File name:

SmartMovie_v3_25_keygen_by_KeygenNinja.exe

Full analysis: https://app.any.run/tasks/ac196910-53d4-43c6-8a49-68539de14d8e
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: December 31, 2021, 18:54:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
stealer
pony
fareit
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BA1F3499B6BD97CAC51F8872DB823076

SHA1:

14BBEDA0EE0E9DCD86A03F3B3D7FC191B7B52823

SHA256:

B5EDB21655803303F4B0222F65CF8FC814C23217B2243D93B6C5DFC00C4FF183

SSDEEP:

393216:+raspxtR7IjVaErO8LWcH+Kbac5bsw1Hp5G:Fsp/VIjPqmH+KbusLG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • keygen-pr.exe (PID: 2900)
      • keygen-step-4.exe (PID: 3104)
      • md2_2efs.exe (PID: 492)
      • keygen-pr.exe (PID: 2252)
      • keygen-step-4.exe (PID: 272)
      • msiexec.exe (PID: 3696)
      • keygen-step-4.exe (PID: 2920)
      • keygen-step-4.exe (PID: 588)
      • keygen-pr.exe (PID: 2932)
      • keygen-step-4.exe (PID: 3536)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • msiexec.exe (PID: 1536)
      • BTRSetp.exe (PID: 2448)
      • BTRSetp.exe (PID: 2140)

    • Application was dropped or rewritten from another process

      • keygen-step-3.exe (PID: 1084)
      • keygen-pr.exe (PID: 2900)
      • keygen-step-4.exe (PID: 3104)
      • keygen-step-1.exe (PID: 1328)
      • intro.exe (PID: 2880)
      • key.exe (PID: 2632)
      • 002.exe (PID: 2600)
      • key.exe (PID: 3176)
      • Setup.exe (PID: 1888)
      • Setup.exe (PID: 500)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • 41CC0C660F45BA98.exe (PID: 2344)
      • md2_2efs.exe (PID: 492)
      • ThunderFW.exe (PID: 3748)
      • keygen-step-1.exe (PID: 2488)
      • keygen-pr.exe (PID: 2252)
      • keygen-step-4.exe (PID: 272)
      • intro.exe (PID: 2472)
      • keygen-step-3.exe (PID: 1344)
      • 002.exe (PID: 3736)
      • key.exe (PID: 1888)
      • key.exe (PID: 848)
      • Setup.exe (PID: 3676)
      • Setup.exe (PID: 3388)
      • md2_2efs.exe (PID: 3044)
      • keygen-step-4.exe (PID: 2920)
      • 002.exe (PID: 1984)
      • keygen-step-4.exe (PID: 588)
      • keygen-pr.exe (PID: 2932)
      • keygen-step-1.exe (PID: 2708)
      • keygen-step-3.exe (PID: 2864)
      • 002.exe (PID: 2840)
      • key.exe (PID: 3220)
      • keygen-step-4.exe (PID: 3536)
      • key.exe (PID: 2368)
      • 002.exe (PID: 2212)
      • Setup.exe (PID: 3356)
      • Setup.exe (PID: 3436)
      • Setup.exe (PID: 3828)
      • Setup.exe (PID: 2192)
      • md2_2efs.exe (PID: 3240)
      • md2_2efs.exe (PID: 1952)
      • Setup.exe (PID: 832)
      • Setup.exe (PID: 2080)
      • md2_2efs.exe (PID: 1740)
      • file.exe (PID: 2540)
      • keygen-pr.exe (PID: 904)
      • Vbox.exe (PID: 3344)
      • file.exe (PID: 3776)
      • Vbox.exe (PID: 2764)
      • ubisoftful.exe (PID: 928)
      • BTRSetp.exe (PID: 2448)
      • 002.exe (PID: 464)
      • ubisoftful.exe (PID: 584)
      • installer.exe (PID: 2376)
      • installer.exe (PID: 3456)
      • testinstalls.exe (PID: 1808)
      • testinstalls.exe (PID: 3560)
      • testinstalls.exe (PID: 3116)
      • BTRSetp.exe (PID: 2140)
      • testinstalls.exe (PID: 324)
      • md2_2efs.exe (PID: 3696)
      • 002.exe (PID: 2492)
      • installer.exe (PID: 2680)
      • installer.exe (PID: 3276)
      • 002.exe (PID: 3616)

