCp:WY5A2blAKFpu27Cbrg+kKWYF8/yEQSYv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • msiexec.exe (PID: 3328)
      • MsiExec.exe (PID: 1596)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3512)

    • Application was dropped or rewritten from another process

      • ƒI4nvŠQIYij--C1.exe (PID: 3996)

    • Changes the autorun value in the registry

      • ƒI4nvŠQIYij--C1.exe (PID: 3996)

    • DANABOT detected by memory dumps

      • ƒI4nvŠQIYij--C1.exe (PID: 3996)

  • SUSPICIOUS

    • Reads the computer name

      • msiexec.exe (PID: 3328)
      • MsiExec.exe (PID: 1596)
      • ƒI4nvŠQIYij--C1.exe (PID: 3996)

    • Checks supported languages

      • msiexec.exe (PID: 3328)
      • MsiExec.exe (PID: 1596)
      • ƒI4nvŠQIYij--C1.exe (PID: 3996)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2864)
      • msiexec.exe (PID: 3328)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3328)
      • msiexec.exe (PID: 2864)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3328)
      • MsiExec.exe (PID: 1596)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 3328)
      • MsiExec.exe (PID: 1596)

    • Reads Environment values

      • ƒI4nvŠQIYij--C1.exe (PID: 3996)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2864)
      • reg.exe (PID: 2116)

    • Reads the computer name

      • msiexec.exe (PID: 2864)

    • Application launched itself

      • msiexec.exe (PID: 3328)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Comments: Google Chrome
Template: ;1046
Software: Advanced Installer 12.3 build 64631
LastModifiedBy: -
Author: Chrome
Subject: Google Chrome
Words: 10
RevisionNumber: {0AF3FDE9-7E3E-4B91-A51E-51DFE29C9060}
CodePage: Windows Latin 1 (Western European)
Security: None
Pages: 200
ModifyDate: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
LastPrinted: 2009:12:11 11:47:44
Keywords: Installer, MSI, Database
Title: Installation Database
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe msiexec.exe searchprotocolhost.exe no specs reg.exe no specs #DANABOT ƒi4nvšqiyij--c1.exe

Process information

PID
CMD
Path
Indicators
Parent process
1596C:\Windows\system32\MsiExec.exe -Embedding A40E8122F8F41B5F814EEE184615B2FCC:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2116"C:\Windows\System32\reg.exe" delete HKCU\software\Microsoft\Windows\CurrentVersion\Run /v ƒI4nvŠQIYij /t reg_sz /d C:\Users\Public\Documents\\\ƒI4nvŠQIYij\ƒI4nvŠQIYij--C1.exe6C:\Windows\System32\reg.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2864"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\_Processo 1231506okew.msi"C:\Windows\System32\msiexec.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3328C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3512"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3996"C:\Users\Public\Documents\ƒI4nvŠQIYij\ƒI4nvŠQIYij--C1.exe" C:\Users\Public\Documents\ƒI4nvŠQIYij\ƒI4nvŠQIYij--C1.exe
MsiExec.exe
User:
admin
Company:
NowSmart
Integrity Level:
MEDIUM
Description:
Song Cube
Exit code:
0
Version:
1.00.40620
Modules
Images
c:\users\public\documents\ƒi4nvšqiyij\ƒi4nvšqiyij--c1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\public\documents\ƒi4nvšqiyij\htmlayout.dll
Total events
4 367
Read events
4 309
Write events
46
Delete events
12

Modification events

(PID) Process:(3328) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
000D00006267D680D1A1D801
(PID) Process:(3328) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
12C7422B8018D029CFA67156DB7385DC55B9F726A9B7E06814BC0C9D4556C5C4
(PID) Process:(3328) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1596) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
16
Suspicious files
6
Text files
16
Unknown types
4

Dropped files

PID
Process
Filename
Type
3512SearchProtocolHost.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\htmlayout.dll —
MD5:—
SHA256:—
3328msiexec.exeC:\Windows\Installer\104fd7.msiexecutable
MD5:—
SHA256:—
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij_ƒI4nvŠQIYij_ƒI4nvŠQIYij.zipcompressed
MD5:—
SHA256:—
1596MsiExec.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\daniel[1].xlscompressed
MD5:—
SHA256:—
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\_-Nameexecutable
MD5:A4BB596FDB3FCD2868D9A00486A1F61E
SHA256:2E7D8011D1F806CAA4151EDD55E3E82EC76D33B04577DBC5EA9B48D1DAE30E23
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\2 - IMG-20160520-WA0003.jpgimage
MD5:B10EF20F440BA7D5E608F86D17D38544
SHA256:C09569A5E668F50F5EE3ACEB846EECCC316D977046C4B19C12187005AF983247
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\intune.exeexecutable
MD5:—
SHA256:—
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\3 - IMG-20160520-WA0000.jpgimage
MD5:88DD5FC741DA500C941899328414EB88
SHA256:ADB6E43742AC698908B4D7AFB469B69CF1214225B746BD8181DAAB8C655DE98A
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\7I53hCh.pngimage
MD5:964E31FA1C594025C66950F6B9C58A5D
SHA256:369AA5F4AF0E964A93820DBE3A4DB9F7D0C0024F941E68D593D66E9DEEDBDE4B
1596MsiExec.exeC:\Users\Public\Documents\ƒI4nvŠQIYij\bass.dllexecutable
MD5:9586E7BE6AE8016932038932D1417241
SHA256:A3B00967D5C4EF1A2B4980183934D46EF36CEE4B3DC1B2A6DA1F820D63448390
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3996
ƒI4nvŠQIYij--C1.exe
POST
—
35.198.3.78:80
http://correios2.isa-geek.net/novidades/inspecionando.php
US
—
—
suspicious
1596
MsiExec.exe
GET
200
20.74.232.197:80
http://postoipirangaweb.duckdns.org/daniel.xls
US
compressed
12.1 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1596
MsiExec.exe
20.74.232.197:80
postoipirangaweb.duckdns.org
—
US
suspicious
3996
ƒI4nvŠQIYij--C1.exe
35.198.3.78:80
correios2.isa-geek.net
Google Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
postoipirangaweb.duckdns.org
  • 20.74.232.197
suspicious
correios2.isa-geek.net
  • 35.198.3.78
suspicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_Processo 1231506okew.msi