analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://memz-trojan.en.softonic.com/

Full analysis: https://app.any.run/tasks/5ad9a411-3e09-48d1-bb94-6281d708acd4
Verdict: Malicious activity
Analysis date: October 19, 2020, 23:09:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A05A75CBA0F744395ACCFA2E333C42E3

SHA1:

C868C3BC51AD1D4870AF4F99ADD094AE5510A678

SHA256:

A75FDA23DD7CE9A0B99CFB71FFF50FA03286337324BD9C600DDF2AD271AF147C

SSDEEP:

3:N8VtIIHLGK3:2VqALGK3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • memz-trojan_1986550059.exe (PID: 5576)
      • memz-trojan_1986550059.exe (PID: 5916)
      • memz-trojan_1986550059.exe (PID: 3076)
      • SXF5_SETUP.exe (PID: 5344)
      • SXF5_SETUP.exe (PID: 5708)

    • Loads dropped or rewritten executable

      • memz-trojan_1986550059.exe (PID: 3076)
      • SXF5_SETUP.exe (PID: 5344)
      • SearchProtocolHost.exe (PID: 4552)
      • SXF5_SETUP.exe (PID: 5708)

    • Actions looks like stealing of personal data

      • memz-trojan_1986550059.exe (PID: 3076)

    • Changes settings of System certificates

      • memz-trojan_1986550059.exe (PID: 3076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 1092)
      • chrome.exe (PID: 3988)
      • memz-trojan_1986550059.exe (PID: 3076)
      • WinRAR.exe (PID: 5932)

    • Cleans NTFS data-stream (Zone Identifier)

      • memz-trojan_1986550059.exe (PID: 5576)

    • Reads Environment values

      • memz-trojan_1986550059.exe (PID: 3076)

    • Reads Internet Cache Settings

      • memz-trojan_1986550059.exe (PID: 3076)

    • Adds / modifies Windows certificates

      • memz-trojan_1986550059.exe (PID: 3076)

    • Application launched itself

      • memz-trojan_1986550059.exe (PID: 5576)

    • Reads internet explorer settings

      • memz-trojan_1986550059.exe (PID: 3076)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2312)
      • chrome.exe (PID: 1092)
      • memz-trojan_1986550059.exe (PID: 3076)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 552)
      • iexplore.exe (PID: 2312)
      • chrome.exe (PID: 3988)

    • Creates files in the user directory

      • iexplore.exe (PID: 552)

    • Reads the hosts file

      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 1092)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2312)

    • Reads internet explorer settings

      • iexplore.exe (PID: 552)

    • Manual execution by user

      • chrome.exe (PID: 3988)
      • WinRAR.exe (PID: 5932)
      • explorer.exe (PID: 4516)
      • memz-trojan_1986550059.exe (PID: 5916)
      • SXF5_SETUP.exe (PID: 5708)
      • taskmgr.exe (PID: 5764)
      • SXF5_SETUP.exe (PID: 5344)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2312)

    • Application launched itself

      • iexplore.exe (PID: 2312)
      • chrome.exe (PID: 3988)

    • Changes internet zones settings

      • iexplore.exe (PID: 2312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
117
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs memz-trojan_1986550059.exe no specs chrome.exe no specs memz-trojan_1986550059.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs memz-trojan_1986550059.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe searchprotocolhost.exe no specs sxf5_setup.exe no specs sxf5_setup.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2312"C:\Program Files\Internet Explorer\iexplore.exe" https://memz-trojan.en.softonic.com/C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
552"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2312 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3988"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3836"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6c4fa9d0,0x6c4fa9e0,0x6c4fa9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3816"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=948 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2452"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,1797330739979906219,16059247664611135988,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2154310853797296648 --mojo-platform-channel-handle=1036 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1092"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,1797330739979906219,16059247664611135988,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=10081635900278373769 --mojo-platform-channel-handle=1624 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3356"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,1797330739979906219,16059247664611135988,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9606894645782938981 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,1797330739979906219,16059247664611135988,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6851347430075971506 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,1797330739979906219,16059247664611135988,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9714313552454622848 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
2 718
Read events
2 273
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
460
Text files
324
Unknown types
49

Dropped files

PID
Process
Filename
Type
2312iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
552iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab596F.tmp —
MD5:—
SHA256:—
552iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar5970.tmp —
MD5:—
SHA256:—
552iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:728C425EE21D3445912DDB071597332A
SHA256:B003F1FB627734F8050F724055723A2DC40017DDE9263BEFC7CC1FBE04029FBF
552iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\1c93b-d1cfd[1].jstext
MD5:D1CFD20C909755EB530DAFEE6799A989
SHA256:62F7ACF9C15E5063C33A031EF9D6380893676E25FDC7C0C8A5EE57F87B3FD969
552iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:64D54B5DB6FC462A8B50380D0288988C
SHA256:52AB8D8037A25A40A21286491311BF45FD50436A630B98A77CC5BC23529B2EAD
552iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2C66F50A39EC00FCDC111614F447CF68binary
MD5:68DB92E4F2B6814FBE28450E9D98E6D5
SHA256:78E04BB8BCE396526B1BC13EF6A3788AB645CD410B18F66B1F2D46642FE30F63
552iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\WS0GMNYB.htmhtml
MD5:A010A19399F5160663BCBD059344C3A7
SHA256:D22C36A6014EFA934C360A092E02AE9A3E5EEEA5BD5D827A1413A84352C78DA9
552iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:C8DE67CD198C45625730016D6EE3DD6C
SHA256:6A347E8A798AC0D22DF8208290CD1B8547DD0CA50434810171D3F412BB6C8806
552iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:82DBDBD917E7C6CF6B299FDD97EB3238
SHA256:867F83A7EF6A257D1313782492281233C022B25B2CE106E5756DB2F90D128210
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
391
DNS requests
260
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
552
iexplore.exe
GET
200
72.247.178.41:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
NL
der
1.37 Kb
whitelisted
552
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEHB063uNMc6dPCqTOMgIPs%3D
US
der
471 b
whitelisted
552
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
552
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
552
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
552
iexplore.exe
GET
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBMtUwvbZX3eCAAAAABbLrM%3D
US
der
471 b
whitelisted
552
iexplore.exe
GET
200
72.247.178.41:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
NL
der
1.37 Kb
whitelisted
552
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
552
iexplore.exe
GET
200
13.35.253.32:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
552
iexplore.exe
GET
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB3oRgfjsJWUCAAAAABbLrQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
552
iexplore.exe
104.111.233.72:443
images.sftcdn.net
Akamai International B.V.
NL
unknown
552
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
552
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
552
iexplore.exe
192.124.249.22:80
ocsp.godaddy.com
Sucuri
US
suspicious
552
iexplore.exe
13.35.253.32:80
o.ss2.us
—
US
suspicious
552
iexplore.exe
13.35.253.5:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
552
iexplore.exe
13.35.253.185:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
552
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
552
iexplore.exe
172.217.23.136:443
www.googletagmanager.com
Google Inc.
US
whitelisted
552
iexplore.exe
2.18.234.190:443
amplify.outbrain.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
memz-trojan.en.softonic.com
  • 35.227.233.104
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
sc.sftcdn.net
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
www.googletagmanager.com
  • 172.217.23.136
whitelisted
securepubads.g.doubleclick.net
  • 216.58.207.66
whitelisted
images.sftcdn.net
  • 104.111.233.72
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://memz-trojan.en.softonic.com/