    • Connects to CnC server

      • keygen-step-3.exe (PID: 1084)
      • keygen-step-1.exe (PID: 1328)
      • key.exe (PID: 2632)
      • md2_2efs.exe (PID: 492)
      • keygen-step-3.exe (PID: 1344)
      • keygen-step-1.exe (PID: 2488)
      • key.exe (PID: 1888)
      • keygen-step-1.exe (PID: 2708)
      • keygen-step-3.exe (PID: 2864)
      • md2_2efs.exe (PID: 3044)
      • key.exe (PID: 3220)
      • file.exe (PID: 2540)
      • md2_2efs.exe (PID: 3240)
      • md2_2efs.exe (PID: 1952)
      • file.exe (PID: 3776)

    • AZORULT was detected

      • keygen-step-1.exe (PID: 1328)
      • keygen-step-1.exe (PID: 2488)
      • keygen-step-1.exe (PID: 2708)

    • Stealing of credential data

      • 002.exe (PID: 2600)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • key.exe (PID: 848)

    • Actions looks like stealing of personal data

      • 002.exe (PID: 2600)
      • keygen-step-4.exe (PID: 3104)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • 41CC0C660F45BA98.exe (PID: 2344)
      • key.exe (PID: 2632)
      • md2_2efs.exe (PID: 492)
      • keygen-step-4.exe (PID: 272)
      • key.exe (PID: 1888)
      • keygen-step-4.exe (PID: 588)
      • keygen-step-4.exe (PID: 2920)
      • key.exe (PID: 3220)
      • keygen-step-4.exe (PID: 3536)
      • md2_2efs.exe (PID: 3044)
      • md2_2efs.exe (PID: 1952)
      • md2_2efs.exe (PID: 1740)
      • md2_2efs.exe (PID: 3240)
      • ubisoftful.exe (PID: 928)
      • ubisoftful.exe (PID: 584)

    • Steals credentials from Web Browsers

      • 002.exe (PID: 2600)
      • key.exe (PID: 2632)
      • md2_2efs.exe (PID: 492)
      • key.exe (PID: 1888)
      • key.exe (PID: 3220)
      • md2_2efs.exe (PID: 3044)
      • md2_2efs.exe (PID: 1952)
      • md2_2efs.exe (PID: 1740)
      • md2_2efs.exe (PID: 3240)
      • ubisoftful.exe (PID: 584)
      • ubisoftful.exe (PID: 928)

    • Changes settings of System certificates

      • Setup.exe (PID: 500)
      • Vbox.exe (PID: 3344)
      • Vbox.exe (PID: 2764)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 1468)
      • cmd.exe (PID: 372)
      • cmd.exe (PID: 3224)
      • cmd.exe (PID: 1068)
      • cmd.exe (PID: 3336)
      • cmd.exe (PID: 2156)
      • cmd.exe (PID: 2032)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 352)
      • MsiExec.exe (PID: 1104)
      • MsiExec.exe (PID: 3388)
      • MsiExec.exe (PID: 3280)
      • MsiExec.exe (PID: 3504)

    • Detected Pony/Fareit Trojan

      • key.exe (PID: 2632)

    • Modifies files in Chrome extension folder

      • 41CC0C660F45BA98.exe (PID: 2344)

    • PONY was detected

      • key.exe (PID: 2632)
      • key.exe (PID: 1888)
      • key.exe (PID: 3220)

