File name:

kleptoru.exe

Full analysis: https://app.any.run/tasks/ab82477f-a069-4aa2-9177-fad41b484d71
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: November 01, 2018, 01:55:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
adload
trojan
loader
pup
adposhel
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

CF31445A532941EE42A3963EA286FE23

SHA1:

2712FECC789D1DCA8B0331C5D58B2EC1776A4ECF

SHA256:

846F183BCD33AC460E40243E5822366E523A5739D6356FBD1870E086057B7A5E

SSDEEP:

49152:dJyWIGOwm224MoinQBd39kdTkZjzyml0oTY5qwNIfOWmFX+9gP:WWXZrInQB7k6pzymlhcAwNIPmFX/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ADLOAD was detected

      • kleptoru.exe (PID: 768)
    • Application was dropped or rewritten from another process

      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.exe (PID: 3184)
      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • 6CC5436B-C088-4CB9-825B-7F26CE323846.exe (PID: 2292)
      • smappscontroller.exe (PID: 3760)
      • mweshield.exe (PID: 3776)
      • mweshield.exe (PID: 3612)
      • mweshieldup.exe (PID: 4004)
      • na_runner.exe (PID: 2216)
      • OneSystemCare.exe (PID: 3796)
      • setup.exe (PID: 3856)
      • MailRuUpdater.exe (PID: 4000)
      • mweshieldup.exe (PID: 3204)
      • MailRuUpdater.exe (PID: 1864)
      • OneSystemCare.exe (PID: 3156)
      • SystemConsole.exe (PID: 572)
      • viewU.exe (PID: 3956)
      • view.exe (PID: 3008)
      • chromedriver.exe (PID: 896)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 2248)
      • chrome.exe (PID: 1552)
      • chrome.exe (PID: 1112)
      • chrome.exe (PID: 1548)
      • chrome.exe (PID: 3588)
      • chrome.exe (PID: 360)
      • chrome.exe (PID: 3832)
      • chrome.exe (PID: 3032)
      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 2144)
    • Changes settings of System certificates

      • kleptoru.exe (PID: 768)
      • mweshield.exe (PID: 3612)
      • MailRuUpdater.exe (PID: 4000)
      • chrome.exe (PID: 3476)
    • Loads the Task Scheduler COM API

      • mmc.exe (PID: 3492)
      • schtasks.exe (PID: 912)
      • schtasks.exe (PID: 2108)
      • schtasks.exe (PID: 2512)
      • na_runner.exe (PID: 2216)
      • SystemConsole.exe (PID: 572)
      • schtasks.exe (PID: 2128)
      • mmc.exe (PID: 2724)
      • schtasks.exe (PID: 3412)
    • Downloads executable files from the Internet

      • kleptoru.exe (PID: 768)
      • 6CC5436B-C088-4CB9-825B-7F26CE323846.exe (PID: 2292)
    • Connects to CnC server

      • kleptoru.exe (PID: 768)
      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • SystemConsole.exe (PID: 572)
    • Loads dropped or rewritten executable

      • 6CC5436B-C088-4CB9-825B-7F26CE323846.exe (PID: 2292)
      • mweshield.exe (PID: 3776)
      • mweshield.exe (PID: 3612)
      • setup.exe (PID: 3856)
      • viewU.exe (PID: 3956)
      • view.exe (PID: 3008)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 2248)
      • chrome.exe (PID: 1548)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 1552)
      • chrome.exe (PID: 1112)
      • chrome.exe (PID: 360)
      • chrome.exe (PID: 3032)
      • chrome.exe (PID: 3588)
      • chrome.exe (PID: 3832)
      • chrome.exe (PID: 2144)
      • chrome.exe (PID: 1012)
    • Uses Task Scheduler to run other applications

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3036)
    • Changes the autorun value in the registry

      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • na_runner.exe (PID: 2216)
      • setup.exe (PID: 3856)
    • MAILRU was detected

      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
    • Changes Windows auto-update feature

      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
    • ADPOSHEL was detected

      • SystemConsole.exe (PID: 572)
  • SUSPICIOUS

    • Starts Internet Explorer

      • kleptoru.exe (PID: 768)
    • Low-level read access rights to disk partition

      • msconfig.exe (PID: 2184)
      • msconfig.exe (PID: 3308)
    • Adds / modifies Windows certificates

      • kleptoru.exe (PID: 768)
      • chrome.exe (PID: 3476)
    • Creates files in the user directory

