analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://down10.zol.com.cn/zoldownload/1.0beta_115464@81_420899.exe

Full analysis: https://app.any.run/tasks/b5e234e1-32c6-4ba8-9406-c517f12c0bc8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 05:15:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

81E5230738CE592D58D171C3D1742769

SHA1:

03A9619647240E1CD7FA643BF4DA20F9C2534B8B

SHA256:

C1938981082C005A046A98FD7B885A8D9D51DEBD9AECF788F21E47D0025B7190

SSDEEP:

3:N1KaKodI6zKXUmOblzn5AC:CaLd9Bzn5N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • iexplore.exe (PID: 1024)
      • iexplore.exe (PID: 2944)

    • Application was dropped or rewritten from another process

      • 1.0beta_115464@81_420899.exe (PID: 1840)
      • 1.0beta_115464@81_420899.exe (PID: 3116)

    • Actions looks like stealing of personal data

      • 1.0beta_115464@81_420899.exe (PID: 3116)

    • Steals credentials from Web Browsers

      • 1.0beta_115464@81_420899.exe (PID: 3116)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1024)
      • 1.0beta_115464@81_420899.exe (PID: 3116)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 1024)
      • iexplore.exe (PID: 2944)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1024)
      • iexplore.exe (PID: 2944)

    • Checks supported languages

      • 1.0beta_115464@81_420899.exe (PID: 3116)

    • Reads the computer name

      • 1.0beta_115464@81_420899.exe (PID: 3116)

    • Creates files in the user directory

      • 1.0beta_115464@81_420899.exe (PID: 3116)

    • Reads internet explorer settings

      • 1.0beta_115464@81_420899.exe (PID: 3116)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1024)
      • iexplore.exe (PID: 2944)

    • Reads the computer name

      • iexplore.exe (PID: 2944)
      • iexplore.exe (PID: 1024)

    • Application launched itself

      • iexplore.exe (PID: 2944)

    • Changes internet zones settings

      • iexplore.exe (PID: 2944)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2944)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2944)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2944)

    • Creates files in the user directory

      • iexplore.exe (PID: 2944)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2944)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2944)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start iexplore.exe iexplore.exe 1.0beta_115464@81_420899.exe no specs 1.0beta_115464@81_420899.exe

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Internet Explorer\iexplore.exe" "http://down10.zol.com.cn/zoldownload/1.0beta_115464@81_420899.exe"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1024"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1840"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1.0beta_115464@81_420899.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1.0beta_115464@81_420899.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
_
Exit code:
3221226540
Version:
6.0.0.1111
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\1.0beta_115464@81_420899.exe
c:\windows\system32\ntdll.dll
3116"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1.0beta_115464@81_420899.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1.0beta_115464@81_420899.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Description:
_
Version:
6.0.0.1111
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\1.0beta_115464@81_420899.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
10 063
Read events
9 937
Write events
122
Delete events
4

Modification events

(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30960849
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30960849
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
7
Text files
14
Unknown types
4

Dropped files

PID
Process
Filename
Type
2944iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:7B3D7F5057399E9826DC3B39DFFF29F8
SHA256:C4C9C92853051E52D10096F6D5C1A49CF5EB9FCA04BAFB3AF9569BA8A15FC728
2944iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:6AC70C35D7220035CB560D4C84ECAEA8
SHA256:981D65F5C058008B75B9F2B8CF1F175D3F535D425F25E6F910047CFD2CA9DEA3
2944iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:FA526918A211E850A6078FB1D00B2045
SHA256:396B94C667643AFA59D155EF4D812DA6F4D67DD50CEC97194E1CA3A1B3ECE3FE
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SSDILO57.txttext
MD5:A2B0CF5605CC7228A9566C87E4E26133
SHA256:7560FDB853693403C3302466D26A8FE499216781E65BF00E6DC397CFBF527A26
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\HPVFDSQS.txttext
MD5:352E391F1C1B3ACDB77E432E2ED575B8
SHA256:D68C1B703FE7663670D656F8414496747BDFE1FF05329D545C8E9D64F369C2AE
2944iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:AC8FE9D561E9E7288AECF13F03AEA3D1
SHA256:CECD911136F3CCBE6F4869CBCBD9FD15B3FA91CD2FD49B9655FA3BCF8E932C05
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SRKCS4BT.txttext
MD5:FD44F7540B00055A4E553628B993A2C3
SHA256:7F5EF39EB0D5630D33BC84AB0CFB31E2F12C13CE64DF90BA8078ACBD335D5F6E
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SVYEL9AR.txttext
MD5:A86E00D420E38871929F6109EA0E1835
SHA256:425A33C26753FF91D95225FAD7715E3529DDF3F43ADECEA906DCBBE054A7B6E5
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\N2AK36NI.txttext
MD5:8FA35727CFA859A67F3F3A0B151EE765
SHA256:942220F9DD65F9C67C00059717A4D5F39A18EF828A030C4CAC5FEBBA16DB6AEF
2944iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\7CX7YIY1.txttext
MD5:23E958B73CCD3F2BDA0F4064EB559516
SHA256:0A96A71CE55948184240284744CBAEBE35E02282B862018398428ADAA9C7EC48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
19
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1024
iexplore.exe
GET
200
112.132.213.230:80
http://down10.zol.com.cn/zoldownload/1.0beta_115464@81_420899.exe
CN
executable
652 Kb
malicious
2944
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2944
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2944
iexplore.exe
GET
200
8.241.123.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4cdef0988fa81bb1
US
compressed
4.70 Kb
whitelisted
3116
1.0beta_115464@81_420899.exe
POST
503
47.103.45.17:80
http://w.nanweng.cn/qy/gl
CN
html
608 b
malicious
2944
iexplore.exe
GET
200
8.241.123.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?64e289ae660ec22d
US
compressed
4.70 Kb
whitelisted
2944
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
3116
1.0beta_115464@81_420899.exe
POST
503
47.103.45.17:80
http://w.nanweng.cn/qy/gl
CN
html
608 b
malicious
3116
1.0beta_115464@81_420899.exe
POST
503
47.103.45.17:80
http://w.nanweng.cn/qy/gl
CN
html
608 b
malicious
3116
1.0beta_115464@81_420899.exe
POST
503
47.103.45.17:80
http://w.nanweng.cn/qy/png
CN
html
608 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2944
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
2944
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1024
iexplore.exe
112.132.213.230:80
down10.zol.com.cn
CHINA UNICOM China169 Backbone
CN
suspicious
2944
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2944
iexplore.exe
8.241.123.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2944
iexplore.exe
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
whitelisted
2944
iexplore.exe
20.25.53.147:443
query.prod.cms.msn.com
—
US
unknown
3116
1.0beta_115464@81_420899.exe
47.103.45.17:80
w.nanweng.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
2944
iexplore.exe
104.92.93.19:443
go.microsoft.com
Akamai Technologies, Inc.
NL
unknown

DNS requests

Domain
IP
Reputation
down10.zol.com.cn
  • 112.132.213.230
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 8.241.123.126
  • 67.27.158.254
  • 67.27.157.254
  • 8.248.149.254
  • 8.241.123.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 104.92.93.19
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
query.prod.cms.msn.com
  • 20.25.53.147
whitelisted
w.nanweng.cn
  • 47.103.45.17
malicious

Threats

PID
Process
Class
Message
1024
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://down10.zol.com.cn/zoldownload/1.0beta_115464@81_420899.exe