  • SUSPICIOUS

    • Reads the computer name

      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 3852)
      • intro.exe (PID: 2880)
      • keygen-step-3.exe (PID: 1084)
      • keygen-pr.exe (PID: 2900)
      • keygen-step-1.exe (PID: 1328)
      • keygen-step-4.exe (PID: 3104)
      • key.exe (PID: 3176)
      • 002.exe (PID: 2600)
      • key.exe (PID: 2632)
      • Setup.exe (PID: 500)
      • md2_2efs.exe (PID: 492)
      • 41CC0C660F45BA98.exe (PID: 2344)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • ThunderFW.exe (PID: 3748)
      • IELowutil.exe (PID: 3552)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • keygen-step-1.exe (PID: 2488)
      • intro.exe (PID: 2472)
      • keygen-pr.exe (PID: 2252)
      • keygen-step-4.exe (PID: 272)
      • keygen-step-3.exe (PID: 1344)
      • key.exe (PID: 848)
      • 002.exe (PID: 3736)
      • key.exe (PID: 1888)
      • Setup.exe (PID: 3388)
      • md2_2efs.exe (PID: 3044)
      • keygen-step-4.exe (PID: 2920)
      • keygen-step-4.exe (PID: 588)
      • 002.exe (PID: 1984)
      • 002.exe (PID: 2840)
      • keygen-step-3.exe (PID: 2864)
      • keygen-pr.exe (PID: 2932)
      • keygen-step-4.exe (PID: 3536)
      • keygen-step-1.exe (PID: 2708)
      • key.exe (PID: 2368)
      • 002.exe (PID: 2212)
      • Setup.exe (PID: 3436)
      • key.exe (PID: 3220)
      • Setup.exe (PID: 2192)
      • md2_2efs.exe (PID: 1952)
      • Setup.exe (PID: 2080)
      • md2_2efs.exe (PID: 3240)
      • IELowutil.exe (PID: 2808)
      • file.exe (PID: 2540)
      • md2_2efs.exe (PID: 1740)
      • keygen-pr.exe (PID: 904)
      • Vbox.exe (PID: 3344)
      • Vbox.exe (PID: 2764)
      • ubisoftful.exe (PID: 928)
      • file.exe (PID: 3776)
      • ubisoftful.exe (PID: 584)
      • BTRSetp.exe (PID: 2448)
      • installer.exe (PID: 3456)
      • 002.exe (PID: 464)
      • testinstalls.exe (PID: 1808)
      • testinstalls.exe (PID: 3116)
      • testinstalls.exe (PID: 3560)
      • testinstalls.exe (PID: 324)
      • md2_2efs.exe (PID: 3696)
      • BTRSetp.exe (PID: 2140)
      • installer.exe (PID: 2680)
      • 002.exe (PID: 2492)

    • Drops a file that was compiled in debug mode

      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 3852)
      • keygen-step-4.exe (PID: 3104)
      • Setup.exe (PID: 500)
      • md2_2efs.exe (PID: 492)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 2944)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • keygen-step-4.exe (PID: 272)
      • Setup.exe (PID: 3388)
      • keygen-step-4.exe (PID: 2920)
      • msiexec.exe (PID: 3696)
      • keygen-step-4.exe (PID: 588)
      • keygen-step-4.exe (PID: 3536)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • msiexec.exe (PID: 1536)
      • BTRSetp.exe (PID: 2448)
      • BTRSetp.exe (PID: 2140)

    • Drops a file with too old compile date

      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 3852)
      • msiexec.exe (PID: 1280)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • msiexec.exe (PID: 1536)

    • Checks supported languages

      • cmd.exe (PID: 2588)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 3852)
      • intro.exe (PID: 2880)
      • keygen-step-1.exe (PID: 1328)
      • keygen-pr.exe (PID: 2900)
      • keygen-step-4.exe (PID: 3104)
      • keygen-step-3.exe (PID: 1084)
      • 002.exe (PID: 2600)
      • key.exe (PID: 3176)
      • key.exe (PID: 2632)
      • Setup.exe (PID: 500)
      • 41CC0C660F45BA98.exe (PID: 2344)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • md2_2efs.exe (PID: 492)
      • cmd.exe (PID: 1468)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 372)
      • ThunderFW.exe (PID: 3748)
      • cmd.exe (PID: 3224)
      • IELowutil.exe (PID: 3552)
      • cmd.exe (PID: 348)
      • intro.exe (PID: 2472)
      • keygen-pr.exe (PID: 2252)
      • keygen-step-1.exe (PID: 2488)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • keygen-step-3.exe (PID: 1344)
      • keygen-step-4.exe (PID: 272)
      • key.exe (PID: 1888)
      • 002.exe (PID: 3736)
      • key.exe (PID: 848)
      • Setup.exe (PID: 3388)
      • md2_2efs.exe (PID: 3044)
      • cmd.exe (PID: 1068)
      • keygen-step-4.exe (PID: 2920)
      • 002.exe (PID: 1984)
      • keygen-step-4.exe (PID: 588)
      • 002.exe (PID: 2840)
      • cmd.exe (PID: 3236)
      • keygen-step-3.exe (PID: 2864)
      • keygen-step-4.exe (PID: 3536)
      • keygen-pr.exe (PID: 2932)
      • keygen-step-1.exe (PID: 2708)
      • 002.exe (PID: 2212)
      • key.exe (PID: 2368)
      • key.exe (PID: 3220)
      • Setup.exe (PID: 2192)
      • Setup.exe (PID: 3436)
      • cmd.exe (PID: 3336)
      • md2_2efs.exe (PID: 3240)
      • md2_2efs.exe (PID: 1952)
      • cmd.exe (PID: 2156)
      • Setup.exe (PID: 2080)
      • keygen-pr.exe (PID: 904)
      • cmd.exe (PID: 2032)
      • md2_2efs.exe (PID: 1740)
      • file.exe (PID: 2540)
      • IELowutil.exe (PID: 2808)
      • Vbox.exe (PID: 3344)
      • cmd.exe (PID: 3796)
      • file.exe (PID: 3776)
      • Vbox.exe (PID: 2764)
      • cmd.exe (PID: 1092)
      • ubisoftful.exe (PID: 928)
      • BTRSetp.exe (PID: 2448)
      • ubisoftful.exe (PID: 584)
      • 002.exe (PID: 464)
      • installer.exe (PID: 3456)
      • testinstalls.exe (PID: 1808)
      • testinstalls.exe (PID: 3116)
      • testinstalls.exe (PID: 324)
      • md2_2efs.exe (PID: 3696)
      • BTRSetp.exe (PID: 2140)
      • testinstalls.exe (PID: 3560)
      • installer.exe (PID: 2680)
      • 002.exe (PID: 2492)
      • 002.exe (PID: 3616)

