File name:

Bltools 2.9.1[PRO].7z

Full analysis: https://app.any.run/tasks/6b8e809c-ad98-4706-a955-7c2216a00b22
Verdict: Malicious activity
Analysis date: November 03, 2024, 14:07:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
ims-api
generic
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

7711D07A88D364EC16CE541ACCFAEE1D

SHA1:

C78D954D3F8EACF972D2197162F3530D22DD2F0E

SHA256:

A296054BB4D289773A08C2678625715DC00DC386A11D1C312DEB9BA758F14F96

SSDEEP:

98304:xRQNnynRKLjwl1TG4VGbSLd4l1jKDgT3tXPyeScaQFWRy1iXhJeYjegAQZfDRThv:xNDKrBLHlEQB7XtG4Z4v5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 700)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 700)

    • Executable content was dropped or overwritten

      • BLTools v2.9.1[PRO].exe (PID: 3156)
      • CookiesCreator v1.2.exe (PID: 2652)
      • BLTools v2.9.1[PRO].exe (PID: 2648)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • BLTools v2.9.1[PRO].exe (PID: 4868)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 700)

    • Manual execution by a user

      • BLTools v2.9.1[PRO].exe (PID: 3156)
      • CookiesCreator v1.2.exe (PID: 2652)
      • BLTools v2.9.1[PRO].exe (PID: 2648)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(4868) BLTools v2.9.1[PRO].exe
Telegram-Tokens (1)6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk
Telegram-Info-Links
6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk
Get info about bothttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/getMe
Get incoming updateshttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/getUpdates
Get webhookhttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk
End-PointsendMessage
Args
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:05:27 21:30:18+00:00
ArchivedFileName: Projects
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
10
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs bltools v2.9.1[pro].exe THREAT bltools v2.9.1[pro].exe no specs cookiescreator v1.2.exe cookiescreator v1.2.exe no specs bltools v2.9.1[pro].exe bltools v2.9.1[pro].exe no specs COpenControlPanel no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bltools 2.9.1[PRO].7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2648"C:\Users\admin\Desktop\t\BLTools v2.9.1[PRO].exe" C:\Users\admin\Desktop\t\BLTools v2.9.1[PRO].exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\t\bltools v2.9.1[pro].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2652"C:\Users\admin\Desktop\t\CookiesCreator v1.2.exe" C:\Users\admin\Desktop\t\CookiesCreator v1.2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\t\cookiescreator v1.2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2660C:\WINDOWS\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
3156"C:\Users\admin\Desktop\t\BLTools v2.9.1[PRO].exe" C:\Users\admin\Desktop\t\BLTools v2.9.1[PRO].exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\t\bltools v2.9.1[pro].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4448"C:\Users\admin\AppData\Local\Temp\3582-490\CookiesCreator v1.2.exe" C:\Users\admin\AppData\Local\Temp\3582-490\CookiesCreator v1.2.exe—CookiesCreator v1.2.exe
User:
admin
Company:
by boyring
Integrity Level:
MEDIUM
Description:
CookiesCreator
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\cookiescreator v1.2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mscoree.dll
4868"C:\Users\admin\AppData\Local\Temp\3582-490\BLTools v2.9.1[PRO].exe" C:\Users\admin\AppData\Local\Temp\3582-490\BLTools v2.9.1[PRO].exe
BLTools v2.9.1[PRO].exe
User:
admin
Integrity Level:
MEDIUM
Description:
BLTools Cookies Checker
Exit code:
1
Version:
2.9.1.0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\bltools v2.9.1[pro].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(4868) BLTools v2.9.1[PRO].exe
Telegram-Tokens (1)6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk
Telegram-Info-Links
6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk
Get info about bothttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/getMe
Get incoming updateshttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/getUpdates
Get webhookhttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token6448011148:AAHcTB8GjoKK5nZce44buWa2oZ3D7kqBVPk
End-PointsendMessage
Args
5948C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6588C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
7072"C:\Users\admin\AppData\Local\Temp\3582-490\BLTools v2.9.1[PRO].exe" C:\Users\admin\AppData\Local\Temp\3582-490\BLTools v2.9.1[PRO].exe—BLTools v2.9.1[PRO].exe
User:
admin
Integrity Level:
MEDIUM
Description:
BLTools Cookies Checker
Exit code:
1
Version:
2.9.1.0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\bltools v2.9.1[pro].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
5 077
Read events
5 061
Write events
16
Delete events
0