      • kleptoru.exe (PID: 768)
      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • 6CC5436B-C088-4CB9-825B-7F26CE323846.exe (PID: 2292)
      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • MailRuUpdater.exe (PID: 4000)
      • OneSystemCare.tmp (PID: 3036)
      • setup.exe (PID: 3856)
      • chromedriver.exe (PID: 896)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 3476)
    • Creates files in the program directory

      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • na_runner.exe (PID: 2216)
      • mweshield.exe (PID: 3612)
      • MailRuUpdater.exe (PID: 4000)
    • Executable content was dropped or overwritten

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.exe (PID: 3184)
      • kleptoru.exe (PID: 768)
      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
      • 6CC5436B-C088-4CB9-825B-7F26CE323846.exe (PID: 2292)
      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • OneSystemCare.exe (PID: 3796)
      • na_runner.exe (PID: 2216)
      • OneSystemCare.tmp (PID: 3092)
      • OneSystemCare.exe (PID: 3156)
      • OneSystemCare.tmp (PID: 3036)
      • setup.exe (PID: 3856)
    • Reads Windows owner settings

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3092)
      • OneSystemCare.tmp (PID: 3036)
    • Reads the Windows organization settings

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3092)
      • OneSystemCare.tmp (PID: 3036)
    • Uses TASKKILL.EXE to kill process

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
    • Searches for installed software

      • kleptoru.exe (PID: 768)
      • smappscontroller.exe (PID: 3760)
    • Creates or modifies windows services

      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
      • mweshield.exe (PID: 3612)
      • viewU.exe (PID: 3956)
      • view.exe (PID: 3008)
    • Creates a software uninstall entry

      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
      • na_runner.exe (PID: 2216)
      • SystemConsole.exe (PID: 572)
      • setup.exe (PID: 3856)
    • Creates files in the Windows directory

      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • MailRuUpdater.exe (PID: 1864)
      • mweshieldup.exe (PID: 3204)
    • Creates files in the driver directory

      • 87DB0636-DF66-43DA-82BF-EE375069E010.exe (PID: 2016)
    • Starts itself from another location

      • na_runner.exe (PID: 2216)
    • Application launched itself

      • chrome.exe (PID: 3476)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3356)
    • Application launched itself

      • iexplore.exe (PID: 3356)
    • Loads dropped or rewritten executable

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3092)
      • OneSystemCare.tmp (PID: 3036)
    • Application was dropped or rewritten from another process

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3092)
      • OneSystemCare.tmp (PID: 3036)
    • Creates files in the user directory

      • iexplore.exe (PID: 3240)
      • iexplore.exe (PID: 1360)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3240)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3240)
      • iexplore.exe (PID: 1360)
    • Changes settings of System certificates

      • iexplore.exe (PID: 3240)
    • Creates files in the program directory

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3036)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3240)
      • iexplore.exe (PID: 1360)
    • Creates a software uninstall entry

      • E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp (PID: 3044)
      • OneSystemCare.tmp (PID: 3036)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 3356)
      • MailRuUpdater.exe (PID: 4000)
    • Dropped object may contain Bitcoin addresses

      • A1A19270-2A25-491B-AF57-C9402B3B4B77.exe (PID: 2760)
      • OneSystemCare.tmp (PID: 3036)
      • setup.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:03:11 09:13:58+01:00
PEType: PE32
LinkerVersion: 12
CodeSize: 72192
InitializedDataSize: 2709504
UninitializedDataSize: -
EntryPoint: 0x1050
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 11-Mar-2016 08:13:58
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 9
Time date stamp: 11-Mar-2016 08:13:58
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000119BC
0x00011A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.64204
.rdata
0x00013000
0x00009338
0x00009400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.47004
.data
0x0001D000
0x02099B18
0x00036000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.56186
.4t1e0
0x020B7000
0x000DE000
0x000DE000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.53458
.eppm
0x02195000
0x000C8480
0x000C8600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.41396
.p7s99a
0x0225E000
0x0004DD40
0x0004DE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.48071
.sl2nl
0x022AC000
0x0003A1E0
0x0003A200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.48062
.96eoh
0x022E7000
0x000226E8
0x00022000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.40486
.rsrc
0x0230A000
0x00005D77
0x00005E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.93689

