analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

/software23577/11344556/downloads/CRACKED_BY_INJUAN_BLTools_v2.4.rar

Full analysis: https://app.any.run/tasks/ef67b02b-3a80-41c6-9dc6-75846e1f3e33
Verdict: Malicious activity
Analysis date: November 11, 2023, 22:55:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

452D856BC0865B6A5E1A1D56FC67B04A

SHA1:

F708F2C06EF54C6D30C279985C19908F8FE051EA

SHA256:

DD65F16472F795E637165587E1FE535ED13291FA0CA0568F97292209BF9E9585

SSDEEP:

98304:1dMmUiyTjMxezA6E+4YIAgGPE7nBAaDY0eKf1n/U3gBiTza3YuO9GOtj5GFjDLYx:TjI7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Uses Task Scheduler to run other applications

      • LZMYBCTLTD.exe (PID: 1760)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3416)

    • Reads the BIOS version

      • BLTools v2.4.exe (PID: 3408)
      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Reads the Internet Settings

      • BLTools v2.4.exe (PID: 3408)
      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Application launched itself

      • BLTools v2.4.exe (PID: 3408)

    • Starts POWERSHELL.EXE for commands execution

      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Script adds exclusion path to Windows Defender

      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Powershell version downgrade attack

      • powershell.exe (PID: 4052)
      • powershell.exe (PID: 4060)
      • powershell.exe (PID: 2056)
      • powershell.exe (PID: 1352)
      • powershell.exe (PID: 2300)
      • powershell.exe (PID: 2332)
      • powershell.exe (PID: 1848)
      • powershell.exe (PID: 2788)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 756)

    • Executing commands from a ".bat" file

      • BLTools v2.4.exe (PID: 3964)

    • Starts CMD.EXE for commands execution

      • BLTools v2.4.exe (PID: 3964)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

  • INFO

    • Checks supported languages

      • BLTools v2.4.exe (PID: 3408)
      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Reads the computer name

      • BLTools v2.4.exe (PID: 3408)
      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Manual execution by a user

      • BLTools v2.4.exe (PID: 3408)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3416)

    • Process checks are UAC notifies on

      • BLTools v2.4.exe (PID: 3964)
      • LZMYBCTLTD.exe (PID: 1760)
      • LZMYBCTLTD.exe (PID: 1904)
      • LZMYBCTLTD.exe (PID: 2736)

    • Creates files in the program directory

      • BLTools v2.4.exe (PID: 3964)

    • Create files in a temporary directory

      • BLTools v2.4.exe (PID: 3964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
17
Malicious processes
14
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs bltools v2.4.exe no specs bltools v2.4.exe powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CRACKED_BY_INJUAN_BLTools_v2.4.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3408"C:\Users\admin\Desktop\[CRACKED BY INJUAN] BLTools v2.4\BLTools v2.4.exe" C:\Users\admin\Desktop\[CRACKED BY INJUAN] BLTools v2.4\BLTools v2.4.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Logon Application
Exit code:
1
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\[cracked by injuan] bltools v2.4\bltools v2.4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3964"C:\Users\admin\Desktop\[CRACKED BY INJUAN] BLTools v2.4\BLTools v2.4.exe" C:\Users\admin\Desktop\[CRACKED BY INJUAN] BLTools v2.4\BLTools v2.4.exe
BLTools v2.4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\[cracked by injuan] bltools v2.4\bltools v2.4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
4060"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—BLTools v2.4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
4052"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—BLTools v2.4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
756C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\s324.0.bat" "C:\Windows\System32\cmd.exe—BLTools v2.4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2060timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
1760"C:\ProgramData\active\LZMYBCTLTD.exe" C:\ProgramData\active\LZMYBCTLTD.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2056"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1352"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
12 265
Read events
11 726
Write events
539
Delete events
0

Modification events

(PID) Process:(3416) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
7
Suspicious files
24
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3416.31384\[CRACKED BY INJUAN] BLTools v2.4\BLTools v2.4.exe —
MD5:—
SHA256:—
3964BLTools v2.4.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3416.31384\[CRACKED BY INJUAN] BLTools v2.4\Newtonsoft.Json.dllexecutable
MD5:715A1FBEE4665E99E859EDA667FE8034
SHA256:C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
4052powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:EA4F1F6997ED9429F7B363B55F163E87
SHA256:D9A7DF5C82CD40803161A0FB312B27508C4A23DA8F66418F59739310F6D0310F
4060powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:EA4F1F6997ED9429F7B363B55F163E87
SHA256:D9A7DF5C82CD40803161A0FB312B27508C4A23DA8F66418F59739310F6D0310F
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3416.31384\[CRACKED BY INJUAN] BLTools v2.4\Extreme.Net.dllexecutable
MD5:F79F0E3A0361CAC000E2D3553753CD68
SHA256:8A6518AB7419FBEC3AC9875BAA3AFB410AD1398C7AA622A09CD9084EC6CADFCD
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3416.31384\[CRACKED BY INJUAN] BLTools v2.4\Ookii.Dialogs.Wpf.dllexecutable
MD5:932EBB3F9E7113071C6A17818342B7CC
SHA256:285AA8225732DDBCF211B1158BD6CFF8BF3ACBEEAB69617F4BE85862B7105AB5
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3416.31384\[CRACKED BY INJUAN] BLTools v2.4\License.dlltext
MD5:B08A5C34CF0A06615DA2CA89010D8B4F
SHA256:04CC5B3B49A7E9E9B6C66C7BE59A20992BF2653746B5D43829C383FB233F88FA
4060powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF16e45a.TMPbinary
MD5:C681106A4168B935996B10134404F885
SHA256:89AB4ECFBB5C1FD07CF99465E36B1A08F51E2512AA60DDD616D4A37753FC112D
4052powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF16e45a.TMPbinary
MD5:EA4F1F6997ED9429F7B363B55F163E87
SHA256:D9A7DF5C82CD40803161A0FB312B27508C4A23DA8F66418F59739310F6D0310F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/software23577/11344556/downloads/CRACKED_BY_INJUAN_BLTools_v2.4.rar