| File name: | Xforce_keygen_by_KeygenSumo.zip |
| Full analysis: | https://app.any.run/tasks/a662becf-b2c2-4b7b-aa68-48996347d4ed |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | July 02, 2021, 04:18:49 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | 12E971A3C2BA08EECF2554A7982BE128 |
| SHA1: | C32E1953EFBE09626B181C88CC76D34733E7291C |
| SHA256: | B6C5CEE94F3DCBA4570377CC032776DD5453291F7D36932AA50557C93E16C592 |
| SSDEEP: | 98304:W3Gj/vDBcShZQqeBI34nepmigVo5zpATCg/IOk3xqvRcdDgXQDrFrJMxSZn:WM/rOSiBI1nRpqCBsv2p0yJF |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipFileName: | Xforce_keygen_by_KeygenSumo.zip |
|---|---|
| ZipUncompressedSize: | 6506518 |
| ZipCompressedSize: | 6506518 |
| ZipCRC: | 0xfad1872d |
| ZipModifyDate: | 2021:07:02 07:18:08 |
| ZipCompression: | None |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 272 | ping 1.1.1.1 -n 1 -w 3000 | C:\Windows\system32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 308 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2580 CREDAT:275457 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 348 | "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL | C:\Windows\system32\cmd.exe | — | keygen-step-6.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 876 | C:\Windows\system32\svchost.exe -k netsvcs | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 904 | C:\Windows\system32\svchost.exe -k SystemNetworkService | C:\Windows\system32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 924 | "C:\Users\admin\AppData\Local\Temp\79-2c5b7-6a9-7569d-5204d928ba9d4\Sezhaetyhaezhae.exe" | C:\Users\admin\AppData\Local\Temp\79-2c5b7-6a9-7569d-5204d928ba9d4\Sezhaetyhaezhae.exe | JFHGSFGSIUGFSUIG.exe | ||||||||||||
User: admin Company: Soft_Cpm_ID__wcz9g62k6fav6864eh3z Integrity Level: HIGH Description: Soft_Cpm_ID__wcz9g62k6fav6864eh3z Exit code: 0 Version: 3.3.3.3 Modules
| |||||||||||||||
| 944 | "C:\Users\admin\AppData\Local\Temp\nscE16E.tmp\ns42BA.tmp" "C:\Program Files\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files\lighteningplayer\plugins\ /SILENT | C:\Users\admin\AppData\Local\Temp\nscE16E.tmp\ns42BA.tmp | — | SunLabsPlayer.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 996 | cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe" | C:\Windows\system32\cmd.exe | — | keygen-step-3.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1320 | "C:\Users\admin\AppData\Roaming\WinHost\WinHoster.exe" | C:\Users\admin\AppData\Roaming\WinHost\WinHoster.exe | — | 8602741.exe | |||||||||||
User: admin Company: WinHost Integrity Level: MEDIUM Description: WinHost Exit code: 0 Version: 1.0.0.12 Modules
| |||||||||||||||
| 1460 | "C:\Windows\System32\cmd.exe" /q /C TypE "C:\Users\admin\AppData\Local\Temp\JNCo2Vf2MC.EXE" > JNCo2Vf2MC.EXE &&stArt JNCo2VF2MC.eXe -PaZ3cHdzoOBUwugzFH & iF "-PaZ3cHdzoOBUwugzFH "== "" for %h In ( "C:\Users\admin\AppData\Local\Temp\JNCo2Vf2MC.EXE" ) do taskkill /f /iM "%~NXh" > NuL | C:\Windows\System32\cmd.exe | — | JNCo2Vf2MC.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\Xforce_keygen_by_KeygenSumo.zip | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2136) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2136 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2136.38554\Xforce_keygen_by_KeygenSumo.zip | — | |
MD5:— | SHA256:— | |||
| 2192 | WinRAR.exe | C:\Users\admin\Desktop\FILE_ID.DIZ | text | |
MD5:— | SHA256:— | |||
| 2192 | WinRAR.exe | C:\Users\admin\Desktop\Xforce_keygen_by_KeygenSumo.exe | executable | |
MD5:— | SHA256:— | |||
| 2928 | Xforce_keygen_by_KeygenSumo.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe | executable | |
MD5:— | SHA256:— | |||
| 2928 | Xforce_keygen_by_KeygenSumo.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe | executable | |
MD5:— | SHA256:— | |||
| 2928 | Xforce_keygen_by_KeygenSumo.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe | executable | |
MD5:— | SHA256:— | |||
| 2756 | keygen-step-3.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data1 | sqlite | |
