analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | CLodop_Setup_for_Win32NT_4.102.exe |
| Full analysis: | https://app.any.run/tasks/7b1ae710-8b84-45c9-bda3-6c49a160490a |
| Verdict: | Malicious activity |
| Threats: | Metamorfo is a trojan malware family that has been active since 2018. It remains a top threat, focusing on stealing victims’ financial information, including banking credentials and other data. The malware is known for targeting users in Brazil. |
| Analysis date: | December 05, 2023 at 15:58:44 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | A05746DDB5E9034297CDF60A093F5E60 |
| SHA1: | 531C8A60AF53249570925AC45BAA0D6B5B4BEC4D |
| SHA256: | D5C0CF0953687C85629E6451E00B0A0CC17549894B365795921301A44FC2FF76 |
| SSDEEP: | 98304:BCKHdWhqxR/sezSNh/aopjkZglcczIdMH4kGHGnYBTrYqPC:eEYe+NgoHlcc02Y/SMTVC |
MALICIOUS
Drops the executable file immediately after the start
- CLodop_Setup_for_Win32NT_4.102.exe (PID: 2780)
- CLodopPrint32.exe (PID: 2076)
- is-VKN0P.tmp (PID: 2628)
METAMORFO has been detected (YARA)
- CLodopPrint32.exe (PID: 2076)
- CLodopPrint32_backup.exe (PID: 3996)
- CLodopPrint32.exe (PID: 4032)
- CLodopPrint32_backup.exe (PID: 1936)
SUSPICIOUS
Process drops legitimate windows executable
- is-VKN0P.tmp (PID: 2628)
Reads the Internet Settings
- CLodopPrint32.exe (PID: 2076)
- CLodopPrint32.exe (PID: 4032)
Reads the Windows owner or organization settings
- is-VKN0P.tmp (PID: 2628)
Executes as Windows Service
- CLodopService32.exe (PID: 2532)
The process drops C-runtime libraries
- is-VKN0P.tmp (PID: 2628)
Starts itself from another location
- CLodopPrint32.exe (PID: 2076)
- CLodopPrint32.exe (PID: 4032)
Changes Internet Explorer settings (feature browser emulation)
- CLodopPrint32.exe (PID: 4032)
INFO
Checks supported languages
- CLodop_Setup_for_Win32NT_4.102.exe (PID: 2780)
- is-VKN0P.tmp (PID: 2628)
- CLodopService32.exe (PID: 1560)
- CLodopPrint32.exe (PID: 2076)
- CLodopService32.exe (PID: 2532)
- wmpnscfg.exe (PID: 1860)
- CLodopPrint32_backup.exe (PID: 3996)
- CLodopPrint32.exe (PID: 4032)
- CLodopPrint32_backup.exe (PID: 1936)
Reads the computer name
- is-VKN0P.tmp (PID: 2628)
- CLodopService32.exe (PID: 1560)
- CLodopPrint32.exe (PID: 2076)
- CLodopService32.exe (PID: 2532)
- wmpnscfg.exe (PID: 1860)
- CLodopPrint32_backup.exe (PID: 3996)
- CLodopPrint32.exe (PID: 4032)
- CLodopPrint32_backup.exe (PID: 1936)
Create files in a temporary directory
- is-VKN0P.tmp (PID: 2628)
- CLodop_Setup_for_Win32NT_4.102.exe (PID: 2780)
- CLodopPrint32.exe (PID: 2076)
Creates files in the program directory
- CLodopPrint32.exe (PID: 2076)
- is-VKN0P.tmp (PID: 2628)
Manual execution by a user
- wmpnscfg.exe (PID: 1860)
- WINWORD.EXE (PID: 1296)
- CLodopPrint32.exe (PID: 4032)
- WINWORD.EXE (PID: 3380)
- WINWORD.EXE (PID: 3560)
Reads the machine GUID from the registry
- CLodopPrint32.exe (PID: 2076)
- CLodopPrint32.exe (PID: 4032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (77.7) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.6) |
| .exe | | | Win32 Executable (generic) (3.1) |
| .exe | | | Win16/32 Executable Delphi generic (1.4) |
EXIF
EXE
| LegalCopyright: | |
|---|---|
| FileVersion: | 4.1.0.4 |
| FileDescription: | C-Lodop(32-bit) Setup |
| CompanyName: | MTSoftware(CN) |
| Comments: | 此安装程序由 Inno Setup 构建。 |
| CharacterSet: | ASCII |
| LanguageCode: | Chinese (Simplified) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 0.0.0.0 |
| FileVersionNumber: | 4.1.0.4 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 1 |
| EntryPoint: | 0x97f8 |
| UninitializedDataSize: | - |
| InitializedDataSize: | 15872 |
| CodeSize: | 36864 |
| LinkerVersion: | 2.25 |
| PEType: | PE32 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| TimeStamp: | 1992:06:20 00:22:17+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Total processes
63
Monitored processes
16
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2980 | "C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe" | C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe | — | explorer.exe | |||||||||||
User: admin Company: MTSoftware(CN) Integrity Level: MEDIUM Description: C-Lodop(32-bit) Setup Exit code: 3221226540 Version: 4.1.0.4 Modules
| |||||||||||||||
| 2780 | "C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe" | C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe | explorer.exe | ||||||||||||
User: admin Company: MTSoftware(CN) Integrity Level: HIGH Description: C-Lodop(32-bit) Setup Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
| 2628 | "C:\Users\admin\AppData\Local\Temp\is-47C1I.tmp\is-VKN0P.tmp" /SL4 $26013A "C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe" 4302233 51200 | C:\Users\admin\AppData\Local\Temp\is-47C1I.tmp\is-VKN0P.tmp | — | CLodop_Setup_for_Win32NT_4.102.exe | |||||||||||
User: admin Integrity Level: HIGH Description: 安装/卸载 Exit code: 0 Version: 51.46.0.0 Modules
| |||||||||||||||
| 2076 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe" setup_noauto | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe | is-VKN0P.tmp | ||||||||||||
User: admin Company: （中国）梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: Web打印服务C-Lodop Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
| 1560 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe" -INSTALL -SILENT | C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe | — | CLodopPrint32.exe | |||||||||||
