| URL: | http://iptv-tools.com/downloads/m3ueditor_setup.exe |
| Full analysis: | https://app.any.run/tasks/3b7761c9-247d-4947-8291-97dd66a7d28c |
| Verdict: | Suspicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | October 17, 2019, 11:11:00 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 90BC7F922A3CAE7CC4B842DEA49509F9 |
| SHA1: | 8AA67EEB6B158537880F90D1A8734E58392FDC84 |
| SHA256: | ADBE4D45CC424B72B561480899CB47F20E468FF3A024D1EECEBC78E1031E1C88 |
| SSDEEP: | 3:N1KXXtKaKXKnyu4A:Coanyu4A |
MALICIOUS
Application was dropped or rewritten from another process
- ERDIPTVM3UEditor.exe (PID: 2956)
- m3ueditor_setup.exe (PID: 600)
- m3ueditor_setup.exe (PID: 2368)
Downloads executable files from the Internet
- opera.exe (PID: 2128)
Loads dropped or rewritten executable
- ERDIPTVM3UEditor.exe (PID: 2956)
SUSPICIOUS
Executed via COM
- explorer.exe (PID: 1904)
Executable content was dropped or overwritten
- m3ueditor_setup.tmp (PID: 2728)
- m3ueditor_setup.exe (PID: 600)
- opera.exe (PID: 2128)
- m3ueditor_setup.exe (PID: 2368)
Reads the Windows organization settings
- m3ueditor_setup.tmp (PID: 2728)
Modifies the open verb of a shell class
- m3ueditor_setup.tmp (PID: 2728)
Reads Windows owner or organization settings
- m3ueditor_setup.tmp (PID: 2728)
INFO
Application was dropped or rewritten from another process
- m3ueditor_setup.tmp (PID: 2516)
- m3ueditor_setup.tmp (PID: 2728)
Creates a software uninstall entry
- m3ueditor_setup.tmp (PID: 2728)
Creates files in the program directory
- m3ueditor_setup.tmp (PID: 2728)
Creates files in the user directory
- opera.exe (PID: 2128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
46
Monitored processes
8
Malicious processes
2
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 600 | "C:\Users\admin\Documents\m3ueditor_setup.exe" /SPAWNWND=$40146 /NOTIFYWND=$30134 | C:\Users\admin\Documents\m3ueditor_setup.exe | m3ueditor_setup.tmp | ||||||||||||
User: admin Company: ERDesigns Integrity Level: HIGH Description: ERD IPTV M3U Editor Exit code: 0 Version: 1.1 Modules
| |||||||||||||||
| 1904 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2128 | "C:\Program Files\Opera\opera.exe" "http://iptv-tools.com/downloads/m3ueditor_setup.exe" | C:\Program Files\Opera\opera.exe | explorer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 2368 | "C:\Users\admin\Documents\m3ueditor_setup.exe" | C:\Users\admin\Documents\m3ueditor_setup.exe | explorer.exe | ||||||||||||
User: admin Company: ERDesigns Integrity Level: MEDIUM Description: ERD IPTV M3U Editor Exit code: 0 Version: 1.1 Modules
| |||||||||||||||
| 2516 | "C:\Users\admin\AppData\Local\Temp\is-G27AJ.tmp\m3ueditor_setup.tmp" /SL5="$30134,4534052,236032,C:\Users\admin\Documents\m3ueditor_setup.exe" | C:\Users\admin\AppData\Local\Temp\is-G27AJ.tmp\m3ueditor_setup.tmp | — | m3ueditor_setup.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2728 | "C:\Users\admin\AppData\Local\Temp\is-AI53I.tmp\m3ueditor_setup.tmp" /SL5="$5015E,4534052,236032,C:\Users\admin\Documents\m3ueditor_setup.exe" /SPAWNWND=$40146 /NOTIFYWND=$30134 | C:\Users\admin\AppData\Local\Temp\is-AI53I.tmp\m3ueditor_setup.tmp | m3ueditor_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2956 | "C:\Program Files\ERD IPTV M3U Editor\ERDIPTVM3UEditor.exe" | C:\Program Files\ERD IPTV M3U Editor\ERDIPTVM3UEditor.exe | m3ueditor_setup.tmp | ||||||||||||
User: admin Company: ERD - Ernst Reidinga Integrity Level: MEDIUM Description: ERDIPTVM3UEditor Exit code: 0 Version: 1.1.0.59 Modules
| |||||||||||||||
| 3244 | "C:\Windows\explorer.exe" /select,"C:\Users\admin\Documents\m3ueditor_setup.exe" | C:\Windows\explorer.exe | — | opera.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