    • Reads Environment values

      • keygen-step-1.exe (PID: 1328)
      • key.exe (PID: 3176)
      • vssvc.exe (PID: 2796)
      • keygen-step-1.exe (PID: 2488)
      • key.exe (PID: 848)
      • keygen-step-1.exe (PID: 2708)
      • key.exe (PID: 2368)
      • installer.exe (PID: 3456)
      • installer.exe (PID: 2680)

    • Executable content was dropped or overwritten

      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 3852)
      • keygen-pr.exe (PID: 2900)
      • keygen-step-4.exe (PID: 3104)
      • Setup.exe (PID: 500)
      • md2_2efs.exe (PID: 492)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 2944)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • keygen-pr.exe (PID: 2252)
      • keygen-step-4.exe (PID: 272)
      • Setup.exe (PID: 3388)
      • msiexec.exe (PID: 3696)
      • keygen-step-4.exe (PID: 2920)
      • keygen-step-4.exe (PID: 588)
      • keygen-pr.exe (PID: 2932)
      • keygen-step-4.exe (PID: 3536)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • msiexec.exe (PID: 1536)
      • BTRSetp.exe (PID: 2448)
      • BTRSetp.exe (PID: 2140)

    • Starts CMD.EXE for commands execution

      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 3852)
      • Setup.exe (PID: 500)
      • 41CC0C660F45BA98.exe (PID: 2344)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • Setup.exe (PID: 3388)
      • Setup.exe (PID: 3436)
      • Setup.exe (PID: 2192)
      • Setup.exe (PID: 2080)
      • file.exe (PID: 2540)
      • file.exe (PID: 3776)

    • Application launched itself

      • key.exe (PID: 2632)
      • msiexec.exe (PID: 2944)
      • key.exe (PID: 1888)
      • key.exe (PID: 3220)

    • Reads Windows Product ID

      • key.exe (PID: 3176)
      • key.exe (PID: 848)
      • key.exe (PID: 2368)

    • Reads Windows owner or organization settings

      • key.exe (PID: 3176)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 2944)
      • key.exe (PID: 848)
      • msiexec.exe (PID: 3696)
      • key.exe (PID: 2368)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • msiexec.exe (PID: 1536)

    • Reads the Windows organization settings

      • key.exe (PID: 3176)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 2944)
      • key.exe (PID: 848)
      • msiexec.exe (PID: 3696)
      • key.exe (PID: 2368)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • msiexec.exe (PID: 1536)

    • Creates files in the user directory

      • 002.exe (PID: 2600)
      • key.exe (PID: 2632)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • 41CC0C660F45BA98.exe (PID: 2344)
      • msiexec.exe (PID: 2944)
      • 002.exe (PID: 3736)
      • 002.exe (PID: 1984)
      • 002.exe (PID: 2840)
      • 002.exe (PID: 2212)
      • Vbox.exe (PID: 3344)
      • file.exe (PID: 3776)
      • 002.exe (PID: 464)
      • 002.exe (PID: 2492)

