File name:

file

Full analysis: https://app.any.run/tasks/093b13c9-2ea4-4ce2-ad8b-e2626ebcffcd
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 28, 2023, 16:43:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealer
vidar
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4C1BBE87EE4AB42478C8D11E5BB42EBF

SHA1:

01911B9C7B596872D3BF53CD6924C7F917799D90

SHA256:

C9E867DA8945ACE03FFFB15FB6C8B73E556131B3E7CEB652EC2F3E36BC26CA66

SSDEEP:

98304:mKVgqRNSUVpJgLtclkBCY+2vE79BjrQ/L9nV/7mLY3B31Vs3P3fOj:mZ2NSiJcculwTExV/7p3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • file.exe (PID: 1352)

    • VIDAR was detected

      • file.exe (PID: 1352)

    • Steals credentials from Web Browsers

      • file.exe (PID: 1352)

    • Steals credentials

      • file.exe (PID: 1352)

    • Loads dropped or rewritten executable

      • file.exe (PID: 1352)

    • Application was dropped or rewritten from another process

      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • Uses Task Scheduler to run other applications

      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • Actions looks like stealing of personal data

      • file.exe (PID: 1352)

  • SUSPICIOUS

    • Reads the Internet Settings

      • file.exe (PID: 1352)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 1352)

    • Reads settings of System Certificates

      • file.exe (PID: 1352)

    • Checks Windows Trust Settings

      • file.exe (PID: 1352)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • file.exe (PID: 1352)

    • Reads browser cookies

      • file.exe (PID: 1352)

    • Executable content was dropped or overwritten

      • file.exe (PID: 1352)
      • 17395231237578275824.exe (PID: 2964)

    • Connects to unusual port

      • file.exe (PID: 1352)

    • Searches for installed software

      • file.exe (PID: 1352)

    • The process executes via Task Scheduler

      • oobeldr.exe (PID: 2724)

    • Reads the BIOS version

      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

  • INFO

    • Reads the computer name

      • file.exe (PID: 1352)

    • Checks supported languages

      • file.exe (PID: 1352)
      • 17395231237578275824.exe (PID: 2964)
      • oobeldr.exe (PID: 2724)

    • Reads the machine GUID from the registry

      • file.exe (PID: 1352)

    • The process checks LSA protection

      • file.exe (PID: 1352)

    • Checks proxy server information

      • file.exe (PID: 1352)

    • Creates files or folders in the user directory

      • file.exe (PID: 1352)
      • 17395231237578275824.exe (PID: 2964)

    • Creates files in the program directory

      • file.exe (PID: 1352)

    • Reads Environment values

      • file.exe (PID: 1352)

    • Reads CPU info

      • file.exe (PID: 1352)

    • Reads product name

      • file.exe (PID: 1352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

SpecialBuild: 3, 1, 0, 0
ProductVersion: 3, 1, 0, 0
ProductName: Nero BackItUp
PrivateBuild: -
OriginalFileName: NBService.EXE
LegalTrademarks: -
LegalCopyright: Copyright (c) 2003-2007 Nero AG and its licensors
InternalName: Nero BackItUp
FileVersion: 3, 1, 0, 0
FileDescription: Nero BackItUp
CompanyName: Nero AG
Comments: Create backups of selected files/folders/partitions/complete hard disk to hard disk, network drive, CD/DVD or FTP.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: Special build
FileFlagsMask: 0x003f
ProductVersionNumber: 3.1.0.0
FileVersionNumber: 3.1.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x4c1c6d
UninitializedDataSize: -
InitializedDataSize: 727040
CodeSize: 258048
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:05:22 12:21:52+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 22-May-2023 12:21:52
Detected languages:
  • English - United States
Comments: Create backups of selected files/folders/partitions/complete hard disk to hard disk, network drive, CD/DVD or FTP.
CompanyName: Nero AG
FileDescription: Nero BackItUp
FileVersion: 3, 1, 0, 0
InternalName: Nero BackItUp
LegalCopyright: Copyright (c) 2003-2007 Nero AG and its licensors
LegalTrademarks: -
OriginalFilename: NBService.EXE
PrivateBuild: -
ProductName: Nero BackItUp
ProductVersion: 3, 1, 0, 0
SpecialBuild: 3, 1, 0, 0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 22-May-2023 12:21:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0003EE35
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.rdata
0x00040000
0x0000E084
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
.data
0x0004F000
0x00017AA4
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.vmp:0
0x00067000
0x001BED03
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.vmp:1
0x00226000
0x0000034C
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.417766
.vmp:2
0x00227000
0x003DD6D0
0x003DD800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.90468
.reloc
0x00605000
0x00000590
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.15994
.rsrc
0x00606000
0x000860F4
0x00086200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.06864