User: admin Company: （中国）梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: C-Lodop 云打印“免登录”启动服务 Exit code: 0 Version: 3.0.0.5 Modules
| |||||||||||||||
| 2532 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe" | C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe | — | services.exe | |||||||||||
User: SYSTEM Company: （中国）梦泰尔软件 MTSoftware(CN) Integrity Level: SYSTEM Description: C-Lodop 云打印“免登录”启动服务 Version: 3.0.0.5 Modules
| |||||||||||||||
| 2108 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe" | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe | — | CLodopPrint32.exe | |||||||||||
User: admin Company: （中国）梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: Web打印服务C-Lodop Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
| 1860 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3996 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe" | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe | CLodopPrint32.exe | ||||||||||||
User: admin Company: （中国）梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: Web打印服务C-Lodop Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
| 1296 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\threecoast.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
Total events
8 954
Read events
8 378
Write events
139
Delete events
437
Modification events
| (PID) Process: | (2628) is-VKN0P.tmp | Key: | HKEY_CURRENT_USER\Software\MountTaiSoftware\C-Lodop |
| Operation: | write | Name: | OnlyLocalPrint |
Value: false | |||
| (PID) Process: | (2628) is-VKN0P.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\MountTaiSoftware\C-Lodop |
| Operation: | write | Name: | OnlyLocalPrint |
Value: false | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol |
| Operation: | write | Name: | URL Protocol |
Value: | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
| Operation: | write | Name: | ApplicationName |
Value: Web打印服务C-Lodop | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
| Operation: | write | Name: | ApplicationCompany |
Value: MTSoftware | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
| Operation: | write | Name: | ApplicationDescription |
Value: Web打印服务C-Lodop | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
| Operation: | write | Name: | ApplicationIcon |
Value: C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe,0 | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
Executable files
20
Suspicious files
26
Text files
128
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2628 | is-VKN0P.tmp | C:\Users\admin\AppData\Local\Temp\is-IM0D7.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\SSL\is-O66B1.tmp | — | |
MD5:— | SHA256:— | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\is-7M90I.tmp | executable | |
MD5:67EC459E42D3081DD8FD34356F7CAFC1 | SHA256:1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067 | |||
| 2628 | is-VKN0P.tmp | C:\Users\admin\AppData\Local\Temp\is-IM0D7.tmp\_isetup\_RegDLL.tmp | executable | |
MD5:C594B792B9C556EA62A30DE541D2FB03 | SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E | |||
| 2780 | CLodop_Setup_for_Win32NT_4.102.exe | C:\Users\admin\AppData\Local\Temp\is-47C1I.tmp\is-VKN0P.tmp | executable | |
MD5:79551E7F460CE4A92B6C9C0F0B714108 | SHA256:06AE7ABCEC424F92569CD67E55E27C7E91F84F6108F91876CD3F135262341BEF | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\is-CNGR9.tmp | executable | |
MD5:E479394A699363D869DB4B12E135FA4B | SHA256:36C6757A0277A98E1E07E52065A67CF8B06C75E109EAB509533290D79C929DF5 | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe | executable | |
MD5:D2FB89B2FF3316182A5AF04C2AD79115 | SHA256:C5990D0C4FFB1DA0EF5916A629D3F12730703F8468E60CF203712A0C4EE4D47B | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\SSL\is-E8NRN.tmp | text | |
MD5:0BB817F7F127CAA8C30D7A966143F9F6 | SHA256:A3CE0046AA1EBD6A8D2C3488B0907DD12A83C35C8CE6AB72E48CBFDBC2C9842E | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\is-9M4B1.tmp | executable | |
MD5:D2FB89B2FF3316182A5AF04C2AD79115 | SHA256:C5990D0C4FFB1DA0EF5916A629D3F12730703F8468E60CF203712A0C4EE4D47B | |||
| 2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\SSL\localhost_c.key | text | |
MD5:0BB817F7F127CAA8C30D7A966143F9F6 | SHA256:A3CE0046AA1EBD6A8D2C3488B0907DD12A83C35C8CE6AB72E48CBFDBC2C9842E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
2
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2076 | CLodopPrint32.exe | GET | — | 121.196.197.102:80 | http://ssl.lodop.net/localhost_c.pem | unknown | — | — | — |
2076 | CLodopPrint32.exe | GET | 200 | 121.196.197.102:80 | http://ssl.lodop.net/localhost_c.key | unknown | text | 1.73 Kb | — |
2076 | CLodopPrint32.exe | GET | 200 | 121.196.197.102:80 | http://ssl.lodop.net/localhost_c_date | unknown | text | 10 b | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | unknown |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
868 | svchost.exe | 23.35.228.137:80 | — | AKAMAI-AS | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
868 | svchost.exe | 88.221.124.138:80 | armmf.adobe.com | AKAMAI-AS | DE | unknown |
2076 | CLodopPrint32.exe | 121.196.197.102:80 | ssl.lodop.net | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
armmf.adobe.com |
| unknown |
ssl.lodop.net |
| unknown |