| URL: | https://idmpatched.com/obs-studio/ |
| Full analysis: | https://app.any.run/tasks/4e21697a-1a8c-45a1-950b-ee008e2f588f |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | July 07, 2021, 12:39:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 449E717CD1C8C9B8D8BB911F02746AD0 |
| SHA1: | 50BB4A7F642A094A7AC4AC1DD5B21D7F1FC659AA |
| SHA256: | BB6D9BAD1CD4F64DC93FB6E986F95CFF0BEEF00534A8BD0D4EE7272DD90B2882 |
| SSDEEP: | 3:N8CLByTKcPWQcn:2CLByTKceP |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 276 | taskkill /f /im wireguard.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 308 | "C:\Users\admin\AppData\Local\Temp\is-3E4HC.tmp\_____________bob.exe" /S /UID=burnerch1 | C:\Users\admin\AppData\Local\Temp\is-3E4HC.tmp\_____________bob.exe | MediaBurner.tmp | ||||||||||||
User: admin Company: Burner_ID__6bcewmegqhc267pz5w2c5gvww Integrity Level: HIGH Description: Burner_ID__6bcewmegqhc267pz5w2c5gvww Exit code: 0 Version: 8.87.7.8 Modules
| |||||||||||||||
| 312 | C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 320 | "C:\Users\admin\AppData\Roaming\7536611.exe" | C:\Users\admin\AppData\Roaming\7536611.exe | sahiba_6.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Defective Exit code: 0 Version: 3.1.0.0 Modules
| |||||||||||||||
| 320 | "C:\Users\admin\Documents\DK2u8J8s6Y_OKtryFL3tUKvl.exe" | C:\Users\admin\Documents\DK2u8J8s6Y_OKtryFL3tUKvl.exe | sahiba_7.exe | ||||||||||||
User: admin Company: Kiff devel. Integrity Level: HIGH Description: MyKiff Exit code: 0 Version: 3.5.7.9 Modules
| |||||||||||||||
| 336 | C:\Users\admin\Documents\8_WUt7Q24AJOgmydqB0qCIT1.exe | C:\Users\admin\Documents\8_WUt7Q24AJOgmydqB0qCIT1.exe | — | 8_WUt7Q24AJOgmydqB0qCIT1.exe | |||||||||||
User: admin Company: NList Corporation. Integrity Level: HIGH Description: Net Listing App Exit code: 0 Version: 124.698.302.190 Modules
| |||||||||||||||
| 356 | C:\Users\admin\Documents\sCvSX5Npg_ODcTpciw8DPCry.exe | C:\Users\admin\Documents\sCvSX5Npg_ODcTpciw8DPCry.exe | — | sCvSX5Npg_ODcTpciw8DPCry.exe | |||||||||||
User: admin Company: NList Corporation. Integrity Level: HIGH Description: Net Listing App Exit code: 0 Version: 606.784.33.599 Modules
| |||||||||||||||
| 364 | C:\Users\admin\Documents\8_WUt7Q24AJOgmydqB0qCIT1.exe | C:\Users\admin\Documents\8_WUt7Q24AJOgmydqB0qCIT1.exe | — | 8_WUt7Q24AJOgmydqB0qCIT1.exe | |||||||||||
User: admin Company: NList Corporation. Integrity Level: HIGH Description: Net Listing App Exit code: 0 Version: 124.698.302.190 Modules
| |||||||||||||||
| 368 | "C:\Program Files\Browzar\MrGh6bEH0L0a.exe" | C:\Program Files\Browzar\MrGh6bEH0L0a.exe | — | MrGh6bEH0L0a.exe | |||||||||||
User: admin Company: LFS Corporation. Integrity Level: HIGH Description: Ferz Universal App Exit code: 0 Version: 950.469.10.696 Modules
| |||||||||||||||
| 400 | "C:\Users\admin\AppData\Local\Temp\setup_installer.exe" | C:\Users\admin\AppData\Local\Temp\setup_installer.exe | main_setup_x86x64.exe | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Exit code: 0 Version: 19.00 Modules
| |||||||||||||||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
| (PID) Process: | (568) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid_installdate |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60E5A088-238.pma | — | |
MD5:— | SHA256:— | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences | text | |
MD5:— | SHA256:— | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\9133bf6d-4196-47e8-a156-160d6c247b97.tmp | text | |
MD5:— | SHA256:— | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\8135a1a5-8025-46eb-80aa-623c3288355e.tmp | binary | |
MD5:5058F1AF8388633F609CADB75A75DC9D | SHA256:— | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC | SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731 | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:7721CDA9F5B73CE8A135471EB53B4E0E | SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500 | |||
| 1264 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma | binary | |
MD5:03C4F648043A88675A920425D824E1B3 | SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450 | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:5BD3C311F2136A7A88D3E197E55CF902 | SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9 | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF10a8e4.TMP | text | |
MD5:8304B8F42465198890090F52D3F80A4C | SHA256:80C32AC2585E7E81200104B1630F19560A156C4ABF51B5888B0FBF07323FAB34 | |||
| 568 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old | text | |
MD5:5202CA4D6AF0C37DAEC0D528CC7F2986 | SHA256:8F5B8FF94B14C36EA0CBE8FA0A4D165A632B45F834BBB7239E1A6CF6685F256C | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2880 | chrome.exe | GET | 301 | 172.67.183.55:80 | http://centomor.xyz/?s=163&q=OBS-Studio-2701-Crack-&g=4448d149e5ad185d11fb11eee8c78b7e&mode= | US | — | — | malicious |