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07794
1223
Latin 1 / Western European
English - United States
RT_MANIFEST
50
5.77319
16936
UNKNOWN
UNKNOWN
RT_ICON
51
5.79701
4264
UNKNOWN
UNKNOWN
RT_ICON
52
6.20938
1128
UNKNOWN
UNKNOWN
RT_ICON
53772
2.74906
48
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
MPRAPI.dll
OPENGL32.dll
SETUPAPI.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
116
Monitored processes
53
Malicious processes
24
Suspicious processes
11

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start download and start drop and start drop and start drop and start drop and start drop and start #ADLOAD kleptoru.exe msconfig.exe no specs msconfig.exe mmc.exe no specs mmc.exe iexplore.exe 87db0636-df66-43da-82bf-ee375069e010.exe iexplore.exe e0c3aa0f-d734-4ab1-94a9-c8469ede1804.exe #MAILRU a1a19270-2a25-491b-af57-c9402b3b4b77.exe e0c3aa0f-d734-4ab1-94a9-c8469ede1804.tmp 6cc5436b-c088-4cb9-825b-7f26ce323846.exe taskkill.exe no specs smappscontroller.exe schtasks.exe no specs schtasks.exe no specs mweshield.exe no specs schtasks.exe no specs mweshieldup.exe no specs setup.exe mweshield.exe na_runner.exe onesystemcare.exe onesystemcare.tmp mailruupdater.exe mweshieldup.exe mailruupdater.exe onesystemcare.exe onesystemcare.tmp mmc.exe no specs mmc.exe #ADPOSHEL systemconsole.exe iexplore.exe schtasks.exe no specs schtasks.exe no specs viewu.exe view.exe chromedriver.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msconfig.exe no specs msconfig.exe kleptoru.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360"C:\Users\admin\AppData\Roaming\view\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=924,5080749783065314531,747620237696653951,131072 --enable-logging --log-level=0 --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0" --user-data-dir="C:\Users\admin\AppData\Roaming\view\Chrome\NewProfile" --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0" --user-data-dir="C:\Users\admin\AppData\Roaming\view\Chrome\NewProfile" --enable-logging --log-level=0 --service-request-channel-token=6358317207620637937 --mojo-platform-channel-handle=1816 --ignored=" --type=renderer " /prefetch:2C:\Users\admin\AppData\Roaming\view\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
3221225794
Version:
69.0.3497.100
Modules
Images
c:\users\admin\appdata\roaming\view\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\view\chrome\application\69.0.3497.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
572C:\ProgramData\1d5dc90e-5c1d-4415-b23d-9e53d09fb809\SystemConsole.exe /in /trk="C:\Users\admin\AppData\Local\Temp\DC2EE985-E3F0-4BA2-A37C-B183767A059D\OneSystemCare.exe" /mkey="VS1fd9V91N1InaWK91YPHyPHjnjMrsgjddogHCybVUYw_6nvN5XlL3okGapXNQd7E07p2sMS8tEpMzq6WvqhNrtlLu3peuUf3BUtY_q1eV28GapkuyyC-oigsKfzoZvPQf-NzAXThRPaYEJYgGCVaBe52fLL5MiDt9AIcEK7T3-9dKrboLFWzMzBxupd2chApY2e2S5ukFb9KDEmtLO1I0IfT3zfGhLgKPg-paPF25VzTak0Ve5i4wZlzc5IoRLh5EYaCTNbgASjKXSrv3nvrBu13PHH-8PCuYJWFF0RuVAUAROAcMaT11RkFNyWeFD0W9_PkhIcyLmAc-880mIeXT33SKU1QS0Sj0v64c-J_dmcLX_mJipvkdJ7Pd3i4wKUeQV05TvbVA2dusyBGGlLfM7EMSh0cBZDen-kDPZ6CNVpyvKLqsBIOgk95fjlksGqrhCnUIKQZLZNtooZQ-N2_mL1u3l46FM3hsGuN-DyFsE0B4kY_EYydYA63ude0Cr0du1iuDh9U9r3mHeiKQjGItWe4v2H2xzVvSicyPPPskITAc5a6sJhwliUti35IIw52li6WgYlYxG7X0eakLYdCntAX9EjeCqpegYCJFihFiYfKDgRajlmb7sG5NtaHkbM4Z5Ar8G0L1mo3D9c6rbPSiAEjS1OS6mtgmleJWW6ztwcMoP8dOgdmmx-mP7rzIatR3-NnruPaaJQiKRoct3u-JuHReTNnoj"C:\ProgramData\1d5dc90e-5c1d-4415-b23d-9e53d09fb809\SystemConsole.exe
OneSystemCare.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\1d5dc90e-5c1d-4415-b23d-9e53d09fb809\systemconsole.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
768"C:\Users\admin\Desktop\kleptoru.exe" C:\Users\admin\Desktop\kleptoru.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\kleptoru.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
896"C:\Users\admin\AppData\Roaming\view\chromedriver.exe" --port=53584C:\Users\admin\AppData\Roaming\view\chromedriver.exe
view.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\view\chromedriver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
912"C:\Windows\System32\schtasks.exe" /delete /f /tn "CheckControllerUpdatesCore"C:\Windows\System32\schtasks.exeE0C3AA0F-D734-4AB1-94A9-C8469EDE1804.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1012"C:\Users\admin\AppData\Roaming\view\Chrome\Application\chrome.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --test-type=webdriver --field-trial-handle=924,5080749783065314531,747620237696653951,131072 --disable-gpu-compositing --service-pipe-token=11149044222387553665 --lang=en-US --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0" --user-data-dir="C:\Users\admin\AppData\Roaming\view\Chrome\NewProfile" --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11149044222387553665 --renderer-client-id=11 --mojo-platform-channel-handle=1188 /prefetch:1C:\Users\admin\AppData\Roaming\view\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
69.0.3497.100
Modules
Images
c:\users\admin\appdata\roaming\view\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\view\chrome\application\69.0.3497.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1112"C:\Users\admin\AppData\Roaming\view\Chrome\Application\chrome.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --test-type=webdriver --field-trial-handle=924,5080749783065314531,747620237696653951,131072 --service-pipe-token=3969314853901885816 --lang=en-US --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0" --user-data-dir="C:\Users\admin\AppData\Roaming\view\Chrome\NewProfile" --disable-client-side-phishing-detection --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3969314853901885816 --renderer-client-id=5 --mojo-platform-channel-handle=1812 /prefetch:1C:\Users\admin\AppData\Roaming\view\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
69.0.3497.100
Modules
Images
c:\users\admin\appdata\roaming\view\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\view\chrome\application\69.0.3497.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1280"C:\Windows\system32\msconfig.exe" C:\Windows\system32\msconfig.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System Configuration Utility
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msconfig.exe
c:\systemroot\system32\ntdll.dll
1360"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3356 CREDAT:14343C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1364"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mmc.exe
c:\systemroot\system32\ntdll.dll
Total events
5 968
Read events
4 590
Write events
1 244
Delete events
134

