File name:

file

Full analysis: https://app.any.run/tasks/093b13c9-2ea4-4ce2-ad8b-e2626ebcffcd
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 28, 2023, 16:43:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealer
vidar
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4C1BBE87EE4AB42478C8D11E5BB42EBF

SHA1:

01911B9C7B596872D3BF53CD6924C7F917799D90

SHA256:

C9E867DA8945ACE03FFFB15FB6C8B73E556131B3E7CEB652EC2F3E36BC26CA66

SSDEEP:

98304:mKVgqRNSUVpJgLtclkBCY+2vE79BjrQ/L9nV/7mLY3B31Vs3P3fOj:mZ2NSiJcculwTExV/7p3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • file.exe (PID: 1352)

    • VIDAR was detected

      • file.exe (PID: 1352)

    • Steals credentials

      • file.exe (PID: 1352)

    • Steals credentials from Web Browsers

      • file.exe (PID: 1352)

    • Application was dropped or rewritten from another process

      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • Uses Task Scheduler to run other applications

      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • Loads dropped or rewritten executable

      • file.exe (PID: 1352)

    • Actions looks like stealing of personal data

      • file.exe (PID: 1352)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • file.exe (PID: 1352)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 1352)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • file.exe (PID: 1352)

    • Reads the Internet Settings

      • file.exe (PID: 1352)

    • Reads browser cookies

      • file.exe (PID: 1352)

    • Connects to unusual port

      • file.exe (PID: 1352)

    • Checks Windows Trust Settings

      • file.exe (PID: 1352)

    • Executable content was dropped or overwritten

      • file.exe (PID: 1352)
      • 17395231237578275824.exe (PID: 2964)

    • Searches for installed software

      • file.exe (PID: 1352)

    • Reads the BIOS version

      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • The process executes via Task Scheduler

      • oobeldr.exe (PID: 2724)

  • INFO

    • Checks supported languages

      • file.exe (PID: 1352)
      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • Reads the machine GUID from the registry

      • file.exe (PID: 1352)

    • Checks proxy server information

      • file.exe (PID: 1352)

    • Reads the computer name

      • file.exe (PID: 1352)

    • The process checks LSA protection

      • file.exe (PID: 1352)

    • Creates files in the program directory

      • file.exe (PID: 1352)

    • Creates files or folders in the user directory

      • file.exe (PID: 1352)
      • 17395231237578275824.exe (PID: 2964)

    • Reads product name

      • file.exe (PID: 1352)

    • Reads Environment values

      • file.exe (PID: 1352)

    • Reads CPU info

      • file.exe (PID: 1352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

SpecialBuild: 3, 1, 0, 0
ProductVersion: 3, 1, 0, 0
ProductName: Nero BackItUp
PrivateBuild: -
OriginalFileName: NBService.EXE
LegalTrademarks: -
LegalCopyright: Copyright (c) 2003-2007 Nero AG and its licensors
InternalName: Nero BackItUp
FileVersion: 3, 1, 0, 0
FileDescription: Nero BackItUp
CompanyName: Nero AG
Comments: Create backups of selected files/folders/partitions/complete hard disk to hard disk, network drive, CD/DVD or FTP.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: Special build
FileFlagsMask: 0x003f
ProductVersionNumber: 3.1.0.0
FileVersionNumber: 3.1.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x4c1c6d
UninitializedDataSize: -
InitializedDataSize: 727040
CodeSize: 258048
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:05:22 12:21:52+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 22-May-2023 12:21:52
Detected languages:
  • English - United States
Comments: Create backups of selected files/folders/partitions/complete hard disk to hard disk, network drive, CD/DVD or FTP.
CompanyName: Nero AG
FileDescription: Nero BackItUp
FileVersion: 3, 1, 0, 0
InternalName: Nero BackItUp
LegalCopyright: Copyright (c) 2003-2007 Nero AG and its licensors
LegalTrademarks: -
OriginalFilename: NBService.EXE
PrivateBuild: -
ProductName: Nero BackItUp
ProductVersion: 3, 1, 0, 0
SpecialBuild: 3, 1, 0, 0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 22-May-2023 12:21:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0003EE35
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.rdata
0x00040000
0x0000E084
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
.data
0x0004F000
0x00017AA4
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.vmp:0
0x00067000
0x001BED03
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.vmp:1
0x00226000
0x0000034C
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.417766
.vmp:2
0x00227000
0x003DD6D0
0x003DD800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.90468
.reloc
0x00605000
0x00000590
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.15994
.rsrc
0x00606000
0x000860F4
0x00086200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.06864

