analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MelonHel.zip

Full analysis: https://app.any.run/tasks/b1ce3124-3eb5-4bc5-b76b-ca9ab80e12f3
Verdict: Malicious activity
Analysis date: December 06, 2022, 00:32:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

491B63598177EBE2F87E919D8FFF78F3

SHA1:

250B61941A47A72CDA9BF8E5DA5FFD45C1E9DF60

SHA256:

9E2D0FE29A4BF5F32A730DFEE631D241C911734BC88F7CDEE081C5298404EAF2

SSDEEP:

196608:Kse6Cf4LpQVd8CF15t7P490kr9jJNE1Qb2Jdy0o38tRCNAO8nACRUJW//Fd:Ks3CfPECF15JP+04dNE1RdyLMtRCIA2d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MelonHel.exe (PID: 3880)
      • MelonHel.exe (PID: 800)
      • qsvte.btmp (PID: 2576)

    • Drops the executable file immediately after the start

      • MelonHel.exe (PID: 3880)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MelonHel.exe (PID: 3880)

    • Starts itself from another location

      • MelonHel.exe (PID: 3880)

    • Connects to unusual port

      • qsvte.btmp (PID: 2576)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs melonhel.exe no specs melonhel.exe cmd.exe no specs qsvte.btmp

Process information

PID
CMD
Path
Indicators
Parent process
1756"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MelonHel.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
800"C:\Users\admin\Desktop\MelonHel.exe" C:\Users\admin\Desktop\MelonHel.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\melonhel.exe
c:\windows\system32\ntdll.dll
3880"C:\Users\admin\Desktop\MelonHel.exe" C:\Users\admin\Desktop\MelonHel.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\melonhel.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
2560C:\Windows\system32\cmd.exe /c del *.btmpC:\Windows\system32\cmd.exe—MelonHel.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
2576"C:\Users\admin\Desktop\MelonHel.exe" C:\Users\admin\Desktop\qsvte.btmp
MelonHel.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\qsvte.btmp
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
2 342
Read events
2 311
Write events
31
Delete events
0

Modification events

(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1756) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MelonHel.zip
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1756) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
8
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2576qsvte.btmpC:\Users\admin\Desktop\Settings.binbinary
MD5:0BC4C335848AC7D3D6700029DDB918C8
SHA256:4C918FA4693DBE1723562D7BF6EC47CB2E1CC5A600534FE9C0A21E8A5ABD797D
2576qsvte.btmpC:\Users\admin\Desktop\Backup\Settings.2.binbinary
MD5:0BC4C335848AC7D3D6700029DDB918C8
SHA256:4C918FA4693DBE1723562D7BF6EC47CB2E1CC5A600534FE9C0A21E8A5ABD797D
2576qsvte.btmpC:\Users\admin\AppData\Roaming\Bitcoin\LinM_Auto\peers.5784binary
MD5:43705FB8DB22226E7D742A336B2258FF
SHA256:3B211E82E36E04E37EBF69915534A43297D5C23C64623558FD1755994DE348B4
1756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1756.25423\MelonHel.exeexecutable
MD5:186F23D842253AE4E4A56D388E8EF5B3
SHA256:3B7BB62D2B52A3009CD234BF935C8DDE2D29D83739D84A6F8F3759124A99FF46
3880MelonHel.exeC:\Users\admin\Desktop\qsvte.btmpexecutable
MD5:186F23D842253AE4E4A56D388E8EF5B3
SHA256:3B7BB62D2B52A3009CD234BF935C8DDE2D29D83739D84A6F8F3759124A99FF46
2576qsvte.btmpC:\Users\admin\Desktop\Backup\Settings.1.binbinary
MD5:0BC4C335848AC7D3D6700029DDB918C8
SHA256:4C918FA4693DBE1723562D7BF6EC47CB2E1CC5A600534FE9C0A21E8A5ABD797D
2576qsvte.btmpC:\Users\admin\AppData\Roaming\Bitcoin\LinM_Auto\peers.datbinary
MD5:43705FB8DB22226E7D742A336B2258FF
SHA256:3B211E82E36E04E37EBF69915534A43297D5C23C64623558FD1755994DE348B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2576
qsvte.btmp
183.111.79.66:2055
—
Korea Telecom
KR
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MelonHel.zip