File name:

malware_autoit.zip

Full analysis: https://app.any.run/tasks/2bf16b7e-010f-4874-b3ab-e41cef8b02bf
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: July 25, 2019, 10:52:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0C1DFE43A4857242A524A9A991716306

SHA1:

5E9C5A652569439B3A21A7B43BE6DB16BFA8F263

SHA256:

8EED5B47CB08A8D5FF2C07CCA1C2526037A2D6F6D435177667916F9F2FBD2111

SSDEEP:

12288:YUHqHryZ16PCVK55cc2y+OJ4A/U23RhdtXFwcY2+1tFvOh52yin0tXn:YbY16PCIUgbUYREc3+vEmyin0tX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • streamer.exe (PID: 3364)
      • streamer.exe (PID: 3480)
      • streamer.exe (PID: 3468)
      • streamer.exe (PID: 3236)
      • streamer.exe (PID: 3604)

    • Changes the autorun value in the registry

      • streamer.exe (PID: 3364)

    • Connects to CnC server

      • streamer.exe (PID: 3480)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3860)
      • streamer.exe (PID: 3364)

    • Starts itself from another location

      • streamer.exe (PID: 3364)

    • Starts CMD.EXE for commands execution

      • streamer.exe (PID: 3364)
      • streamer.exe (PID: 3480)

    • Executed via COM

      • DllHost.exe (PID: 2724)

    • Uses RUNDLL32.EXE to load library

      • streamer.exe (PID: 3480)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 2712)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 1664)

    • Application launched itself

      • streamer.exe (PID: 3480)

  • INFO

    • Manual execution by user

      • cmd.exe (PID: 3096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:07:25 12:20:20
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: malware_autoit/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe cmd.exe no specs streamer.exe streamer.exe cmd.exe no specs streamer.exe no specs PhotoViewer.dll no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs streamer.exe no specs cmd.exe no specs streamer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1632"C:\Windows\System32\cmd.exe" /c start C:\streamer\streamer.exe /AutoIt3ExecuteScript C:\streamer/stream.txtC:\Windows\System32\cmd.exe—streamer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1664"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—streamer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2640"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—streamer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2712"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—streamer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2724C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2968"C:\Windows\System32\cmd.exe" /c C:\streamer\streamer.exe /AutoIt3ExecuteScript C:\streamer\stream.txtC:\Windows\System32\cmd.exe—streamer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3096"C:\Windows\system32\cmd.exe" /c start streamerdata\streamer.exe /AutoIt3ExecuteScript "streamerdata\stream.txt" ds6TP43Fj7ET6dk & exitC:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3236"C:\streamer\streamer.exe" /AutoIt3ExecuteScript C:\streamer\stream.txtC:\streamer\streamer.exe—streamer.exe
User:
admin
Company:
Carifred
Integrity Level:
MEDIUM
Description:
Ultra Virus Killer AutoIt script parser
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\streamer\streamer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3364streamerdata\streamer.exe /AutoIt3ExecuteScript "streamerdata\stream.txt" ds6TP43Fj7ET6dk C:\Users\admin\Desktop\malware_autoit\streamerdata\streamer.exe
cmd.exe
User:
admin
Company:
Carifred
Integrity Level:
MEDIUM
Description:
Ultra Virus Killer AutoIt script parser
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\malware_autoit\streamerdata\streamer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3468C:\streamer\streamer.exe /AutoIt3ExecuteScript C:\streamer\stream.txtC:\streamer\streamer.exe—cmd.exe
User:
admin
Company:
Carifred
Integrity Level:
MEDIUM
Description:
Ultra Virus Killer AutoIt script parser
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\streamer\streamer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
Total events
1 084
Read events
1 030
Write events
54
Delete events
0

Modification events

(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3860) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\malware_autoit.zip
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
3
Suspicious files
0
Text files
7
Unknown types
6

Dropped files

PID
Process
Filename
Type
3480streamer.exeC:\streamerdata\stream.txt —
MD5:—
SHA256:—
3364streamer.exeC:\streamerdata\run.battext
MD5:6A228B87697516374145B1C81BE0687C
SHA256:9F832E6E568536580E24DC504B0505C4004240BE4E8F630C9F80524CC2D871DA
3860WinRAR.exeC:\Users\admin\Desktop\malware_autoit\streamerdata\run.lnklnk
MD5:D7CDE2AF14F90FEBF211043CF8CAF77A
SHA256:4F0C4CF1E027572E92446EEBF5FA9CE0B8E1D22282BFE2B20603957E861D54CB
3364streamer.exeC:\streamerdata\stream.txta3x
MD5:C585F4FAEE96A0BEC3B0F93F37239008
SHA256:B4D8D7CBEC7FE4C24DCB9B38F6036A58B765EFDA10C42FCE7BBE2B2BF79CD53E
3364streamer.exeC:\streamer\run.battext
MD5:6A228B87697516374145B1C81BE0687C
SHA256:9F832E6E568536580E24DC504B0505C4004240BE4E8F630C9F80524CC2D871DA
3364streamer.exeC:\streamer\stream.txta3x
MD5:C585F4FAEE96A0BEC3B0F93F37239008
SHA256:B4D8D7CBEC7FE4C24DCB9B38F6036A58B765EFDA10C42FCE7BBE2B2BF79CD53E
3364streamer.exeC:\streamer\run.lnklnk
MD5:D7CDE2AF14F90FEBF211043CF8CAF77A
SHA256:4F0C4CF1E027572E92446EEBF5FA9CE0B8E1D22282BFE2B20603957E861D54CB
3364streamer.exeC:\streamerdata\streamer.exeexecutable
MD5:040CD888E971F2872D6D5DAFD52E6194
SHA256:77C2372364B6DD56BC787FDA46E6F4240AAA0353EAD1E3071224D454038A545E
3480streamer.exeC:\streamer\stream.txttext
MD5:—
SHA256:—
3480streamer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\4D53473A213A2055706461746564200D0A[1].txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
1
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3480
streamer.exe
GET
200
195.154.133.145:8393
http://newage.newminersage.com:8393/msg/303430392D2D5838362D33333030353337393237/4D53473A213A2055706461746564200D0A
FR
text
9 b
suspicious
3480
streamer.exe
GET
200
195.154.133.145:8393
http://newage.newminersage.com:8393/303430392D2D5838362D33333030353337393237/1/0/0
FR
text
176 b
suspicious
3480
streamer.exe
GET
200
195.154.133.145:70
http://195.154.133.145:70/raw/aAutoitlastworm88393/8393/rcsXvQ12
FR
text
14.8 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3480
streamer.exe
195.154.133.145:8393
newage.newminersage.com
Online S.a.s.
FR
suspicious
3480
streamer.exe
195.154.133.145:70
newage.newminersage.com
Online S.a.s.
FR
suspicious

DNS requests

Domain
IP
Reputation
newage.newminersage.com
  • 195.154.133.145
malicious

Threats

PID
Process
Class
Message
3480
streamer.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
3480
streamer.exe
A Network Trojan was detected
ET TROJAN Win32/Retadup CnC Checkin M1
3480
streamer.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
3480
streamer.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malware_autoit.zip