Modification events

(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Bltools 2.9.1[PRO].7z
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
17
Suspicious files
45
Text files
493
Unknown types
0

Dropped files

PID
Process
Filename
Type
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\carousell_SG.projtext
MD5:C9E038B00F09D559AE137ADAFFD1BA91
SHA256:EBB25FBF252E0769D66447F885B2B047DFFCD3EEFD715300E5978F1BA13B4F17
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\carousell_MY.projtext
MD5:A7DC8AAB3EFB58C1A60353B56CE70C1E
SHA256:8DD192EAC540FB29B60327B3A911CF27C13E846924B2BD83D7D2534DCEC69E8B
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\2dehands.be.projtext
MD5:C83ECFBF6D3A250D9D928DF23D069E0C
SHA256:8F63F6C77EED61B0698665F1FCA117B77C7807384310E50C29194D2A3D822689
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\2ememain.be.projtext
MD5:F8A23F836EF27D836E15F62F6851940B
SHA256:7E3548D9D3A318ECDB996C8C23E52A065FC07C12C72407CD4AA9AA631F2769AC
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\Ebay.projtext
MD5:A57E89250A50C010B2B6EDD2EFD0B39F
SHA256:51314174405FE1D723621C67C12C03550426F07A83DDCAB9E36E6D992498D899
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\dba.dk.projtext
MD5:90E1CBC56BF62EDE9F7D1A2F93F367E4
SHA256:E51CCB0D3D0A98708FB18B80BE431863FCF8CC5E78EAF3AFDDD0E5E2FA3A9045
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\Etsy.projtext
MD5:7044889592BA5079CC545F9026317CF2
SHA256:649ADB7B32110F4A158549B7BFB48F6712E04BA02952EA51F947C263D193FB7F
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\KLEINANZEIGEN.projtext
MD5:FE084B578C6F1A8D8AFCE11AFE551ACF
SHA256:99609DD9E38117E6AAD46C5DD6178DB88A8ED8F99DD2059294C76AF57B8F5755
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\Projects\Godaddy.projtext
MD5:35DC422A9D0CD1393E6899CC68C4138B
SHA256:0ED94DBFAD19CACED82F9BA48B171B1AAD9AC7E2BE4EBE3D5FDCBFAAB9CD3AEC
700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa700.19480\License.dlltext
MD5:D76BF73F3D3768A4589E72A7B2B83088
SHA256:EAAB53F4B23C3CC9E3C9D4D5D4689438146519E69C7063F4F15B0A43DD861F7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2364
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2684
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2684
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6740
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted
4360
SearchApp.exe
2.23.209.160:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.9
  • 2.16.164.51
  • 2.16.164.43
whitelisted
www.microsoft.com
  • 23.32.185.131
whitelisted
www.bing.com
  • 2.23.209.160
  • 2.23.209.185
  • 2.23.209.158
  • 2.23.209.177
  • 2.23.209.179
  • 2.23.209.176
  • 2.23.209.181
  • 2.23.209.187
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.76
whitelisted
th.bing.com
  • 23.212.110.179
  • 23.212.110.209
  • 23.212.110.144
  • 23.212.110.162
  • 23.212.110.152
  • 23.212.110.184
  • 23.212.110.168
  • 23.212.110.185
  • 23.212.110.187
whitelisted
go.microsoft.com
  • 23.52.181.141
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bltools 2.9.1[PRO].7z