Modification events

(PID) Process:(768) kleptoru.exeKey:HKEY_CURRENT_USER\Software\Downloader
Operation:writeName:quarantine
Value:
(PID) Process:(3492) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:HelpTopic
Value:
C:\Windows\Help\taskscheduler.chm
(PID) Process:(3492) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:LinkedHelpTopics
Value:
C:\Windows\Help\taskscheduler.chm
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(768) kleptoru.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\kleptoru_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
87
Suspicious files
60
Text files
508
Unknown types
100

Dropped files

PID
Process
Filename
Type
768kleptoru.exeC:\Users\admin\AppData\Local\Temp\Downloader\tempicon.ico
MD5:
SHA256:
3356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\favicon[1].ico
MD5:
SHA256:
3356iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2760A1A19270-2A25-491B-AF57-C9402B3B4B77.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm
MD5:
SHA256:
2760A1A19270-2A25-491B-AF57-C9402B3B4B77.exeC:\Users\admin\AppData\Local\Temp\3cdc-0a63-1dc3-8b0b\MailRu.ico
MD5:
SHA256:
768kleptoru.exeC:\Users\admin\AppData\Local\Temp\87DB0636-DF66-43DA-82BF-EE375069E010\87DB0636-DF66-43DA-82BF-EE375069E010.exeexecutable
MD5:
SHA256:
768kleptoru.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@onesystemhost[1].txttext
MD5:
SHA256:
2760A1A19270-2A25-491B-AF57-C9402B3B4B77.exeC:\Users\admin\AppData\Local\Temp\f21f-ab42-8737-ffaa\GoMailRu.ico
MD5:
SHA256:
768kleptoru.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@softodrom[1].txttext
MD5:
SHA256:
768kleptoru.exeC:\Users\admin\AppData\Local\Temp\E0C3AA0F-D734-4AB1-94A9-C8469EDE1804\E0C3AA0F-D734-4AB1-94A9-C8469EDE1804.exeexecutable
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
134
TCP/UDP connections
214
DNS requests
85
Threats
66

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
768
kleptoru.exe
HEAD
301
88.212.206.11:80
http://www.softodrom.ru/ftp/386/kleptoru.exe
RU
malicious
768
kleptoru.exe
POST
88.208.60.174:80
http://golmno.ru/api_v2/json/send/analyticsreport
NL
malicious
768
kleptoru.exe
GET
200
88.208.60.174:80
http://golmno.ru/upload/4b3fedd488b3a4b8fe830cd8f107158b.exe
NL
executable
2.84 Mb
malicious
768
kleptoru.exe
GET
200
192.133.141.11:80
http://savegglserps.com/install6.exe
US
executable
169 Kb
malicious
768
kleptoru.exe
POST
88.208.60.174:80
http://golmno.ru/api_v2/json/get/campaigns
NL
malicious
768
kleptoru.exe
POST
88.208.60.174:80
http://golmno.ru/api_v2/json/get/initialization
NL
malicious
768
kleptoru.exe
GET
200
88.208.60.174:80
http://golmno.ru/upload/9b33448929168974fa305a0ec4a35bc9.exe
NL
executable
623 Kb
malicious
768
kleptoru.exe
GET
200
104.24.118.133:80
http://vd.onesystemhost.net/331002722/OneSystemCare.exe
US
executable
3.96 Mb
shared
768
kleptoru.exe
GET
200
88.208.60.174:80
http://golmno.ru/icons/2.ico
NL
image
21.8 Kb
malicious
768
kleptoru.exe
POST
88.208.60.174:80
http://golmno.ru/api_v2/json/send/executereport
NL
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3356
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3240
iexplore.exe
88.212.206.11:80
www.softodrom.ru
United Network LLC
RU
malicious
3240
iexplore.exe
88.212.206.11:443
www.softodrom.ru
United Network LLC
RU
malicious
2760
A1A19270-2A25-491B-AF57-C9402B3B4B77.exe
217.69.139.245:80
mrds.mail.ru
Limited liability company Mail.Ru
RU
malicious
2760
A1A19270-2A25-491B-AF57-C9402B3B4B77.exe
217.69.139.245:443
mrds.mail.ru
Limited liability company Mail.Ru
RU
malicious
768
kleptoru.exe
88.208.60.174:80
golmno.ru
DataWeb Global Group B.V.
NL
malicious
768
kleptoru.exe
104.24.118.133:80
vd.onesystemhost.net
Cloudflare Inc
US
shared
768
kleptoru.exe
88.212.206.11:80
www.softodrom.ru
United Network LLC
RU
malicious
768
kleptoru.exe
88.212.206.11:443
www.softodrom.ru
United Network LLC
RU
malicious
768
kleptoru.exe
217.69.139.110:80
sputnikmailru.cdnmail.ru
Limited liability company Mail.Ru
RU
malicious

DNS requests

Domain
IP
Reputation
golmno.ru
  • 88.208.60.174
malicious
vd.onesystemhost.net
  • 104.24.118.133
  • 104.24.119.133
unknown
sputnikmailru.cdnmail.ru
  • 217.69.139.110
unknown
www.softodrom.ru
  • 88.212.206.11
malicious
savegglserps.com
  • 192.133.141.11
malicious
mywebshield-ww1.com
  • 200.7.97.34
malicious
getmywebshield.org
  • 5.149.249.101
unknown
xmlbinupdate.mail.ru
  • 217.69.139.247
shared
conserv.go.mail.ru
  • 217.69.139.122
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
768
kleptoru.exe
Misc activity
ADWARE [PTsecurity] AdLoad CnC Reverse Base64 POST
768
kleptoru.exe
Misc activity
ADWARE [PTsecurity] W32.DLHelper
768
kleptoru.exe
Misc activity
ADWARE [PTsecurity] Downloader.Win32.DownloadHelper.dcx POST base64 reverse
768
kleptoru.exe
Misc activity
ADWARE [PTsecurity] AdLoad CnC Reverse Base64 POST
768
kleptoru.exe
Misc activity
ADWARE [PTsecurity] AdLoad CnC Reverse Base64 POST
768
kleptoru.exe
Misc activity
ADWARE [PTsecurity] Downloader.Win32.DownloadHelper.dcx POST base64 reverse
768
kleptoru.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
768
kleptoru.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
768
kleptoru.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Possible threat - .exe downloading with HEAD option
768
kleptoru.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
17 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
MailRuUpdater.exe
RunAsService: Entry
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\view\Chrome\NewProfile directory exists )