File name:

file

Full analysis: https://app.any.run/tasks/6b29b264-91cb-4b49-a9dd-1e1a14ff033b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 09, 2023, 00:47:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealc
stealer
loader
smoke
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

5119E57BB0C971D0FAE64D0548C78EE0

SHA1:

73B785B67E0D218CBFD58A7902193402AB88094B

SHA256:

98E2336AFE9AED01D8859C988CB984A017800BF5A5760A643B9F5579C8936E40

SSDEEP:

98304:OhCC32/SN19QEyeCGEiRxWhkwwV7JE8E+WaR3j7449o3iVo8Rdmkb1/szBW1K2YB:OWkPT6YFw3SWKXXV93VaXy5eVuO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 2928)
      • set16.exe (PID: 2272)
      • kos1.exe (PID: 2544)
      • is-1ONTO.tmp (PID: 1556)
      • previewer.exe (PID: 304)
      • latestX.exe (PID: 988)
      • updater.exe (PID: 2144)

    • Application was dropped or rewritten from another process

      • toolspub2.exe (PID: 2216)
      • kos1.exe (PID: 2544)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • Setup.exe (PID: 2764)
      • set16.exe (PID: 2272)
      • set16.exe (PID: 3012)
      • toolspub2.exe (PID: 2472)
      • kos.exe (PID: 2116)
      • latestX.exe (PID: 988)
      • latestX.exe (PID: 2864)
      • previewer.exe (PID: 2040)
      • previewer.exe (PID: 304)
      • updater.exe (PID: 2144)

    • Loads dropped or rewritten executable

      • is-1ONTO.tmp (PID: 1556)

    • Runs injected code in another process

      • toolspub2.exe (PID: 2472)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • STEALC was detected

      • InstallUtil.exe (PID: 2564)

    • Connects to the CnC server

      • InstallUtil.exe (PID: 2564)
      • explorer.exe (PID: 1944)

    • SMOKE was detected

      • explorer.exe (PID: 1944)

    • Uses Task Scheduler to autorun other applications

      • powershell.exe (PID: 1072)
      • powershell.exe (PID: 1776)

    • Uses Task Scheduler to run other applications

      • explorer.exe (PID: 1944)

    • Creates a writable file the system directory

      • powershell.exe (PID: 2216)

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 1944)

    • Modifies hosts file to block updates

      • latestX.exe (PID: 988)

  • SUSPICIOUS

    • Reads the Internet Settings

      • file.exe (PID: 2928)
      • kos1.exe (PID: 2544)
      • kos.exe (PID: 2116)
      • InstallUtil.exe (PID: 2564)
      • powershell.exe (PID: 2324)
      • previewer.exe (PID: 2040)

    • Application launched itself

      • toolspub2.exe (PID: 2216)
      • explorer.exe (PID: 1944)

    • Reads the Windows owner or organization settings

      • is-1ONTO.tmp (PID: 1556)

    • Process drops legitimate windows executable

      • is-1ONTO.tmp (PID: 1556)

    • Reads settings of System Certificates

      • kos.exe (PID: 2116)

    • Connects to the server without a host name

      • InstallUtil.exe (PID: 2564)

    • Starts POWERSHELL.EXE for commands execution

      • explorer.exe (PID: 1944)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 284)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 1944)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 2124)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2144)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 2144)

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 1944)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2216)

    • Unusual connection from system programs

      • powershell.exe (PID: 2216)

    • Connects to unusual port

      • explorer.exe (PID: 2332)

  • INFO

    • Reads the computer name

      • file.exe (PID: 2928)
      • kos1.exe (PID: 2544)
      • Setup.exe (PID: 2764)
      • kos.exe (PID: 2116)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • previewer.exe (PID: 304)
      • is-1ONTO.tmp (PID: 1556)
      • previewer.exe (PID: 2040)
      • InstallUtil.exe (PID: 2564)

    • Checks supported languages

      • file.exe (PID: 2928)
      • toolspub2.exe (PID: 2216)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • kos1.exe (PID: 2544)
      • Setup.exe (PID: 2764)
      • set16.exe (PID: 2272)
      • toolspub2.exe (PID: 2472)
      • is-1ONTO.tmp (PID: 1556)
      • kos.exe (PID: 2116)
      • previewer.exe (PID: 304)
      • previewer.exe (PID: 2040)
      • latestX.exe (PID: 988)
      • InstallUtil.exe (PID: 2564)
      • updater.exe (PID: 2144)

    • Create files in a temporary directory

      • kos1.exe (PID: 2544)
      • file.exe (PID: 2928)
      • set16.exe (PID: 2272)
      • is-1ONTO.tmp (PID: 1556)
      • kos.exe (PID: 2116)
      • previewer.exe (PID: 304)