    • Loads DLL from Mozilla Firefox

      • key.exe (PID: 2632)
      • key.exe (PID: 1888)
      • key.exe (PID: 3220)

    • Starts Microsoft Installer

      • Setup.exe (PID: 500)
      • Setup.exe (PID: 3388)
      • Setup.exe (PID: 3436)
      • Setup.exe (PID: 2192)
      • Setup.exe (PID: 2080)

    • Starts itself from another location

      • Setup.exe (PID: 500)

    • Executed as Windows Service

      • msiexec.exe (PID: 2944)
      • vssvc.exe (PID: 2796)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 2408)

    • Searches for installed software

      • msiexec.exe (PID: 2944)
      • key.exe (PID: 3176)
      • key.exe (PID: 2632)
      • key.exe (PID: 848)
      • key.exe (PID: 1888)
      • key.exe (PID: 2368)
      • key.exe (PID: 3220)

    • Starts CMD.EXE for self-deleting

      • 41CC0C660F45BA98.exe (PID: 2344)
      • 41CC0C660F45BA98.exe (PID: 2496)
      • Setup.exe (PID: 500)
      • Setup.exe (PID: 3388)
      • Setup.exe (PID: 3436)
      • Setup.exe (PID: 2192)
      • Setup.exe (PID: 2080)
      • file.exe (PID: 2540)
      • file.exe (PID: 3776)

    • Creates files in the program directory

      • msiexec.exe (PID: 2944)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 2944)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2944)

    • Executed via COM

      • DllHost.exe (PID: 2932)
      • iexplore.exe (PID: 2168)

    • Reads Microsoft Outlook installation path

      • keygen-pr.exe (PID: 904)
      • iexplore.exe (PID: 3576)

    • Reads internet explorer settings

      • keygen-pr.exe (PID: 904)

    • Drops a file with a compile date too recent

      • BTRSetp.exe (PID: 2448)
      • BTRSetp.exe (PID: 2140)

  • INFO

    • Reads Microsoft Office registry keys

      • key.exe (PID: 3176)
      • WINWORD.EXE (PID: 3732)
      • key.exe (PID: 848)
      • key.exe (PID: 2368)

    • Reads settings of System Certificates

      • Setup.exe (PID: 500)
      • file.exe (PID: 2540)
      • Vbox.exe (PID: 3344)
      • Vbox.exe (PID: 2764)
      • file.exe (PID: 3776)
      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3576)

    • Reads the computer name

      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 2944)
      • PING.EXE (PID: 1240)
      • MsiExec.exe (PID: 352)
      • vssvc.exe (PID: 2796)
      • firefox.exe (PID: 312)
      • taskkill.exe (PID: 3768)
      • PING.EXE (PID: 3776)
      • PING.EXE (PID: 3832)
      • WINWORD.EXE (PID: 3732)
      • explorer.exe (PID: 2884)
      • DllHost.exe (PID: 2932)
      • PING.EXE (PID: 3992)
      • msiexec.exe (PID: 3696)
      • MsiExec.exe (PID: 1104)
      • msiexec.exe (PID: 3244)
      • PING.EXE (PID: 2676)
      • MsiExec.exe (PID: 3388)
      • msiexec.exe (PID: 4048)
      • PING.EXE (PID: 2864)
      • MsiExec.exe (PID: 3280)
      • msiexec.exe (PID: 1536)
      • PING.EXE (PID: 1324)
      • MsiExec.exe (PID: 3504)
      • PING.EXE (PID: 3124)
      • PING.EXE (PID: 1768)
      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3576)

    • Checks supported languages

      • msiexec.exe (PID: 2944)
      • PING.EXE (PID: 1240)
      • MsiExec.exe (PID: 352)
      • vssvc.exe (PID: 2796)
      • firefox.exe (PID: 312)
      • taskkill.exe (PID: 3768)
      • PING.EXE (PID: 3776)
      • PING.EXE (PID: 3832)
      • msiexec.exe (PID: 1280)
      • WINWORD.EXE (PID: 3732)
      • explorer.exe (PID: 2884)
      • DllHost.exe (PID: 2932)
      • msiexec.exe (PID: 3696)
      • PING.EXE (PID: 3992)
      • MsiExec.exe (PID: 1104)
      • PING.EXE (PID: 2676)
      • msiexec.exe (PID: 3244)
      • msiexec.exe (PID: 4048)
      • MsiExec.exe (PID: 3388)
      • MsiExec.exe (PID: 3280)
      • PING.EXE (PID: 2864)
      • msiexec.exe (PID: 1536)
      • PING.EXE (PID: 1324)
      • MsiExec.exe (PID: 3504)
      • PING.EXE (PID: 3124)
      • PING.EXE (PID: 1768)
      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3576)
      • NOTEPAD.EXE (PID: 3428)
      • NOTEPAD.EXE (PID: 3744)