2 455
Read events
2 186
Write events
261
Delete events
8
Modification events
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
| Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe "http://iptv-tools.com/downloads/m3ueditor_setup.exe" | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | NodeSlots |
Value: 020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202 | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | MRUListEx |
Value: 02000000070000000100000009000000080000000000000006000000030000000500000004000000FFFFFFFF | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg |
| Operation: | write | Name: | TV_FolderType |
Value: {FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg |
| Operation: | write | Name: | TV_TopViewID |
Value: {82BA0782-5B7A-4569-B5D7-EC83085F08CC} | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg |
| Operation: | write | Name: | TV_TopViewVersion |
Value: 0 | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} |
| Operation: | write | Name: | Mode |
Value: 4 | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} |
| Operation: | write | Name: | LogicalViewMode |
Value: 1 | |||
| (PID) Process: | (2128) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} |
| Operation: | write | Name: | FFlags |
Value: 1092616257 | |||
Executable files
9
Suspicious files
16
Text files
6
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2128 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprAC48.tmp | — | |
MD5:— | SHA256:— | |||
| 2128 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprAC68.tmp | — | |
MD5:— | SHA256:— | |||
| 2128 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprACA8.tmp | — | |
MD5:— | SHA256:— | |||
| 2128 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HGZBQH9UJP4J4S755FK6.temp | — | |
MD5:— | SHA256:— | |||
| 2128 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00002.tmp | — | |
MD5:— | SHA256:— | |||
| 2728 | m3ueditor_setup.tmp | C:\Program Files\ERD IPTV M3U Editor\is-I48FL.tmp | — | |
MD5:— | SHA256:— | |||
| 2728 | m3ueditor_setup.tmp | C:\Program Files\ERD IPTV M3U Editor\is-IU07M.tmp | — | |
MD5:— | SHA256:— | |||
| 2128 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:— | SHA256:— | |||
| 2728 | m3ueditor_setup.tmp | C:\Program Files\ERD IPTV M3U Editor\is-0B2E4.tmp | — | |
MD5:— | SHA256:— | |||
| 2128 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\g_0000\opr00001.tmp | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
5
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2956 | ERDIPTVM3UEditor.exe | GET | — | 185.104.28.64:80 | http://iptv-tools.com/iptv_m3u_editor.php?tips | NL | — | — | suspicious |
2128 | opera.exe | GET | 200 | 185.104.28.64:80 | http://iptv-tools.com/downloads/m3ueditor_setup.exe | NL | executable | 4.79 Mb | suspicious |
2128 | opera.exe | GET | 400 | 107.167.110.211:80 | http://sitecheck2.opera.com/?host=iptv-tools.com&hdn=zFpJdpWI7/z%2BJwsomk7Klw== | US | html | 150 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2128 | opera.exe | 185.104.28.64:80 | iptv-tools.com | Stichting DIGI NL | NL | malicious |
2128 | opera.exe | 107.167.110.211:80 | sitecheck2.opera.com | Opera Software Americas LLC | US | suspicious |
2956 | ERDIPTVM3UEditor.exe | 185.104.28.64:80 | iptv-tools.com | Stichting DIGI NL | NL | malicious |
2128 | opera.exe | 185.26.182.93:443 | certs.opera.com | Opera Software AS | — | whitelisted |
2128 | opera.exe | 93.184.220.29:80 | crl4.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
iptv-tools.com |
| suspicious |
sitecheck2.opera.com |
| whitelisted |
certs.opera.com |
| whitelisted |
crl4.digicert.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |