analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

3ca3579e3a2a66f494bcb72adc576482.bat

Full analysis: https://app.any.run/tasks/91b685f3-6631-4b26-b691-bad051e46fb8
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Analysis date: November 14, 2018, 10:54:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2978B9AF6D7985ECBEEDF8E3CBC5F6F3

SHA1:

58D74DA45259396B1E43A10B6736C5CA7443ACC4

SHA256:

BFF1B31DF5D7BD5DA7F80E84D094AFC34A4E96BB08DDC5D37483C145700D91C3

SSDEEP:

12288:/UBgyoyvf7UziRXlQM9nH541EeIccPniD1kR/XlQM9nH541EeIccPniD1kR1:/UXvf7OQVQ4nZaEj+kR/VQ4nZaEj+kR1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 2.bat (PID: 3744)
      • 1.exe (PID: 3216)
      • 1.exe (PID: 3100)
      • 2.bat (PID: 2956)
      • syswin32.exe (PID: 3612)
      • syswin32.exe (PID: 1480)
    • Stealing of credential data

      • syswin32.exe (PID: 3612)
  • SUSPICIOUS

    • Application launched itself

      • 2.bat (PID: 3744)
      • 1.exe (PID: 3100)
    • Executable content was dropped or overwritten

      • 3ca3579e3a2a66f494bcb72adc576482.bat (PID: 1908)
      • 2.bat (PID: 2956)
      • 1.exe (PID: 3216)
    • Suspicious files were dropped or overwritten

      • 3ca3579e3a2a66f494bcb72adc576482.bat (PID: 1908)
    • Starts application with an unusual extension

      • 3ca3579e3a2a66f494bcb72adc576482.bat (PID: 1908)
      • 2.bat (PID: 3744)
    • Starts Internet Explorer

      • 2.bat (PID: 2956)
      • 1.exe (PID: 3216)
    • Creates files in the user directory

      • 1.exe (PID: 3216)
    • Loads DLL from Mozilla Firefox

      • syswin32.exe (PID: 3612)
  • INFO

    • Application was crashed

      • iexplore.exe (PID: 3160)
    • Connects to unusual port

      • iexplore.exe (PID: 3220)
    • Creates files in the user directory

      • iexplore.exe (PID: 3220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:08:14 21:15:54+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 135168
InitializedDataSize: 250880
UninitializedDataSize: -
EntryPoint: 0xfce7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Aug-2016 19:15:54
Detected languages:
  • Polish - Poland
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 14-Aug-2016 19:15:54
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00020F77
0x00021000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62162
.rdata
0x00022000
0x00008FD4
0x00009000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13549
.data
0x0002B000
0x0002D370
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.7652
.gfids
0x00059000
0x000000FC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.16316
.rsrc
0x0005A000
0x0000483D
0x00004A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.69159
.reloc
0x0005F000
0x00002354
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.69514

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28823
1873
UNKNOWN
Polish - Poland
RT_MANIFEST
7
3.41798
548
UNKNOWN
Polish - Poland
RT_STRING
8
3.45553
572
UNKNOWN
Polish - Poland
RT_STRING
9
3.47114
492
UNKNOWN
Polish - Poland
RT_STRING
10
3.40584
320
UNKNOWN
Polish - Poland
RT_STRING
11
3.53928
1216
UNKNOWN
Polish - Poland
RT_STRING
12
3.32935
368
UNKNOWN
Polish - Poland
RT_STRING
13
3.23901
300
UNKNOWN
Polish - Poland
RT_STRING
14
3.15623
264
UNKNOWN
Polish - Poland
RT_STRING
15
3.15753
232
UNKNOWN
Polish - Poland
RT_STRING

Imports

COMCTL32.dll (delay-loaded)
KERNEL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
9
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start 3ca3579e3a2a66f494bcb72adc576482.bat 1.exe no specs 2.bat no specs 2.bat 1.exe iexplore.exe iexplore.exe syswin32.exe no specs syswin32.exe

Process information

PID
CMD
Path
Indicators
Parent process
1908"C:\Users\admin\AppData\Local\Temp\3ca3579e3a2a66f494bcb72adc576482.bat" C:\Users\admin\AppData\Local\Temp\3ca3579e3a2a66f494bcb72adc576482.bat
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3100"C:\Users\admin\AppData\Local\Temp\1.exe" C:\Users\admin\AppData\Local\Temp\1.exe3ca3579e3a2a66f494bcb72adc576482.bat
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3744"C:\Users\admin\AppData\Local\Temp\2.bat" C:\Users\admin\AppData\Local\Temp\2.bat3ca3579e3a2a66f494bcb72adc576482.bat
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2956"C:\Users\admin\AppData\Local\Temp\2.bat"C:\Users\admin\AppData\Local\Temp\2.bat
2.bat
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3216"C:\Users\admin\AppData\Local\Temp\1.exe"C:\Users\admin\AppData\Local\Temp\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3220"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3160"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
2.bat
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1480"C:\Users\admin\AppData\Roaming\install\syswin32.exe" C:\Users\admin\AppData\Roaming\install\syswin32.exeiexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3612"C:\Users\admin\AppData\Roaming\install\syswin32.exe"C:\Users\admin\AppData\Roaming\install\syswin32.exe
syswin32.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Total events
1 063
Read events
1 045
Write events
18
Delete events
0

Modification events

(PID) Process:(1908) 3ca3579e3a2a66f494bcb72adc576482.batKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1908) 3ca3579e3a2a66f494bcb72adc576482.batKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3220) iexplore.exeKey:HKEY_CURRENT_USER\Software\addon
Operation:writeName:FirstExecution
Value:
14/11/2018 -- 10:55
(PID) Process:(3220) iexplore.exeKey:HKEY_CURRENT_USER\Software\addon
Operation:writeName:NewIdentification
Value:
addon
(PID) Process:(3220) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3220) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3612) syswin32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\syswin32_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3612) syswin32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\syswin32_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3612) syswin32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\syswin32_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3612) syswin32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\syswin32_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
4
Suspicious files
2
Text files
717
Unknown types
0

Dropped files

PID
Process
Filename
Type
19083ca3579e3a2a66f494bcb72adc576482.batC:\Users\admin\AppData\Local\Temp\2.batexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
3220iexplore.exeC:\Users\admin\AppData\Local\Temp\UuU.uUutext
MD5:58DE92C85ACD0D04B037CF8CE892B610
SHA256:F9615282926401695C4C314A2DC0630714972B123B0D67B9704C68F37E8272A7
32161.exeC:\Users\admin\AppData\Roaming\install\syswin32.exeexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
29562.batC:\Users\admin\AppData\Roaming\install\syswin32.exeexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
29562.batC:\Users\admin\AppData\Local\Temp\XX--XX--XX.txtbinary
MD5:1D714CF0C3C9E707635EA67BEB8890BD
SHA256:8AB3678871BF90FBD13C066EA8521F14D9316144665016B568C41C4D1DBB7D57
3220iexplore.exeC:\Users\admin\AppData\Local\Temp\XxX.xXxtext
MD5:58DE92C85ACD0D04B037CF8CE892B610
SHA256:F9615282926401695C4C314A2DC0630714972B123B0D67B9704C68F37E8272A7
32161.exeC:\Users\admin\AppData\Local\Temp\XX--XX--XX.txtbinary
MD5:1D714CF0C3C9E707635EA67BEB8890BD
SHA256:8AB3678871BF90FBD13C066EA8521F14D9316144665016B568C41C4D1DBB7D57
19083ca3579e3a2a66f494bcb72adc576482.batC:\Users\admin\AppData\Local\Temp\1.exeexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
3220iexplore.exeC:\Users\admin\AppData\Roaming\logs.dattext
MD5:BF3DBA41023802CF6D3F8C5FD683A0C7
SHA256:4A8E75390856BF822F492F7F605CA0C21F1905172F6D3EF610162533C140507D
3612syswin32.exeC:\Users\admin\AppData\Local\Temp\IEWEB.abctext
MD5:9E2FBAF6FAE8C687AA4E519EED2CFEC9
SHA256:54F5A85E392B1498DC1D9E8E9E7D685237CBD33320593AEBFEC706D3F6F1CAA1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3220
iexplore.exe
217.173.4.252:3300
123host.zapto.org
Przedsiebiorstwo PROMAX Spolka Jawna Zofia Formanek-Okroj, Wieslaw Okroj
PL
unknown

DNS requests

Domain
IP
Reputation
123host.zapto.org
  • 217.173.4.252
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info