File name:

pstwalker724.exe

Full analysis: https://app.any.run/tasks/04ebd1de-a452-42ba-9fd2-9b1d1246f1ac
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 21, 2024, 13:51:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

38039599E75C34AB9D55D4343F1926B6

SHA1:

342DF61EE04706CDCCF4470B2B4A985003812D32

SHA256:

8DB87ADC7C63C0C0E68883106598BB687BA14DD57476E8B55F4BC608765C0729

SSDEEP:

98304:J+cD4dnDbZhUNh4DpuLitQ0vN/6J4FkYC/zDfOgs7Hg5NiwhoJPVmVYrCfCEN5J3:+r83iHdJYaznwwUwMNF/xRryJwZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pstwalker724.exe (PID: 4052)
      • pstwalker724.exe (PID: 3848)
      • pstwalker724.tmp (PID: 3948)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pstwalker724.exe (PID: 4052)
      • pstwalker724.exe (PID: 3848)
      • pstwalker724.tmp (PID: 3948)

    • Reads the Windows owner or organization settings

      • pstwalker724.tmp (PID: 3948)

    • Reads the Internet Settings

      • pstwalker.exe (PID: 3936)

    • Reads security settings of Internet Explorer

      • pstwalker.exe (PID: 3936)

    • Reads Internet Explorer settings

      • pstwalker.exe (PID: 3936)

    • Changes Internet Explorer settings (feature browser emulation)

      • pstwalker.exe (PID: 3936)

  • INFO

    • Checks supported languages

      • pstwalker724.exe (PID: 4052)
      • pstwalker724.tmp (PID: 3652)
      • pstwalker724.exe (PID: 3848)
      • pstwalker724.tmp (PID: 3948)
      • pstwalker.exe (PID: 3936)

    • Reads the computer name

      • pstwalker724.tmp (PID: 3652)
      • pstwalker724.tmp (PID: 3948)
      • pstwalker.exe (PID: 3936)

    • Create files in a temporary directory

      • pstwalker724.exe (PID: 4052)
      • pstwalker724.exe (PID: 3848)

    • Creates files in the program directory

      • pstwalker724.tmp (PID: 3948)

    • Creates a software uninstall entry

      • pstwalker724.tmp (PID: 3948)

    • Reads the machine GUID from the registry

      • pstwalker.exe (PID: 3936)

    • Manual execution by a user

      • explorer.exe (PID: 4044)

    • Creates files or folders in the user directory

      • pstwalker.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: PST Walker Software
FileDescription: PST Walker Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: PST Walker
ProductVersion: 7.24
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pstwalker724.exe pstwalker724.tmp no specs pstwalker724.exe pstwalker724.tmp pstwalker.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3652"C:\Users\admin\AppData\Local\Temp\is-K3D0M.tmp\pstwalker724.tmp" /SL5="$E0170,12657799,832512,C:\Users\admin\AppData\Local\Temp\pstwalker724.exe" C:\Users\admin\AppData\Local\Temp\is-K3D0M.tmp\pstwalker724.tmp—pstwalker724.exe
User:
admin
Company:
PST Walker Software
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-k3d0m.tmp\pstwalker724.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3848"C:\Users\admin\AppData\Local\Temp\pstwalker724.exe" /SPAWNWND=$17013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\pstwalker724.exe
pstwalker724.tmp
User:
admin
Company:
PST Walker Software
Integrity Level:
HIGH
Description:
PST Walker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\pstwalker724.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3936"C:\Program Files\PSTWalker Software\OST PST Viewer\PSTWalker.exe"C:\Program Files\PSTWalker Software\OST PST Viewer\pstwalker.exe—pstwalker724.tmp
User:
admin
Company:
PST Walker Software
Integrity Level:
MEDIUM
Description:
PST Walker
Exit code:
0
Version:
7.24
Modules
Images
c:\program files\pstwalker software\ost pst viewer\pstwalker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3948"C:\Users\admin\AppData\Local\Temp\is-3DL0A.tmp\pstwalker724.tmp" /SL5="$100130,12657799,832512,C:\Users\admin\AppData\Local\Temp\pstwalker724.exe" /SPAWNWND=$17013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-3DL0A.tmp\pstwalker724.tmp
pstwalker724.exe
User:
admin
Company:
PST Walker Software
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3dl0a.tmp\pstwalker724.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
4044"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
4052"C:\Users\admin\AppData\Local\Temp\pstwalker724.exe" C:\Users\admin\AppData\Local\Temp\pstwalker724.exe
explorer.exe
User:
admin
Company:
PST Walker Software
Integrity Level:
MEDIUM
Description:
PST Walker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\pstwalker724.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
10 977
Read events
10 797
Write events
166
Delete events
14