    • Manual execution by user

      • WINWORD.EXE (PID: 3732)
      • explorer.exe (PID: 2884)
      • SmartMovie_v3_25_keygen_by_KeygenNinja.exe (PID: 2700)
      • keygen-step-4.exe (PID: 2920)
      • keygen-step-4.exe (PID: 588)
      • cmd.exe (PID: 3236)
      • keygen-pr.exe (PID: 904)
      • ubisoftful.exe (PID: 928)
      • ubisoftful.exe (PID: 584)
      • BTRSetp.exe (PID: 2448)
      • 002.exe (PID: 464)
      • testinstalls.exe (PID: 1808)
      • testinstalls.exe (PID: 3116)
      • md2_2efs.exe (PID: 3696)
      • BTRSetp.exe (PID: 2140)
      • testinstalls.exe (PID: 324)
      • testinstalls.exe (PID: 3560)
      • NOTEPAD.EXE (PID: 3428)
      • 002.exe (PID: 2492)
      • NOTEPAD.EXE (PID: 3744)
      • 002.exe (PID: 3616)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3732)
      • iexplore.exe (PID: 3576)

    • Checks Windows Trust Settings

      • file.exe (PID: 2540)
      • Vbox.exe (PID: 3344)
      • Vbox.exe (PID: 2764)
      • file.exe (PID: 3776)
      • iexplore.exe (PID: 3576)
      • iexplore.exe (PID: 2168)

    • Application launched itself

      • iexplore.exe (PID: 2168)

    • Changes internet zones settings

      • iexplore.exe (PID: 2168)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2168)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3576)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1e1f9
UninitializedDataSize: -
InitializedDataSize: 254464
CodeSize: 198144
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:03:26 11:02:47+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 26-Mar-2020 10:02:47
Detected languages:
  • English - United States
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 26-Mar-2020 10:02:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00030581
0x00030600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.70021
.rdata
0x00032000
0x0000A332
0x0000A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.23888
.data
0x0003D000
0x000238B0
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.83994
.gfids
0x00061000
0x000000E8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.12166
.rsrc
0x00062000
0x0000DFD0
0x0000E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.63693
.reloc
0x00070000
0x0000210C
0x00002200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.61039

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.25329
1875
UNKNOWN
English - United States
RT_MANIFEST
2
5.10026
2216
UNKNOWN
English - United States
RT_ICON
3
5.25868
3752
UNKNOWN
English - United States
RT_ICON
4
5.02609
1128
UNKNOWN
English - United States
RT_ICON
5
5.18109
4264
UNKNOWN
English - United States
RT_ICON
6
5.04307
9640
UNKNOWN
English - United States
RT_ICON
7
3.1586
482
UNKNOWN
English - United States
RT_STRING
8
3.11685
460
UNKNOWN
English - United States
RT_STRING
9
3.11236
440
UNKNOWN
English - United States
RT_STRING
10
2.99727
326
UNKNOWN
English - United States
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
221
Monitored processes
113
Malicious processes
46
Suspicious processes
25

