File name:

bc4579add82d6e9aa6c730d4120b17f2

Full analysis: https://app.any.run/tasks/c41c7ad7-4453-4f86-b616-1bd3c3b25f9c
Verdict: Malicious activity
Analysis date: June 03, 2024, 09:15:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BC4579ADD82D6E9AA6C730D4120B17F2

SHA1:

F589D260319D572FD9B11414711B349AE71C3A6A

SHA256:

84D4ACE067A79D8B6251646D4095051A829F576D8F679A2DC2B5A0EAEC276445

SSDEEP:

98304:/4wD8HLDwG8e+Ue2xLBb89JH622zgmXmtwtR52ph1wxmsmk4LsjZYH6tM2KtyiQh:v6OLH402A82TpyMlvi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • bc4579add82d6e9aa6c730d4120b17f2.exe (PID: 3976)
      • AKernel3.exe (PID: 4008)
      • systecv3.exe (PID: 4024)

    • Creates a writable file in the system directory

      • systecv3.exe (PID: 4024)
      • winrdlv3.exe (PID: 2104)

    • Runs injected code in another process

      • winrdgv3.exe (PID: 4044)
      • winrdlv3.exe (PID: 2104)

    • Application was injected by another process

      • wininit.exe (PID: 376)
      • svchost.exe (PID: 592)
      • svchost.exe (PID: 884)
      • wininit.exe (PID: 392)

  • SUSPICIOUS

    • Application launched itself

      • AKernel3.exe (PID: 3992)
      • winrdlv3.exe (PID: 4088)
      • winrdlv3.exe (PID: 1732)

    • Drops a system driver (possible attempt to evade defenses)

      • AKernel3.exe (PID: 4008)
      • systecv3.exe (PID: 4024)

    • Executable content was dropped or overwritten

      • bc4579add82d6e9aa6c730d4120b17f2.exe (PID: 3976)
      • systecv3.exe (PID: 4024)
      • AKernel3.exe (PID: 4008)

    • Executes as Windows Service

      • winrdgv3.exe (PID: 4044)

    • Checks Windows Trust Settings

      • winrdgv3.exe (PID: 4044)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 2188)
      • sipnotify.exe (PID: 2204)

    • Connects to unusual port

      • winrdlv3.exe (PID: 2104)

  • INFO

    • Checks Windows language

      • AKernel3.exe (PID: 4008)
      • systecv3.exe (PID: 4024)
      • winrdlv3.exe (PID: 2104)
      • winrdlv3.exe (PID: 704)

    • Checks supported languages

      • bc4579add82d6e9aa6c730d4120b17f2.exe (PID: 3976)
      • AKernel3.exe (PID: 4008)
      • AKernel3.exe (PID: 3992)
      • systecv3.exe (PID: 4024)
      • winrdgv3.exe (PID: 4044)
      • winrdlv3.exe (PID: 4088)
      • winrdlv3.exe (PID: 2104)
      • winrdlv3.exe (PID: 704)
      • winrdlv3.exe (PID: 1732)

    • Reads the computer name

      • AKernel3.exe (PID: 4008)
      • AKernel3.exe (PID: 3992)
      • systecv3.exe (PID: 4024)
      • winrdgv3.exe (PID: 4044)
      • winrdlv3.exe (PID: 2104)
      • winrdlv3.exe (PID: 704)

    • Creates files in the program directory

      • bc4579add82d6e9aa6c730d4120b17f2.exe (PID: 3976)
      • AKernel3.exe (PID: 4008)

    • Create files in a temporary directory

      • bc4579add82d6e9aa6c730d4120b17f2.exe (PID: 3976)

    • Reads the machine GUID from the registry

      • winrdgv3.exe (PID: 4044)
      • winrdlv3.exe (PID: 2104)

    • Reads the software policy settings

      • wininit.exe (PID: 376)
      • winrdgv3.exe (PID: 4044)
      • wininit.exe (PID: 392)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 2356)
      • IMEKLMG.EXE (PID: 2364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (15.8)
.exe | Win64 Executable (generic) (14)
.scr | Windows screen saver (6.6)
.exe | Win32 Executable (generic) (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:08:02 08:30:10+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 483328
InitializedDataSize: 10530816
UninitializedDataSize: -
EntryPoint: 0x1f398
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.0.0.13
ProductVersionNumber: 4.0.0.13
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Ocular Agent V3
FileVersion: 4.0.0.13
InternalName: Agent
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: AgentStp
PrivateBuild: -
ProductName: Ocular Tool
ProductVersion: 4.0.0.13
SpecialBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
17
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bc4579add82d6e9aa6c730d4120b17f2.exe akernel3.exe no specs akernel3.exe systecv3.exe winrdgv3.exe no specs winrdlv3.exe no specs winrdlv3.exe wininit.exe winrdlv3.exe no specs winrdlv3.exe no specs ctfmon.exe no specs sipnotify.exe no specs imeklmg.exe no specs imeklmg.exe no specs wininit.exe svchost.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
376wininit.exeC:\Windows\System32\wininit.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Start-Up Application
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wininit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
392wininit.exeC:\Windows\System32\wininit.exe
smss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Start-Up Application
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wininit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
592C:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpnpmgr.dll
c:\windows\system32\spinf.dll
c:\windows\system32\user32.dll
704C:\Windows\system32\winrdlv3.exe winoav3.dll,RunAgent32C:\Windows\System32\winrdlv3.exe—winrdlv3.exe
User:
SYSTEM
Company:
TEC Solutions Limited.
Integrity Level:
SYSTEM
Description:
Winrdlv3
Version:
4, 61, 112, 0
Modules
Images
c:\windows\system32\winrdlv3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winoav3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
884C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1732C:\Windows\system32\winrdlv3.exe winwdgv3.dll,RunMonitor32C:\Windows\System32\winrdlv3.exe—winrdgv3.exe
User:
SYSTEM
Company:
TEC Solutions Limited.
Integrity Level:
SYSTEM
Description:
Winrdlv3
Version:
4, 61, 112, 0
Modules
Images
c:\windows\system32\winrdlv3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winwdgv3.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2104C:\Windows\system32\winrdlv3.exe winoav3.dll,RunAgent32C:\Windows\System32\winrdlv3.exe
winrdlv3.exe
User:
SYSTEM
Company:
TEC Solutions Limited.
Integrity Level:
SYSTEM
Description:
Winrdlv3
Exit code:
0
Version:
4, 61, 112, 0
Modules
Images
c:\windows\system32\winrdlv3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winoav3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2188C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2204C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
2356"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Total events
70 960
Read events
70 437
Write events
433
Delete events
90

