File name:

blok_supreme_lite_x86.zip

Full analysis: https://app.any.run/tasks/0c353e1e-d44b-4880-8590-35770104cec4
Verdict: Malicious activity
Analysis date: December 23, 2020, 13:31:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9F5C03701CE4B5B1C8CDBB065F9AF81B

SHA1:

6B60AEB2F68B5B649B8AEF9498BE0C5B46E89155

SHA256:

CD0C38FAA7BEA043C5DBA4BC6261CA358625171623EBE17CA6086E18B3433878

SSDEEP:

393216:Jc6e2kyJITbuoc8ho+7drRnyx8RY3IignsoQ4N:JcuJITKo3oydrRyQ0gJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • blok_supreme_lite_x86.exe (PID: 2152)
      • nbmss.exe (PID: 3916)
      • nbhss.exe (PID: 4028)

    • Application was dropped or rewritten from another process

      • ins.exe (PID: 1804)
      • blok_supreme_lite_x86.exe (PID: 3108)
      • ins.exe (PID: 1252)
      • eme.exe (PID: 3604)
      • blok_supreme_lite_x86.exe (PID: 2152)
      • eme.exe (PID: 3888)
      • eme.exe (PID: 676)
      • nbmss.exe (PID: 2960)
      • nbmss.exe (PID: 3916)
      • nbblo.exe (PID: 3100)
      • nbmon.exe (PID: 3612)
      • nbhss.exe (PID: 4028)
      • nbhss.exe (PID: 2584)
      • nbage.exe (PID: 2100)
      • cfg.exe (PID: 3572)

    • Changes the login/logoff helper path in the registry

      • nbmss.exe (PID: 3916)

    • Loads dropped or rewritten executable

      • nbhss.exe (PID: 4028)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ins.exe (PID: 1804)
      • ins.exe (PID: 1252)
      • nbhss.exe (PID: 4028)
      • nbmss.exe (PID: 3916)
      • blok_supreme_lite_x86.exe (PID: 2152)

    • Reads Environment values

      • eme.exe (PID: 676)
      • blok_supreme_lite_x86.exe (PID: 2152)
      • ins.exe (PID: 1804)
      • eme.exe (PID: 3604)
      • eme.exe (PID: 3888)
      • nbmss.exe (PID: 2960)
      • ins.exe (PID: 1252)
      • nbmss.exe (PID: 3916)
      • nbhss.exe (PID: 2584)
      • nbhss.exe (PID: 4028)
      • nbblo.exe (PID: 3100)
      • nbage.exe (PID: 2100)
      • nbmon.exe (PID: 3612)
      • cfg.exe (PID: 3572)

    • Executed as Windows Service

      • eme.exe (PID: 676)
      • nbmss.exe (PID: 3916)
      • nbhss.exe (PID: 4028)

    • Removes files from Windows directory

      • ins.exe (PID: 1252)

    • Creates a directory in Program Files

      • ins.exe (PID: 1252)

    • Creates files in the program directory

      • ins.exe (PID: 1252)
      • nbmss.exe (PID: 3916)
      • nbhss.exe (PID: 4028)

    • Creates files in the Windows directory

      • ins.exe (PID: 1252)
      • nbmss.exe (PID: 3916)
      • ins.exe (PID: 1804)

    • Drops a file that was compiled in debug mode

      • nbhss.exe (PID: 4028)

    • Starts CMD.EXE for commands execution

      • ins.exe (PID: 1252)

    • Creates or modifies windows services

      • nbmss.exe (PID: 3916)
      • nbhss.exe (PID: 4028)

  • INFO

    • Manual execution by user

      • blok_supreme_lite_x86.exe (PID: 3108)
      • blok_supreme_lite_x86.exe (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:10:08 10:12:24
ZipCRC: 0x57206858
ZipCompressedSize: 15545092
ZipUncompressedSize: 16973720
ZipFileName: blok_supreme_lite_x86.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
17
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs blok_supreme_lite_x86.exe no specs blok_supreme_lite_x86.exe ins.exe eme.exe no specs eme.exe no specs ins.exe eme.exe no specs nbmss.exe no specs nbmss.exe nbhss.exe no specs nbhss.exe nbblo.exe nbmon.exe nbage.exe cmd.exe no specs cfg.exe

