analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

lpiograd.bin.zip

Full analysis: https://app.any.run/tasks/73b44eef-3220-4b3d-a4ab-9de067e16a06
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: November 14, 2018, 23:18:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

70AA6898D8E0E3923AFD60BFE56C6576

SHA1:

AE219F9C2215450D7334AC63F6E972691CE35181

SHA256:

9816A4E555542AA44CB384E62B8FF3213F5A6648EB480D80B6287355E75BE863

SSDEEP:

3072:eKI+ysLY+PtlIEplOuLfg8UjNE+xRbfx43H:MqTplOuLfgV1l6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 614.exe (PID: 2952)
      • 614.exe (PID: 3512)
      • 614.exe (PID: 2964)
      • 614.exe (PID: 828)
      • lpiograd.exe (PID: 3280)
      • lpiograd.exe (PID: 2620)
    • Emotet process was detected

      • lpiograd.exe (PID: 2620)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 614.exe (PID: 2964)
    • Starts itself from another location

      • 614.exe (PID: 2964)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2018:11:13 22:29:11
ZipCRC: 0x073ef64b
ZipCompressedSize: 102222
ZipUncompressedSize: 151552
ZipFileName: 614.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs 614.exe no specs 614.exe no specs 614.exe no specs 614.exe #EMOTET lpiograd.exe no specs lpiograd.exe

Process information

PID
CMD
Path
Indicators
Parent process
3772"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\lpiograd.bin.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2952"C:\Users\admin\Desktop\614.exe" C:\Users\admin\Desktop\614.exeexplorer.exe
User:
admin
Company:
AbanSoft / Sun Microsystems, Inc.
Integrity Level:
MEDIUM
Description:
Window I Stub
Exit code:
0
Version:
1, 4, 2, 50
3512"C:\Users\admin\Desktop\614.exe"C:\Users\admin\Desktop\614.exe614.exe
User:
admin
Company:
AbanSoft / Sun Microsystems, Inc.
Integrity Level:
MEDIUM
Description:
Window I Stub
Exit code:
0
Version:
1, 4, 2, 50
828"C:\Users\admin\Desktop\614.exe" C:\Users\admin\Desktop\614.exeexplorer.exe
User:
admin
Company:
AbanSoft / Sun Microsystems, Inc.
Integrity Level:
MEDIUM
Description:
Window I Stub
Exit code:
0
Version:
1, 4, 2, 50
2964"C:\Users\admin\Desktop\614.exe"C:\Users\admin\Desktop\614.exe
614.exe
User:
admin
Company:
AbanSoft / Sun Microsystems, Inc.
Integrity Level:
MEDIUM
Description:
Window I Stub
Exit code:
0
Version:
1, 4, 2, 50
2620"C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe
614.exe
User:
admin
Company:
AbanSoft / Sun Microsystems, Inc.
Integrity Level:
MEDIUM
Description:
Window I Stub
Exit code:
0
Version:
1, 4, 2, 50
3280"C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe
lpiograd.exe
User:
admin
Company:
AbanSoft / Sun Microsystems, Inc.
Integrity Level:
MEDIUM
Description:
Window I Stub
Version:
1, 4, 2, 50
Total events
399
Read events
363
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3772WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3772.1104\614.bin
MD5:
SHA256:
2964614.exeC:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exeexecutable
MD5:98A06525B6E6529BE5BB1841D5A10341
SHA256:5F0DF0C31C47DA2CF9E379F392144BF8D2437D436D9EA7C14FF07F5D04A705E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3280
lpiograd.exe
187.163.174.149:8080
Axtel, S.A.B. de C.V.
MX
malicious

DNS requests

No data

Threats

No threats detected
No debug info