File name:

MobaXterm_installer_23.6.msi

Full analysis: https://app.any.run/tasks/6a250d19-7ce4-4890-a96c-e5a8ea01780b
Verdict: Malicious activity
Analysis date: February 16, 2024, 00:28:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: MobaXterm, Author: Mobatek, Keywords: Installer, Comments: This installer database contains the logic and data required to install MobaXterm., Template: Intel;1033, Revision Number: {C92C58DE-0ECF-4AE1-BEE3-4D16A1843DC3}, Create Time/Date: Wed Dec 20 22:15:34 2023, Last Saved Time/Date: Wed Dec 20 22:15:34 2023, Number of Pages: 100, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.0.5419.0), Security: 2
MD5:

DFBACD99F77AEA1AD45E443EBD871156

SHA1:

07C0E957E79CC0F73C4CC506DECC79FE9D6D3A08

SHA256:

A845C55F8C95D94996FB8584FA869CAE44A5D53A90B6347B333C259AB55FF8E1

SSDEEP:

98304:uMGEcc091JanZSfUb1QrsHJ0YV1k/WsOl0JldOCO+pARbTa1VTbpS9Ds1BlUXcs4:YSHC+yKubHqN/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3700)
      • MobaXterm.exe (PID: 2972)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3700)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2036)

    • Executable content was dropped or overwritten

      • MobaXterm.exe (PID: 2972)

    • The process creates files with name similar to system file names

      • MobaXterm.exe (PID: 2972)

  • INFO

    • Reads the software policy settings

      • msiexec.exe (PID: 3700)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3700)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3700)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3700)

    • Checks supported languages

      • MobaXterm.exe (PID: 2972)

    • Reads the computer name

      • MobaXterm.exe (PID: 2972)

    • Manual execution by a user

      • MobaXterm.exe (PID: 2972)

    • Reads product name

      • MobaXterm.exe (PID: 2972)

    • Reads Environment values

      • MobaXterm.exe (PID: 2972)

    • Creates files or folders in the user directory

      • MobaXterm.exe (PID: 2972)

    • Reads mouse settings

      • MobaXterm.exe (PID: 2972)

    • Reads the machine GUID from the registry

      • MobaXterm.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: MobaXterm
Author: Mobatek
Keywords: Installer
Comments: This installer database contains the logic and data required to install MobaXterm.
Template: Intel;1033
RevisionNumber: {C92C58DE-0ECF-4AE1-BEE3-4D16A1843DC3}
CreateDate: 2023:12:20 22:15:34
ModifyDate: 2023:12:20 22:15:34
Pages: 100
Words: 2
Software: Windows Installer XML (3.0.5419.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe vssvc.exe no specs mobaxterm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2036C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2972"C:\Program Files\Mobatek\MobaXterm\MobaXterm.exe" C:\Program Files\Mobatek\MobaXterm\MobaXterm.exe
explorer.exe
User:
admin
Company:
Mobatek
Integrity Level:
MEDIUM
Description:
MobaXterm
Exit code:
0
Version:
23.6.0.5186
Modules
Images
c:\program files\mobatek\mobaxterm\mobaxterm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3700"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\MobaXterm_installer_23.6.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 153
Read events
5 019
Write events
134
Delete events
0

Modification events

(PID) Process:(3700) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A00E602C6F60DA01F40700005C0F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A00E602C6F60DA01F40700001C0B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A00E602C6F60DA01F407000018090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A00E602C6F60DA01F4070000240B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000FA70622C6F60DA01F40700001C0B0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000FA70622C6F60DA01F4070000240B0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000FA70622C6F60DA01F40700005C0F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
400000000000000054D3642C6F60DA01F407000018090000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
Operation:writeName:PROVIDER_BEGINPREPARE (Enter)
Value:
400000000000000016ECA12D6F60DA01F40700001809000001040000010000000000000000000000ABB4511EEDFA7A4F9C0D814A55181EDE0000000000000000
Executable files
64
Suspicious files
228
Text files
472
Unknown types
65

Dropped files

PID
Process
Filename
Type
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\bin\MobaRTE.exeexecutable
MD5:091CAB4B6658353E08072D8C683E815E
SHA256:010F15D8B3494DA85D60CD187D24960B06634D3B078C299B99CD831B47A4F771
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\bin\MobAgent.exeexecutable
MD5:6AEA7D513C68625C303F8765977F9F43
SHA256:5BD1A648DCE053324C8624970A457825AFEDDDDD50A1E7D58F625827CDB79BF6
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\bin\MobaKeyGen.exeexecutable
MD5:1D7B16502599C8B5969E07113776F3EB
SHA256:49E007B88E21A5DB9438D648CC74F452685B44AE339ECFE20B23B5139BB372FF
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\bin\MobaSCP.exeexecutable
MD5:19C4B90E36B3F0EFB1589E63D6A10190
SHA256:8B97501E15159ACEB1A3AD804AFB6921CFB6ED1BDD0EC44B2C989AF83C096F4F
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\bin\MoTTY.exeexecutable
MD5:01EC29C6BB61BD6D36E137FA5B87685F
SHA256:3EA55E5FC6235C6BBA4B46EEB2DF7E1D30CF7A4BF7734FBAE57DE8D0638D3E5A
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\usr\share\dtree.jstext
MD5:8164FF89D290CF2F223EA52691DDF6DA
SHA256:9A9EF8AF4100251E7682D7BA8CF1ED71753B3E6093865F3D4ACF31E5E1BD1E5C
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\usr\share\img\join.gifimage
MD5:4D5D614E0DA056DF815A4306D6368692
SHA256:6DEF35062B5BF23BA38EF8CF3E11D6560FDDA9E7FFF7BE6B84594EEE8CA5369C
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\usr\share\img\empty.gifimage
MD5:DF22AFF6E941FF1CC577333D1712B584
SHA256:152C84E46B3466B723A4CB9BACBBCE881A1FD9AF042DFA716EAF02DF28D6AD7D
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\usr\share\img\joinbottom.gifimage
MD5:4B3DAA7F2CC584F1AAC0D142275D7CBA
SHA256:E7DA2318DEAE5AC66E1A08E890CE607BE5D6497B6801AFBF06AA54E6E412BCD2
2972MobaXterm.exeC:\Users\admin\AppData\Roaming\MobaXterm\slash\usr\share\img\base.gifimage
MD5:1F71B021E061A4948D69ADC4FF10CCAD
SHA256:FDC851CA6AD53AD1A2E64332962FCE7D9989BCE38B2EA538B35CBCD38C39B328
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MobaXterm_installer_23.6.msi