MD5:— | SHA256:— | |||
| 2928 | Xforce_keygen_by_KeygenSumo.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe | executable | |
MD5:— | SHA256:— | |||
| 3580 | keygen-step-4.exe | C:\Users\admin\AppData\Local\Temp\RarSFX2\GloryWSetp.exe | executable | |
MD5:— | SHA256:— | |||
| 3580 | keygen-step-4.exe | C:\Users\admin\AppData\Local\Temp\RarSFX2\John.url | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2756 | keygen-step-3.exe | POST | 200 | 107.191.60.39:80 | http://www.w7dslkipoja.com/index.php/api/fb | JP | text | 24 b | suspicious |
2152 | keygen-step-6.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 471 b | whitelisted |
2152 | keygen-step-6.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D | US | der | 471 b | whitelisted |
2152 | keygen-step-6.exe | GET | 301 | 85.214.154.106:80 | http://www.almanhost.com/components/fw2.php | DE | executable | 515 Kb | suspicious |
2152 | keygen-step-6.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 727 b | whitelisted |
2152 | keygen-step-6.exe | GET | 200 | 23.45.105.185:80 | http://x1.c.lencr.org/ | NL | der | 717 b | whitelisted |
2152 | keygen-step-6.exe | GET | 301 | 85.214.154.106:80 | http://www.almanhost.com/components/fw3.php | DE | executable | 515 Kb | suspicious |
2152 | keygen-step-6.exe | GET | 200 | 85.214.154.106:80 | http://www.almanhost.com/components/fw4.exe | DE | executable | 101 Kb | suspicious |
2152 | keygen-step-6.exe | GET | 200 | 85.214.154.106:80 | http://www.almanhost.com/components/fw3.exe | DE | executable | 118 Kb | suspicious |
2152 | keygen-step-6.exe | GET | 200 | 85.214.154.106:80 | http://www.almanhost.com/components/fw1.php | DE | executable | 515 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2756 | keygen-step-3.exe | 107.191.60.39:80 | www.w7dslkipoja.com | Choopa, LLC | JP | malicious |
2416 | keygen-step-1.exe | 185.173.37.179:80 | kvaka.li | M-Telecom, LLC | RU | malicious |
2152 | keygen-step-6.exe | 88.99.66.31:443 | iplogger.org | Hetzner Online GmbH | DE | malicious |
2152 | keygen-step-6.exe | 151.139.128.14:80 | ocsp.comodoca.com | Highwinds Network Group, Inc. | US | suspicious |
2152 | keygen-step-6.exe | 85.214.154.106:80 | www.almanhost.com | Strato AG | DE | suspicious |
2152 | keygen-step-6.exe | 23.45.105.185:80 | x1.c.lencr.org | Akamai International B.V. | NL | unknown |
2152 | keygen-step-6.exe | 195.138.255.18:80 | r3.o.lencr.org | AS33891 Netzbetrieb GmbH | DE | unknown |
2172 | 43A1.tmp.exe | 95.216.186.40:443 | tttttt.me | Hetzner Online GmbH | DE | suspicious |
3552 | GloryWSetp.exe | 104.21.42.63:443 | videoconvert-download38.xyz | Cloudflare Inc | US | suspicious |
2172 | 43A1.tmp.exe | 35.205.249.65:80 | — | Google Inc. | US | malicious |
Domain | IP | Reputation |
|---|---|---|
www.w7dslkipoja.com |
| suspicious |
kvaka.li |
| malicious |
iplogger.org |
| shared |
ocsp.comodoca.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
ocsp.sectigo.com |
| whitelisted |
www.almanhost.com |
| suspicious |
crl.identrust.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
PID | Process | Class | Message |
|---|---|---|---|
2416 | keygen-step-1.exe | A Network Trojan was detected | ET TROJAN Win32/AZORult V3.3 Client Checkin M2 |
2416 | keygen-step-1.exe | A Network Trojan was detected | AV TROJAN Azorult CnC Beacon |
2152 | keygen-step-6.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2152 | keygen-step-6.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2152 | keygen-step-6.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2152 | keygen-step-6.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .exe file with no User-Agent |
2152 | keygen-step-6.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
2152 | keygen-step-6.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2152 | keygen-step-6.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .exe file with no User-Agent |
2152 | keygen-step-6.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |