File name: | CLodop_Setup_for_Win32NT_4.102.exe |
Full analysis: | https://app.any.run/tasks/7b1ae710-8b84-45c9-bda3-6c49a160490a |
Verdict: | Malicious activity |
Threats: | Metamorfo is a trojan malware family that has been active since 2018. It remains a top threat, focusing on stealing victims’ financial information, including banking credentials and other data. The malware is known for targeting users in Brazil. |
Analysis date: | December 05, 2023 at 15:58:44 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | A05746DDB5E9034297CDF60A093F5E60 |
SHA1: | 531C8A60AF53249570925AC45BAA0D6B5B4BEC4D |
SHA256: | D5C0CF0953687C85629E6451E00B0A0CC17549894B365795921301A44FC2FF76 |
SSDEEP: | 98304:BCKHdWhqxR/sezSNh/aopjkZglcczIdMH4kGHGnYBTrYqPC:eEYe+NgoHlcc02Y/SMTVC |
.exe | | | Inno Setup installer (77.7) |
---|---|---|
.exe | | | Win32 Executable Delphi generic (10) |
.dll | | | Win32 Dynamic Link Library (generic) (4.6) |
.exe | | | Win32 Executable (generic) (3.1) |
.exe | | | Win16/32 Executable Delphi generic (1.4) |
LegalCopyright: | |
---|---|
FileVersion: | 4.1.0.4 |
FileDescription: | C-Lodop(32-bit) Setup |
CompanyName: | MTSoftware(CN) |
Comments: | 此安装程序由 Inno Setup 构建。 |
CharacterSet: | ASCII |
LanguageCode: | Chinese (Simplified) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 0.0.0.0 |
FileVersionNumber: | 4.1.0.4 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 1 |
EntryPoint: | 0x97f8 |
UninitializedDataSize: | - |
InitializedDataSize: | 15872 |
CodeSize: | 36864 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
TimeStamp: | 1992:06:20 00:22:17+02:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2980 | "C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe" | C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe | — | explorer.exe | |||||||||||
User: admin Company: MTSoftware(CN) Integrity Level: MEDIUM Description: C-Lodop(32-bit) Setup Exit code: 3221226540 Version: 4.1.0.4 Modules
| |||||||||||||||
2780 | "C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe" | C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe | explorer.exe | ||||||||||||
User: admin Company: MTSoftware(CN) Integrity Level: HIGH Description: C-Lodop(32-bit) Setup Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
2628 | "C:\Users\admin\AppData\Local\Temp\is-47C1I.tmp\is-VKN0P.tmp" /SL4 $26013A "C:\Users\admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT_4.102.exe" 4302233 51200 | C:\Users\admin\AppData\Local\Temp\is-47C1I.tmp\is-VKN0P.tmp | — | CLodop_Setup_for_Win32NT_4.102.exe | |||||||||||
User: admin Integrity Level: HIGH Description: 安装/卸载 Exit code: 0 Version: 51.46.0.0 Modules
| |||||||||||||||
2076 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe" setup_noauto | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe | is-VKN0P.tmp | ||||||||||||
User: admin Company: (中国)梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: Web打印服务C-Lodop Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
1560 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe" -INSTALL -SILENT | C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe | — | CLodopPrint32.exe | |||||||||||
User: admin Company: (中国)梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: C-Lodop 云打印“免登录”启动服务 Exit code: 0 Version: 3.0.0.5 Modules
| |||||||||||||||
2532 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe" | C:\Program Files\MountTaiSoftware\CLodop32\CLodopService32.exe | — | services.exe | |||||||||||
User: SYSTEM Company: (中国)梦泰尔软件 MTSoftware(CN) Integrity Level: SYSTEM Description: C-Lodop 云打印“免登录”启动服务 Version: 3.0.0.5 Modules
| |||||||||||||||
2108 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe" | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe | — | CLodopPrint32.exe | |||||||||||
User: admin Company: (中国)梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: Web打印服务C-Lodop Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
1860 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3996 | "C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe" | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe | CLodopPrint32.exe | ||||||||||||
User: admin Company: (中国)梦泰尔软件 MTSoftware(CN) Integrity Level: HIGH Description: Web打印服务C-Lodop Exit code: 0 Version: 4.1.0.4 Modules
| |||||||||||||||
1296 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\threecoast.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
|
(PID) Process: | (2628) is-VKN0P.tmp | Key: | HKEY_CURRENT_USER\Software\MountTaiSoftware\C-Lodop |
Operation: | write | Name: | OnlyLocalPrint |
Value: false | |||
(PID) Process: | (2628) is-VKN0P.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\MountTaiSoftware\C-Lodop |
Operation: | write | Name: | OnlyLocalPrint |
Value: false | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol |
Operation: | write | Name: | URL Protocol |
Value: | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
Operation: | write | Name: | ApplicationName |
Value: Web打印服务C-Lodop | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
Operation: | write | Name: | ApplicationCompany |
Value: MTSoftware | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
Operation: | write | Name: | ApplicationDescription |
Value: Web打印服务C-Lodop | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLodop.protocol\Application |
Operation: | write | Name: | ApplicationIcon |
Value: C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe,0 | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2076) CLodopPrint32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2628 | is-VKN0P.tmp | C:\Users\admin\AppData\Local\Temp\is-IM0D7.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\SSL\is-O66B1.tmp | — | |
MD5:— | SHA256:— | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\is-7M90I.tmp | executable | |
MD5:67EC459E42D3081DD8FD34356F7CAFC1 | SHA256:1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067 | |||
2628 | is-VKN0P.tmp | C:\Users\admin\AppData\Local\Temp\is-IM0D7.tmp\_isetup\_RegDLL.tmp | executable | |
MD5:C594B792B9C556EA62A30DE541D2FB03 | SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E | |||
2780 | CLodop_Setup_for_Win32NT_4.102.exe | C:\Users\admin\AppData\Local\Temp\is-47C1I.tmp\is-VKN0P.tmp | executable | |
MD5:79551E7F460CE4A92B6C9C0F0B714108 | SHA256:06AE7ABCEC424F92569CD67E55E27C7E91F84F6108F91876CD3F135262341BEF | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\is-CNGR9.tmp | executable | |
MD5:E479394A699363D869DB4B12E135FA4B | SHA256:36C6757A0277A98E1E07E52065A67CF8B06C75E109EAB509533290D79C929DF5 | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\CLodopPrint32.exe | executable | |
MD5:D2FB89B2FF3316182A5AF04C2AD79115 | SHA256:C5990D0C4FFB1DA0EF5916A629D3F12730703F8468E60CF203712A0C4EE4D47B | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\SSL\is-E8NRN.tmp | text | |
MD5:0BB817F7F127CAA8C30D7A966143F9F6 | SHA256:A3CE0046AA1EBD6A8D2C3488B0907DD12A83C35C8CE6AB72E48CBFDBC2C9842E | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\is-9M4B1.tmp | executable | |
MD5:D2FB89B2FF3316182A5AF04C2AD79115 | SHA256:C5990D0C4FFB1DA0EF5916A629D3F12730703F8468E60CF203712A0C4EE4D47B | |||
2628 | is-VKN0P.tmp | C:\Program Files\MountTaiSoftware\CLodop32\SSL\localhost_c.key | text | |
MD5:0BB817F7F127CAA8C30D7A966143F9F6 | SHA256:A3CE0046AA1EBD6A8D2C3488B0907DD12A83C35C8CE6AB72E48CBFDBC2C9842E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2076 | CLodopPrint32.exe | GET | — | 121.196.197.102:80 | http://ssl.lodop.net/localhost_c.pem | unknown | — | — | — |
2076 | CLodopPrint32.exe | GET | 200 | 121.196.197.102:80 | http://ssl.lodop.net/localhost_c.key | unknown | text | 1.73 Kb | — |
2076 | CLodopPrint32.exe | GET | 200 | 121.196.197.102:80 | http://ssl.lodop.net/localhost_c_date | unknown | text | 10 b | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | unknown |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
868 | svchost.exe | 23.35.228.137:80 | — | AKAMAI-AS | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
868 | svchost.exe | 88.221.124.138:80 | armmf.adobe.com | AKAMAI-AS | DE | unknown |
2076 | CLodopPrint32.exe | 121.196.197.102:80 | ssl.lodop.net | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
Domain | IP | Reputation |
---|---|---|
armmf.adobe.com |
| unknown |
ssl.lodop.net |
| unknown |