Process information

PID
CMD
Path
Indicators
Parent process
676C:\windows\semev1\eme.exeC:\windows\semev1\eme.exe—services.exe
User:
SYSTEM
Company:
Gamsoft
Integrity Level:
SYSTEM
Description:
NbEme
Exit code:
0
Version:
1.0.0.33
Modules
Images
c:\windows\semev1\eme.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1252c:\users\admin\appdata\local\temp\nbains\ins.exe emestartc:\users\admin\appdata\local\temp\nbains\ins.exe
eme.exe
User:
SYSTEM
Company:
Gamsoft
Integrity Level:
SYSTEM
Description:
Blok Supreme Lite - Instalação
Exit code:
1
Version:
1.0.0.33
Modules
Images
c:\users\admin\appdata\local\temp\nbains\ins.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1804"C:\Users\admin\AppData\Local\Temp\nbains\ins.exe" C:\Users\admin\AppData\Local\Temp\nbains\ins.exe
blok_supreme_lite_x86.exe
User:
admin
Company:
Gamsoft
Integrity Level:
HIGH
Description:
Blok Supreme Lite - Instalação
Exit code:
0
Version:
1.0.0.33
Modules
Images
c:\users\admin\appdata\local\temp\nbains\ins.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1972cmd /c ""C:\users\admin\appdata\local\temp\nbains\nkudw.bat" "C:\Windows\system32\cmd.exe—ins.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2100"c:\program files\snba\nbage.exe"c:\program files\snba\nbage.exe
nbmss.exe
User:
admin
Company:
Gamsoft
Integrity Level:
MEDIUM
Description:
iAge Module
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\snba\nbage.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2152"C:\Users\admin\Desktop\blok_supreme_lite_x86.exe" C:\Users\admin\Desktop\blok_supreme_lite_x86.exe
explorer.exe
User:
admin
Company:
Gamsoft
Integrity Level:
HIGH
Description:
Blok Supreme Lite - Instalação
Exit code:
0
Version:
1.0.0.33
Modules
Images
c:\users\admin\desktop\blok_supreme_lite_x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2584"C:\program files\snba\nbhss.exe" /install /silentC:\program files\snba\nbhss.exe—nbmss.exe
User:
SYSTEM
Company:
Gamsoft
Integrity Level:
SYSTEM
Description:
Snb Hss
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\snba\nbhss.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2960"C:\program files\snba\nbmss.exe" /install /silentC:\program files\snba\nbmss.exe—ins.exe
User:
SYSTEM
Company:
Gamsoft
Integrity Level:
SYSTEM
Description:
Snb Mss
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\snba\nbmss.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3012"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\blok_supreme_lite_x86.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3100"c:\program files\snba\nbblo.exe"c:\program files\snba\nbblo.exe
nbmss.exe
User:
admin
Company:
Gamsoft
Integrity Level:
MEDIUM
Description:
User b module
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\snba\nbblo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
5 948
Read events
1 587
Write events
4 360
Delete events
1

Modification events

(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3012) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\blok_supreme_lite_x86.zip
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3012) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
20
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3012.14308\blok_supreme_lite_x86.exe —
MD5:—
SHA256:—
2152blok_supreme_lite_x86.exeC:\Users\admin\AppData\Local\Temp\nbains\if.nb1r —
MD5:—
SHA256:—
2152blok_supreme_lite_x86.exeC:\Users\admin\AppData\Local\Temp\nbains\mssexecutable
MD5:—
SHA256:—
2152blok_supreme_lite_x86.exeC:\Users\admin\AppData\Local\Temp\nbains\ins.exeexecutable
MD5:—
SHA256:—
1252ins.exeC:\program files\snba\nbmss.exeexecutable
MD5:—
SHA256:—
2152blok_supreme_lite_x86.exeC:\Users\admin\AppData\Local\Temp\nbains\staexecutable
MD5:—
SHA256:—
1804ins.exeC:\windows\semev1\emeinftext
MD5:—
SHA256:—
1804ins.exeC:\windows\semev1\eme.exeexecutable
MD5:—
SHA256:—
1252ins.exeC:\users\admin\appdata\local\temp\nbains\nkudw.bat —
MD5:—
SHA256:—
1252ins.exeC:\program files\tnba\cfg.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3572
cfg.exe
GET
200
187.17.111.35:80
http://www.gamsoft.com.br/pt-br/vslite/sys/msgs32.php?v=21
BR
text
302 b
malicious
3572
cfg.exe
GET
200
187.17.111.35:80
http://www.gamsoft.com.br/pt-br/vslite/sys/msgs32.php?v=21
BR
text
302 b
malicious
3572
cfg.exe
GET
—
187.17.111.35:80
http://www.gamsoft.com.br/pt-br/vslite/sys/msgs32.php?v=21
BR
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
cfg.exe
187.17.111.35:80
www.gamsoft.com.br
Universo Online S.A.
BR
malicious
1252
ins.exe
200.160.7.186:123
a.st1.ntp.br
Núcleo de Inf. e Coord. do Ponto BR - NIC.
BR
unknown

DNS requests

Domain
IP
Reputation
a.st1.ntp.br
  • 200.160.7.186
unknown
www.gamsoft.com.br
  • 187.17.111.35
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
blok_supreme_lite_x86.zip