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start smartmovie_v3_25_keygen_by_keygenninja.exe cmd.exe no specs intro.exe keygen-pr.exe keygen-step-3.exe #AZORULT keygen-step-1.exe keygen-step-4.exe #PONY key.exe 002.exe key.exe no specs setup.exe no specs setup.exe msiexec.exe 41cc0c660f45ba98.exe 41cc0c660f45ba98.exe msiexec.exe cmd.exe no specs md2_2efs.exe ping.exe no specs msiexec.exe no specs cmd.exe no specs taskkill.exe no specs firefox.exe no specs vssvc.exe no specs cmd.exe no specs ping.exe no specs thunderfw.exe no specs cmd.exe no specs ping.exe no specs ielowutil.exe no specs winword.exe no specs explorer.exe no specs Shell Security Editor no specs smartmovie_v3_25_keygen_by_keygenninja.exe cmd.exe no specs keygen-pr.exe intro.exe keygen-step-3.exe #AZORULT keygen-step-1.exe keygen-step-4.exe #PONY key.exe 002.exe key.exe setup.exe no specs setup.exe msiexec.exe cmd.exe no specs md2_2efs.exe ping.exe no specs msiexec.exe no specs keygen-step-4.exe 002.exe keygen-step-4.exe 002.exe cmd.exe no specs keygen-pr.exe #AZORULT keygen-step-1.exe keygen-step-3.exe keygen-step-4.exe #PONY key.exe 002.exe key.exe no specs setup.exe no specs setup.exe setup.exe no specs setup.exe msiexec.exe cmd.exe no specs md2_2efs.exe ping.exe no specs msiexec.exe no specs msiexec.exe cmd.exe no specs md2_2efs.exe ping.exe no specs msiexec.exe no specs setup.exe no specs setup.exe msiexec.exe md2_2efs.exe cmd.exe no specs ping.exe no specs msiexec.exe no specs keygen-pr.exe no specs ielowutil.exe no specs file.exe cmd.exe no specs vbox.exe ping.exe no specs file.exe cmd.exe no specs vbox.exe ping.exe no specs ubisoftful.exe ubisoftful.exe 002.exe btrsetp.exe installer.exe no specs installer.exe iexplore.exe iexplore.exe testinstalls.exe no specs testinstalls.exe no specs testinstalls.exe no specs testinstalls.exe no specs md2_2efs.exe btrsetp.exe installer.exe no specs installer.exe notepad.exe no specs notepad.exe no specs 002.exe 002.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272keygen-step-4.exe C:\Users\admin\AppData\Local\Temp\RarSFX2\keygen-step-4.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rarsfx2\keygen-step-4.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
312"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—41CC0C660F45BA98.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
324"C:\Users\admin\AppData\Local\Temp\RarSFX6\testinstalls.exe" C:\Users\admin\AppData\Local\Temp\RarSFX6\testinstalls.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
cSharpQuickPanel
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx6\testinstalls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
348C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX2\keygen.bat" "C:\Windows\system32\cmd.exe—SmartMovie_v3_25_keygen_by_KeygenNinja.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
352C:\Windows\system32\MsiExec.exe -Embedding 159FDB57A3AD960E6ABA0349E951AD5F CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
372cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\admin\AppData\Local\Temp\41CC0C660F45BA98.exe"C:\Windows\system32\cmd.exe—41CC0C660F45BA98.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
464"C:\Users\admin\AppData\Local\Temp\RarSFX6\002.exe" C:\Users\admin\AppData\Local\Temp\RarSFX6\002.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx6\002.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
492"C:\Users\admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
keygen-step-4.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\md2_2efs.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
500"C:\Users\admin\AppData\Local\Temp\RarSFX1\Setup.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\Setup.exe
keygen-step-4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\sechost.dll
584"C:\Users\admin\AppData\Local\Temp\RarSFX6\ubisoftful.exe" C:\Users\admin\AppData\Local\Temp\RarSFX6\ubisoftful.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx6\ubisoftful.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
87 939
Read events
85 886
Write events
1 823
Delete events
230

Modification events

(PID) Process:(3852) SmartMovie_v3_25_keygen_by_KeygenNinja.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3852) SmartMovie_v3_25_keygen_by_KeygenNinja.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3852) SmartMovie_v3_25_keygen_by_KeygenNinja.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3852) SmartMovie_v3_25_keygen_by_KeygenNinja.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2880) intro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2880) intro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2880) intro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2880) intro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2880) intro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2880) intro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
88
Suspicious files
56
Text files
45
Unknown types
53

Dropped files

PID
Process
Filename
Type
3852SmartMovie_v3_25_keygen_by_KeygenNinja.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\intro.exeexecutable
MD5:—
SHA256:—
3104keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\Setup.exeexecutable
MD5:—
SHA256:—
3104keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\md2_2efs.exeexecutable
MD5:—
SHA256:—
3852SmartMovie_v3_25_keygen_by_KeygenNinja.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:—
SHA256:—
3852SmartMovie_v3_25_keygen_by_KeygenNinja.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeexecutable
MD5:—
SHA256:—
3852SmartMovie_v3_25_keygen_by_KeygenNinja.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:—
SHA256:—
3104keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\002.exeexecutable
MD5:—
SHA256:—
3104keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\Vbox.exeexecutable
MD5:—
SHA256:—
3104keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\BTRSetp.exeexecutable
MD5:—
SHA256:—
3104keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\gdrrr.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
86
DNS requests
25
Threats
97