Modification events

(PID) Process:(3976) bc4579add82d6e9aa6c730d4120b17f2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:InstallSetup
Value:
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:InstallSetup
Value:
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:InstallParams
Value:
m_dwVersionID=00000000;m_dwProductNo=214E0000;m_dtExpire=0000000000000000;m_bRegistered=01000000;m_wstrFunctions=4600460046004600460046004600460046004600460046003000330030003000;m_arrCheckCode=;m_bValidSDSn=00000000;m_arrServerIP=C3C6EECEA4C6EECE89C6EECE;m_arrServerName=;
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:SafeInstallParams
Value:
#OAIPHEAD#390B3023023126273D3B3A1D106964646464646464646F390B302304263B302137201A3B6966656011646464646F390B3020112C243D263169646464646464646464646464646464646F390B360631333D2720312631306964656464646464646F390B2327202612213A37203D3B3A2769606264646062646460626464606264646062646460626464606264646062646460626464606264646062646460626464676464646767646467646464676464646F390B352626173C31373F173B3031696F390B360235383D300710073A6964646464646464646F390B3526260731262231261D0469176717621111171115601762111117116C6D1762111117116F390B3526260731262231261A353931696F
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:InstallTime
Value:
0BC121ADCD30E640
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:RunAs
Value:
1
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:UplThirdPageMod_Unzip
Value:
1
(PID) Process:(4008) AKernel3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\Agent
Operation:writeName:UpdataGUID
Value:
1
(PID) Process:(4024) systecv3.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:delete valueName:PendingFileRenameOperations
Value:
(PID) Process:(4024) systecv3.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NetCfgLockHolder
Operation:delete keyName:(default)
Value:
Executable files
49
Suspicious files
7
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3976bc4579add82d6e9aa6c730d4120b17f2.exeC:\ProgramData\IPGASKERNEL20240603101516\SetupData.dat —
MD5:—
SHA256:—
4008AKernel3.exeC:\Program Files\Common Files\System\systecv3.exeexecutable
MD5:B9E0A7CBD7FDB4D179172DBDD453495A
SHA256:CB72B724C5F57E83CC5BC215DD522C566E0EA695B9E3D167EED9BE3F18D273CE
4008AKernel3.exeC:\Program Files\Common Files\System\file001.tmp.bak001038EDexecutable
MD5:97AC3EF2E098C4CB7DD6EC1D14DC28F1
SHA256:A3D817490804A951BAC1C7B1EA6F48AED75BAEC7E3B4E31BE4FBD1FE82860BB1
4008AKernel3.exeC:\ProgramData\IPGASZIP20240603101524\file002.tmpexecutable
MD5:0AED8F70A00060F8005EFA8D1C668B98
SHA256:326ABF1AF467670DE571252BFD8118B9EA0B8A3BABC10DF092FFFC2DA3E11671
4008AKernel3.exeC:\Program Files\Common Files\System\winrdgv3.exeexecutable
MD5:97AC3EF2E098C4CB7DD6EC1D14DC28F1
SHA256:A3D817490804A951BAC1C7B1EA6F48AED75BAEC7E3B4E31BE4FBD1FE82860BB1
4008AKernel3.exeC:\ProgramData\IPGASZIP20240603101524\file001.tmp.bak001038EDexecutable
MD5:97AC3EF2E098C4CB7DD6EC1D14DC28F1
SHA256:A3D817490804A951BAC1C7B1EA6F48AED75BAEC7E3B4E31BE4FBD1FE82860BB1
4008AKernel3.exeC:\ProgramData\IPGASZIP20240603101524\file000.tmp.bak00103A94executable
MD5:B9E0A7CBD7FDB4D179172DBDD453495A
SHA256:CB72B724C5F57E83CC5BC215DD522C566E0EA695B9E3D167EED9BE3F18D273CE
4008AKernel3.exeC:\Windows\bakstec3.sysexecutable
MD5:B9E0A7CBD7FDB4D179172DBDD453495A
SHA256:CB72B724C5F57E83CC5BC215DD522C566E0EA695B9E3D167EED9BE3F18D273CE
4008AKernel3.exeC:\Windows\file000.tmp.bak0010399Dexecutable
MD5:B9E0A7CBD7FDB4D179172DBDD453495A
SHA256:CB72B724C5F57E83CC5BC215DD522C566E0EA695B9E3D167EED9BE3F18D273CE
3976bc4579add82d6e9aa6c730d4120b17f2.exeC:\Users\admin\AppData\Local\Temp\AgentInstall\Installation.logtext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2104
winrdlv3.exe
206.238.198.195:8237
—
TERAEXCH
ZA
unknown
1096
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1492
svchost.exe
239.255.255.250:3702
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bc4579add82d6e9aa6c730d4120b17f2