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10064
784
UNKNOWN
English - United States
RT_MANIFEST
2
2.888
10344
UNKNOWN
English - United States
RT_ICON
3
2.677
2664
UNKNOWN
English - United States
RT_ICON
4
2.74285
1640
UNKNOWN
English - United States
RT_ICON
5
2.95023
744
UNKNOWN
English - United States
RT_ICON
6
2.91242
488
UNKNOWN
English - United States
RT_ICON
7
0
132
UNKNOWN
English - United States
RT_STRING
8
3.7109
74792
UNKNOWN
English - United States
RT_ICON
9
4.22609
19496
UNKNOWN
English - United States
RT_ICON
10
4.65568
5672
UNKNOWN
English - United States
RT_ICON

Imports

CRYPT32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start #VIDAR file.exe 17395231237578275824.exe schtasks.exe no specs oobeldr.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1352"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Company:
Nero AG
Integrity Level:
MEDIUM
Description:
Nero BackItUp
Exit code:
0
Version:
3, 1, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2124/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\SysWOW64\schtasks.exe—17395231237578275824.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2724C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe—taskeng.exe
User:
admin
Company:
Ben Adams
Integrity Level:
MEDIUM
Description:
Ben.Demystifier
Exit code:
0
Version:
0.4.0.2
Modules
Images
c:\users\admin\appdata\roaming\microsoft\protect\oobeldr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2904/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\SysWOW64\schtasks.exe—oobeldr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wow64.dll
c:\windows\syswow64\schtasks.exe
c:\windows\system32\wow64win.dll
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2964"C:\ProgramData\17395231237578275824.exe" C:\ProgramData\17395231237578275824.exe
file.exe
User:
admin
Company:
Ben Adams
Integrity Level:
MEDIUM
Description:
Ben.Demystifier
Exit code:
4294967295
Version:
0.4.0.2
Modules
Images
c:\programdata\17395231237578275824.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
984
Read events
967
Write events
17
Delete events
0

Modification events

(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1352) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1352) file.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
9
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1352file.exeC:\ProgramData\17395231237578275824.exeexecutable
MD5:8B91589D7D7877B6469FC4647617A611
SHA256:D532320CCB771301D3B9D6C0B0048ED776B1020C4480DC736163298C8AC4AB26
1352file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\KLIPE[1].exeexecutable
MD5:8B91589D7D7877B6469FC4647617A611
SHA256:D532320CCB771301D3B9D6C0B0048ED776B1020C4480DC736163298C8AC4AB26
1352file.exeC:\ProgramData\mozglue.dllexecutable
MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
1352file.exeC:\ProgramData\85067601314872861917952364binary
MD5:C72DB02959D2F97D090B0051EE963AD7
SHA256:6D8285E102CD46A9379778B223651ECEE043321E436DD15C2354EC59F5EB22A5
1352file.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\UN7TSTBY.txttext
MD5:D43EC84E1A06374539B5A27A9BDE84CB
SHA256:F3AEABE791DB9288BA09E2566A4DAA3041056A205E4BA2C083A75F4409F8DCCC
1352file.exeC:\ProgramData\20622532352887454785033989binary
MD5:B6AC860E0B054140F65635EE09CCBC18
SHA256:1A6F576BFEBB88FE0E466014032BBD070268D11EB431E9106EE9CA5795A2EF44
296417395231237578275824.exeC:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeexecutable
MD5:8B91589D7D7877B6469FC4647617A611
SHA256:D532320CCB771301D3B9D6C0B0048ED776B1020C4480DC736163298C8AC4AB26
1352file.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CQTGLU80.txttext
MD5:1EFCC91A2D1A6553F1ADBCE97E36978E
SHA256:410F19903D7F5144CC7D0CF76BAF65E5DDD9BCC1595863F4188FD7D17D5B3CBD
1352file.exeC:\ProgramData\msvcp140.dllexecutable
MD5:5FF1FCA37C466D6723EC67BE93B51442
SHA256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
1352file.exeC:\ProgramData\freebl3.dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
2
Threats
229

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1352
file.exe
GET
200
188.34.154.187:30303
http://188.34.154.187:30303/addon.zip
DE
compressed
2.56 Mb
malicious
1352
file.exe
GET
200
188.34.154.187:30303
http://188.34.154.187:30303/bf57fe2fae2974604afc18ab750c7063
DE
text
136 b
malicious
1352
file.exe
POST
200
188.34.154.187:30303
http://188.34.154.187:30303/
DE
text
89 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1352
file.exe
188.34.154.187:30303
—
Hetzner Online GmbH
DE
malicious
1352
file.exe
162.159.134.233:443
cdn.discordapp.com
CLOUDFLARENET
—
shared
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1352
file.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
malicious

DNS requests

Domain
IP
Reputation
t.me
  • 149.154.167.99
whitelisted
cdn.discordapp.com
  • 162.159.134.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.130.233
  • 162.159.129.233
shared

Threats

PID
Process
Class
Message
1352
file.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
1352
file.exe
A Network Trojan was detected
STEALER [ANY.RUN] Stealerc/Arkei
1352
file.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host ZIP Request
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1352
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
2 ETPRO signatures available at the full report
No debug info