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3240
md2_2efs.exe
GET
—
101.36.107.74:80
http://101.36.107.74/seemorebty/il.php?e=md2_2efs
CN
—
—
malicious
492
md2_2efs.exe
GET
—
101.36.107.74:80
http://101.36.107.74/seemorebty/il.php?e=md2_2efs
CN
—
—
malicious
3044
md2_2efs.exe
GET
—
101.36.107.74:80
http://101.36.107.74/seemorebty/il.php?e=md2_2efs
CN
—
—
malicious
1952
md2_2efs.exe
GET
—
101.36.107.74:80
http://101.36.107.74/seemorebty/il.php?e=md2_2efs
CN
—
—
malicious
1888
key.exe
POST
—
185.177.93.149:80
http://www.oldhorse.info/
MD
—
—
malicious
1888
key.exe
POST
200
185.177.93.149:80
http://oldhorse.info/a.php
MD
—
—
malicious
2632
key.exe
POST
—
185.177.93.149:80
http://www.oldhorse.info/
MD
—
—
malicious
1888
key.exe
POST
—
185.177.93.149:80
http://www.oldhorse.info/
MD
—
—
malicious
3220
key.exe
POST
200
185.177.93.149:80
http://oldhorse.info/a.php
MD
—
—
malicious
1740
md2_2efs.exe
GET
—
101.36.107.74:80
http://101.36.107.74/seemorebty/il.php?e=md2_2efs
CN
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1328
keygen-step-1.exe
185.173.37.179:80
kvaka.li
M-Telecom, LLC
RU
malicious
—
—
34.98.99.30:80
www.wsfsd33sdfer.com
—
US
whitelisted
492
md2_2efs.exe
101.36.107.74:80
—
—
CN
malicious
—
—
185.173.37.179:443
kvaka.li
M-Telecom, LLC
RU
malicious
2880
intro.exe
185.173.37.179:443
kvaka.li
M-Telecom, LLC
RU
malicious
1084
keygen-step-3.exe
34.98.99.30:80
www.wsfsd33sdfer.com
—
US
whitelisted
—
—
185.173.37.179:80
kvaka.li
M-Telecom, LLC
RU
malicious
1888
key.exe
185.177.93.149:80
oldhorse.info
—
MD
malicious
2632
key.exe
185.177.93.149:80
oldhorse.info
—
MD
malicious
3044
md2_2efs.exe
101.36.107.74:80
—
—
CN
malicious

DNS requests

Domain
IP
Reputation
www.wsfsd33sdfer.com
  • 34.98.99.30
whitelisted
kvaka.li
  • 185.173.37.179
malicious
a.kvaka.li
  • 185.173.37.179
malicious
ppiinstall.xyz
  • —
malicious
e256c58b1e6fbc0a.xyz
  • —
unknown
oldhorse.info
  • 185.177.93.149
malicious
www.oldhorse.info
  • 185.177.93.149
malicious
E256C58B1E6FBC0A.xyz
  • —
unknown
iplogger.org
  • 148.251.234.83
shared
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.178
whitelisted

Threats

PID
Process
Class
Message
1084
keygen-step-3.exe
Misc Attack
ET Threatview.io High Confidence Cobalt Strike C2 IP group 7
1328
keygen-step-1.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
1328
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2632
key.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2632
key.exe
Generic Protocol Command Decode
SURICATA HTTP invalid response chunk len
2632
key.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2632
key.exe
Generic Protocol Command Decode
SURICATA HTTP invalid response chunk len
492
md2_2efs.exe
A Network Trojan was detected
AV TROJAN Win32/Masson CnC Activity
2488
keygen-step-1.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
2488
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
51 ETPRO signatures available at the full report
Process
Message
002.exe
./he.c
002.exe
002
002.exe
./he.c
md2_2efs.exe
<<< Exit with same app>>>
002.exe
./he.c
002.exe
./he.c
002.exe
./he.c
md2_2efs.exe
<<< Exit with same app>>>
md2_2efs.exe
<<< Exit with same app>>>
md2_2efs.exe
<<< Exit with same app>>>
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SmartMovie_v3_25_keygen_by_KeygenNinja.exe