496 | sahiba_5.tmp | HEAD | 200 | 63.250.33.126:80 | http://requested404.com/C_Pirlo/UltraMediaBurner.exe | US | — | — | suspicious |
3080 | sahiba_7.exe | HEAD | 200 | 136.144.41.201:80 | http://136.144.41.201/WW/file10.exe | NL | — | — | suspicious |
3368 | setup_install.exe | GET | 200 | 104.21.86.8:80 | http://razino.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=139&oname[]=7July220PM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&oname[]=8&oname[]=9&oname[]=10&cnt=10 | US | text | 10 b | malicious |
2880 | chrome.exe | GET | 302 | 54.214.130.202:80 | http://54.214.130.202/?00bcb3becb49f270b481397fd524e4c2365901f4=592d520959078c2a6d2e16efccf4bff314b74a5f&m=163&q=OBS-Studio-2701-Crack-&dedica= | US | html | 19.0 Kb | unknown |
2880 | chrome.exe | POST | 200 | 54.214.130.202:80 | http://54.214.130.202/?go=4358c7b940a&dedica= | US | html | 670 b | unknown |
3080 | sahiba_7.exe | GET | 200 | 2.56.59.245:80 | http://2.56.59.245/server.txt | unknown | text | 18 b | suspicious |
3080 | sahiba_7.exe | POST | 200 | 79.174.12.174:80 | http://79.174.12.174/base/api/getData.php | unknown | text | 263 b | malicious |
3080 | sahiba_7.exe | POST | 200 | 79.174.12.174:80 | http://79.174.12.174/base/api/getData.php | unknown | text | 263 b | malicious |
3080 | sahiba_7.exe | POST | 200 | 79.174.12.174:80 | http://79.174.12.174/base/api/getData.php | unknown | text | 263 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2880 | chrome.exe | 142.250.186.110:443 | — | Google Inc. | US | whitelisted |
2880 | chrome.exe | 142.250.186.77:443 | clients2.google.com | Google Inc. | US | suspicious |
2880 | chrome.exe | 80.82.77.242:443 | — | Quasi Networks LTD. | SC | suspicious |
2880 | chrome.exe | 192.0.76.3:443 | stats.wp.com | Automattic, Inc | US | suspicious |
2880 | chrome.exe | 192.0.77.2:443 | i1.wp.com | Automattic, Inc | US | suspicious |
2880 | chrome.exe | 192.0.77.37:443 | c0.wp.com | Automattic, Inc | US | suspicious |
2880 | chrome.exe | 104.22.70.197:443 | — | Cloudflare Inc | US | unknown |
2880 | chrome.exe | 192.0.73.2:443 | — | Automattic, Inc | US | whitelisted |
2880 | chrome.exe | 192.0.78.27:443 | href.li | Automattic, Inc | US | suspicious |
2880 | chrome.exe | 104.21.65.112:443 | singhost.online | Cloudflare Inc | US | suspicious |
Domain | IP | Reputation |
|---|---|---|
idmpatched.com |
| whitelisted |
clients2.google.com |
| whitelisted |
accounts.google.com |
| shared |
c0.wp.com |
| whitelisted |
i1.wp.com |
| whitelisted |
i0.wp.com |
| whitelisted |
i2.wp.com |
| whitelisted |
stats.wp.com |
| whitelisted |
static.addtoany.com |
| whitelisted |
secure.gravatar.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2880 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
3368 | setup_install.exe | A Network Trojan was detected | AV TROJAN GCleaner Downloader CnC Activity |
3368 | setup_install.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
3080 | sahiba_7.exe | A Network Trojan was detected | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) |
3080 | sahiba_7.exe | Potential Corporate Privacy Violation | ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) |
2124 | sahiba_4.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
2124 | sahiba_4.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
496 | sahiba_5.tmp | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3080 | sahiba_7.exe | Generic Protocol Command Decode | SURICATA Applayer Mismatch protocol both directions |
3080 | sahiba_7.exe | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
Process | Message |
|---|---|
lighteningplayer-cache-gen.exe | main libvlc debug: VLC media player - 3.0.7 Vetinari
|
lighteningplayer-cache-gen.exe | main libvlc debug: Copyright � 1996-2018 the VideoLAN team
|
lighteningplayer-cache-gen.exe | main libvlc debug: revision 3.0.2-225-gc9e3360dd4
|
lighteningplayer-cache-gen.exe | main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-twolame' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-x264' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--build=x86_64-pc-linux-gnu' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=i686-w64-mingw32'
|
lighteningplayer-cache-gen.exe | main libvlc debug: using multimedia timers as clock source
|
lighteningplayer-cache-gen.exe | main libvlc debug: min period: 1 ms, max period: 1000000 ms
|
lighteningplayer-cache-gen.exe | main libvlc debug: searching plug-in modules
|
lighteningplayer-cache-gen.exe | main libvlc debug: ignoring plugins cache file
|
lighteningplayer-cache-gen.exe | main libvlc debug: recursively browsing `C:\Program Files\lighteningplayer\plugins'
|
lighteningplayer-cache-gen.exe | main libvlc debug: saving plugins cache C:\Program Files\lighteningplayer\plugins\plugins.dat
|