    • Creates files in the program directory

      • Setup.exe (PID: 2764)
      • previewer.exe (PID: 304)
      • is-1ONTO.tmp (PID: 1556)
      • latestX.exe (PID: 988)
      • updater.exe (PID: 2144)
      • previewer.exe (PID: 2040)

    • Reads Environment values

      • kos.exe (PID: 2116)

    • Application was dropped or rewritten from another process

      • is-1ONTO.tmp (PID: 1556)

    • Reads the machine GUID from the registry

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 2776)
      • kos.exe (PID: 2116)
      • Setup.exe (PID: 2764)
      • InstallUtil.exe (PID: 2564)
      • previewer.exe (PID: 2040)

    • Checks proxy server information

      • InstallUtil.exe (PID: 2564)
      • previewer.exe (PID: 2040)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:08 22:05:23+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 14077952
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xd6ee3e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: zinda.exe
LegalCopyright:
OriginalFileName: zinda.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
50
Malicious processes
18
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start inject file.exe no specs toolspub2.exe no specs e0cbefcb1af40c7d4aff4aca26621a98.exe no specs kos1.exe no specs setup.exe no specs set16.exe no specs latestx.exe no specs set16.exe toolspub2.exe no specs kos.exe is-1onto.tmp no specs latestx.exe net.exe no specs previewer.exe no specs net1.exe no specs previewer.exe #STEALC installutil.exe #SMOKE explorer.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe cmd.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs schtasks.exe updater.exe no specs powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe sc.exe no specs powershell.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs conhost.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvcC:\Windows\System32\cmd.exe
explorer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
304"C:\Program Files (x86)\PA Previewer\previewer.exe" -iC:\Program Files (x86)\PA Previewer\previewer.exe—is-1ONTO.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
23.8.8416.1
Modules
Images
c:\program files (x86)\pa previewer\previewer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\wow64win.dll
588powercfg /x -hibernate-timeout-dc 0 C:\Windows\System32\powercfg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
980sc stop dosvcC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
988"C:\Users\admin\AppData\Local\Temp\latestX.exe" C:\Users\admin\AppData\Local\Temp\latestX.exe
file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\latestx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
996powercfg /x -hibernate-timeout-ac 0 C:\Windows\System32\powercfg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1012sc stop UsoSvc C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1040powercfg /x -hibernate-timeout-ac 0 C:\Windows\System32\powercfg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1072C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1208sc stop bits C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
9 135
Read events
9 027
Write events
108
Delete events
0

Modification events

(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2928) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2544) kos1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000C5000000FF00000063ED690015000000070000001F1D06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000100300000000B06FD70300000000BFDC7109000000000A000080000000004DBC20FEFE070000000000000000000080DF100300000000D8ED10030000000001000000000000000A0000800000000004FE20FEFE0700000000000000000000D8ED100300000000D8ED10030000000002000000000000007500F400CB09000030C22D0000000000011002111A086E00BFDC71090000000000D3A70200000000B06FD70300000000C0A32B0000000000880000000000000040B35CFEFE0700000000000000000000000000000000000000002B0000000000C803CE77000000000000000000000000D00300000000000000002B0000000000D037C40300000000280CBF770000000048062B000000000048DDC177000000000000000000000000C1030000000000000700DE02A704000010812B000000000090047009000000000000000000000000D0ED1003000000000800000000000000601B860700000000207D2B0000000000C8225DFEFE0700001C7F2B000000000040042D00000000005B590EFFFE0700000200000000000000B8B7870700000000601B860700000000A54208FFFE070000C803CE7707000000250000004B7A0B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000075006C0074000000000000000000010000000000000088E2EA0200000000000000000000000030E0EA020000000028E0EA020000000020E0EA0200000000586705FCFE070000000000000000000040E0EA0200000000000000000000000000000000000000003E00400000000000B0E8EA02000000003053A203000000000000000000000000000000000000000022BBD2FF0000000000003D4A62B00000E000070000000000A210000000000000E0F1EA02000000000000000000000000300B8B0200000000A4768F0200000000D4AF17FEFE070000B0E3EA0200000000200C9C0A000000000100000000000000D46905FCFE0700001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000E8261C007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E006500780065000000008000000000542DC9FDFE070000000000000000000068009902000000005800010000000000000000000000000000002B0000000000EB1AC07700000000680099020000000000000000FE0700002825D2FDFE070000F099A90200000000180099020000000000000000000000000100000000000000BF1DC9FDFE07000030E010030000000010D1AB020000000000000000000000003B94B8FDFE070000B04EAB020000000008009902000000005800010000000000869AAE7700000000C7F7CF529EC5000082020000000000000000000000000000580001000000000000000000000000008202000000000000020000000000000058000100000000000000000000000000820200000000000080A630FF00000000C81222FF00000000B04EAB020000000001000000000000000F0000C00000000090DFDD0300000000820200000000000001000000000000008202000000000000DB9BAE77000000005800010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000
(PID) Process:(2116) kos.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
23
Suspicious files
23
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2928file.exeC:\Users\admin\AppData\Local\Temp\kos1.exeexecutable
MD5:85B698363E74BA3C08FC16297DDC284E
SHA256:78EFCBB0C6EB6A4C76C036ADC65154B8FF028849F79D508E45BABFB527CB7CFE
2928file.exeC:\Users\admin\AppData\Local\Temp\toolspub2.exeexecutable
MD5:D2FF6B5F2B7469FE3F6DC12C573735D1
SHA256:04969E573FE6DC8E69B1733C56164F9C53B0C33A823B940EE7A08167FF067252
2928file.exeC:\Users\admin\AppData\Local\Temp\latestX.exeexecutable
MD5:BAE29E49E8190BFBBF0D77FFAB8DE59D
SHA256:F91E4FF7811A5848561463D970C51870C9299A80117A89FB86A698B9F727DE87
2544kos1.exeC:\Users\admin\AppData\Local\Temp\set16.exeexecutable
MD5:22D5269955F256A444BD902847B04A3B
SHA256:AB16986253BD187E3134F27495EF0DB4B648F769721BC8C84B708C7BA69156FD
2544kos1.exeC:\Users\admin\AppData\Local\Temp\kos.exeexecutable
MD5:076AB7D1CC5150A5E9F8745CC5F5FB6C
SHA256:D1B71081D7BA414B589338329F278BA51C6CCF542D74F131F96C2337EE0A4C90
2928file.exeC:\Users\admin\AppData\Local\Temp\Setup.exeexecutable
MD5:4C7EFD165AF03D720CE4A9D381BFB29A
SHA256:F5BBE3FDC27074249C6860B8959A155E6C79571DAA86E7A574656A3C5C6326B8
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_RegDLL.tmpexecutable
MD5:BB211D7A8CEA15072DE7425403508C17
SHA256:E71EC712064F193C367B0BB95A07A6DD9EB450BE1BE12CD48073FEFA1C3E0E58
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_setup64.tmpexecutable
MD5:42BF074B99A445614BD19C6E5724A01A
SHA256:0A6C41612400C3400466A0583DBB0E6C9BD310393704807E4F9617AA53ABDED6
2928file.exeC:\Users\admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeexecutable
MD5:41E1611E1D7EC85F611C4717B9F38599
SHA256:309B3D7DB8A0EC9FAAE6C2A89F72E94B8465B393B3F8729E9D87FCDFF765E813
1556is-1ONTO.tmpC:\Users\admin\AppData\Local\Temp\is-FOMTB.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
14
DNS requests
9
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2116
kos.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ee991669e51ae835
unknown
compressed
61.6 Kb
unknown
2216
powershell.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?603b4061c116a53b
unknown
compressed
4.66 Kb
unknown
1944
explorer.exe
POST
404
194.169.175.127:80
http://host-host-file8.com/
unknown
binary
7 b
unknown
2040
previewer.exe
GET
200
104.21.89.251:80
http://datasheet.fun/manual/avon_3_2022.pdf?eb639ef9
unknown
pdf
2.96 Kb
unknown
2564
InstallUtil.exe
POST
200
5.42.65.39:80
http://5.42.65.39/bed95ea4798a5204.php
unknown
text
8 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2116
kos.exe
148.251.234.93:443
iplogger.com
Hetzner Online GmbH
DE
unknown
2116
kos.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2564
InstallUtil.exe
5.42.65.39:80
—
CJSC Kolomna-Sviaz TV
RU
unknown
1944
explorer.exe
194.169.175.127:80
host-host-file8.com
—
US
unknown
2216
powershell.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2332
explorer.exe
212.47.253.124:14433
xmr-eu1.nanopool.org
Online S.a.s.
FR
unknown

DNS requests

Domain
IP
Reputation
iplogger.com
  • 148.251.234.93
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
host-file-host6.com
  • —
unknown
host-host-file8.com
  • 194.169.175.127
unknown
xmr-eu1.nanopool.org
  • 51.68.143.81
  • 212.47.253.124
  • 51.15.58.224
  • 51.255.34.118
  • 163.172.154.142
  • 51.68.190.80
  • 51.15.65.182
  • 135.125.238.108
  • 51.15.193.130
unknown
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
datasheet.fun
  • 104.21.89.251
  • 172.67.166.109
malicious
teredo.ipv6.microsoft.com
  • —
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (iplogger .com in DNS lookup)
2116
kos.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)
2564
InstallUtil.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
2564
InstallUtil.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
2 ETPRO signatures available at the full report
No debug info