Modification events

(PID) Process:(3948) pstwalker724.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
6C0F00004C7C7027CD64DA01
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
DF7EE91349F77ED7D74000B4FBD7D5D3736A9FA72A3B6A8283CB818F06285476
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\PSTWalker Software\OST PST Viewer\pstwalker.exe
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
0D9134986DEA0A6EDE7D1434006255B344BBEEEF3E8AB9C587B519EC916F2BED
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pst\OpenWithProgids
Operation:writeName:PSTWalker.FileAssoc.PST
Value:
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\pstwalker.exe\SupportedTypes
Operation:writeName:.pst
Value:
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ost\OpenWithProgids
Operation:writeName:PSTWalker.FileAssoc.OST
Value:
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\pstwalker.exe\SupportedTypes
Operation:writeName:.ost
Value:
(PID) Process:(3948) pstwalker724.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msg\OpenWithProgids
Operation:writeName:PSTWalker.FileAssoc.Msg
Value:
Executable files
18
Suspicious files
14
Text files
59
Unknown types
6

Dropped files

PID
Process
Filename
Type
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\is-ABCVB.tmpexecutable
MD5:42E32E5BED4C356983E70952DA033829
SHA256:CC77301BE82B744F212B803E76887CAD5A8346F2FD4F903D4D2E2C87AC36CE76
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\is-S7OIU.tmpexecutable
MD5:7EC6DCA5FB4891A7180204EBF485F1B9
SHA256:528EB8941B0780F78A878921012FC713E3C15EDF9424C449B76AD4E53FB5A6F4
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\pstwalker.exeexecutable
MD5:42E32E5BED4C356983E70952DA033829
SHA256:CC77301BE82B744F212B803E76887CAD5A8346F2FD4F903D4D2E2C87AC36CE76
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\unins000.exeexecutable
MD5:7EC6DCA5FB4891A7180204EBF485F1B9
SHA256:528EB8941B0780F78A878921012FC713E3C15EDF9424C449B76AD4E53FB5A6F4
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\is-58N8K.tmpbinary
MD5:1CA100AFA7A710F1CBA6D1E2EEE5AED8
SHA256:AFC17A99358031A09398241ABF669DAEA8F81A63CB489AD1E7864F76CEF6374A
4052pstwalker724.exeC:\Users\admin\AppData\Local\Temp\is-K3D0M.tmp\pstwalker724.tmpexecutable
MD5:C74D60342FCFA7A9D520B9D3AC2776A7
SHA256:27E49D6B80ABC2EEA358D91D4702E526541EF0E18C6BB69445D5549CBFE40A20
3848pstwalker724.exeC:\Users\admin\AppData\Local\Temp\is-3DL0A.tmp\pstwalker724.tmpexecutable
MD5:C74D60342FCFA7A9D520B9D3AC2776A7
SHA256:27E49D6B80ABC2EEA358D91D4702E526541EF0E18C6BB69445D5549CBFE40A20
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\is-FDVUS.tmpexecutable
MD5:266A1625A5CDC64B2CC834F86A074913
SHA256:5194148AFB7B01D8EF32F35DBED7FF34392678DA4A6CDA7059E98CBC05AE6E8D
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\ICSharpCode.SharpZipLib.dllexecutable
MD5:D59EF46A5F01DDFE7EB691E6C725A247
SHA256:C287E9B07A8251828F35914364C89A37DB606B0C1D64457F9EB8FA2258F0DEE3
3948pstwalker724.tmpC:\Program Files\PSTWalker Software\OST PST Viewer\is-N0F1K.tmpexecutable
MD5:5820D4930A77B2EC531C80F25F545EC7
SHA256:2178AB9E6BC7E5F4CDE8D471F04C2D6D25FDE8D19A79A7105B0E418776FBC1F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pstwalker724.exe