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10064
784
UNKNOWN
English - United States
RT_MANIFEST
2
2.888
10344
UNKNOWN
English - United States
RT_ICON
3
2.677
2664
UNKNOWN
English - United States
RT_ICON
4
2.74285
1640
UNKNOWN
English - United States
RT_ICON
5
2.95023
744
UNKNOWN
English - United States
RT_ICON
6
2.91242
488
UNKNOWN
English - United States
RT_ICON
7
0
132
UNKNOWN
English - United States
RT_STRING
8
3.7109
74792
UNKNOWN
English - United States
RT_ICON
9
4.22609
19496
UNKNOWN
English - United States
RT_ICON
10
4.65568
5672
UNKNOWN
English - United States
RT_ICON

Imports

CRYPT32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start #VIDAR file.exe 17395231237578275824.exe schtasks.exe no specs oobeldr.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1352"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Company:
Nero AG
Integrity Level:
MEDIUM
Description:
Nero BackItUp
Exit code:
0
Version:
3, 1, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2124/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\SysWOW64\schtasks.exe—17395231237578275824.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2724C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe—taskeng.exe
User:
admin
Company:
Ben Adams
Integrity Level:
MEDIUM
Description:
Ben.Demystifier
Exit code:
0
Version:
0.4.0.2
Modules
Images
c:\users\admin\appdata\roaming\microsoft\protect\oobeldr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2904/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\SysWOW64\schtasks.exe—oobeldr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wow64.dll
c:\windows\syswow64\schtasks.exe
c:\windows\system32\wow64win.dll
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2964"C:\ProgramData\17395231237578275824.exe" C:\ProgramData\17395231237578275824.exe
file.exe
User:
admin
Company:
Ben Adams
Integrity Level:
MEDIUM
Description:
Ben.Demystifier
Exit code:
4294967295
Version:
0.4.0.2
Modules
Images
c:\programdata\17395231237578275824.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
984
Read events
967
Write events
17
Delete events
0

Modification events

(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1352) file.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
9
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1352file.exeC:\ProgramData\vcruntime140.dllexecutable
MD5:A37EE36B536409056A86F50E67777DD7
SHA256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
1352file.exeC:\ProgramData\nss3.dllexecutable
MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
SHA256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
1352file.exeC:\ProgramData\68218634943156727208865055-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1352file.exeC:\ProgramData\17395231237578275824.exeexecutable
MD5:8B91589D7D7877B6469FC4647617A611
SHA256:D532320CCB771301D3B9D6C0B0048ED776B1020C4480DC736163298C8AC4AB26
1352file.exeC:\ProgramData\20622532352887454785033989binary
MD5:B6AC860E0B054140F65635EE09CCBC18
SHA256:1A6F576BFEBB88FE0E466014032BBD070268D11EB431E9106EE9CA5795A2EF44
1352file.exeC:\ProgramData\68218634943156727208865055binary
MD5:FF3819BA79CA33058AB110FEC5CD0955
SHA256:C5140A31EA483E1E6AFE2A2750B853FA46FA3C5B0A04C973094E23E6C8AD533E
1352file.exeC:\ProgramData\85067601314872861917952364binary
MD5:C72DB02959D2F97D090B0051EE963AD7
SHA256:6D8285E102CD46A9379778B223651ECEE043321E436DD15C2354EC59F5EB22A5
1352file.exeC:\ProgramData\16739020384816628317219460binary
MD5:B6AC860E0B054140F65635EE09CCBC18
SHA256:1A6F576BFEBB88FE0E466014032BBD070268D11EB431E9106EE9CA5795A2EF44
1352file.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CQTGLU80.txttext
MD5:1EFCC91A2D1A6553F1ADBCE97E36978E
SHA256:410F19903D7F5144CC7D0CF76BAF65E5DDD9BCC1595863F4188FD7D17D5B3CBD
1352file.exeC:\ProgramData\20316496325608084132937601binary
MD5:387B1D63B45DA12EE4D0C68A9E777271
SHA256:40BD4B959B25DBF4D65864B92F548C5373C12FC7EF99FE70A9BE479A90FBF0D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
2
Threats
229

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1352
file.exe
GET
200
188.34.154.187:30303
http://188.34.154.187:30303/bf57fe2fae2974604afc18ab750c7063
DE
text
136 b
malicious
1352
file.exe
GET
200
188.34.154.187:30303
http://188.34.154.187:30303/addon.zip
DE
compressed
2.56 Mb
malicious
1352
file.exe
POST
200
188.34.154.187:30303
http://188.34.154.187:30303/
DE
text
89 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1352
file.exe
188.34.154.187:30303
—
Hetzner Online GmbH
DE
malicious
1352
file.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
malicious
1352
file.exe
162.159.134.233:443
cdn.discordapp.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
t.me
  • 149.154.167.99
whitelisted
cdn.discordapp.com
  • 162.159.134.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.130.233
  • 162.159.129.233
shared

Threats

PID
Process
Class
Message
1352
file.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
1352
file.exe
A Network Trojan was detected
STEALER [ANY.RUN] Stealerc/Arkei
1352
file.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host ZIP Request
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
2 ETPRO signatures available at the full report
No debug info