analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://104.244.76.14/eBxUk/vstat

Full analysis: https://app.any.run/tasks/cbb0c079-d602-4641-b80f-0c6a8820c060
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 06, 2019, 17:22:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

8AA91A0255E6AA201FB3A2990F7F2A3C

SHA1:

B790F46EA650C74811C08077C09E0A0C81341CB9

SHA256:

DF5DCD450E13B464990BCDCED5AE83E1175E6E8E6E8B92193EE5790F2FE9EF7A

SSDEEP:

3:N1KtLWTvlaRER:CRWha4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • iexplore.exe (PID: 1928)
      • iexplore.exe (PID: 2236)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2236)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1928)
      • iexplore.exe (PID: 2236)

    • Application launched itself

      • iexplore.exe (PID: 2236)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe rundll32.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2236"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1928"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2236 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
600"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Downloads\vstatC:\Windows\system32\rundll32.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2760"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Downloads\vstatC:\Windows\system32\rundll32.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 703
Read events
1 500
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
7
Unknown types
6

Dropped files

PID
Process
Filename
Type
2236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2236iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2236iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDCB427BA85BB7EA2.TMP —
MD5:—
SHA256:—
2236iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF04D0F8A859C5638B.TMP —
MD5:—
SHA256:—
2236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F954FB81-184C-11EA-AB41-5254004A04AF}.dat —
MD5:—
SHA256:—
2236iexplore.exeC:\Users\admin\Downloads\vstato
MD5:C6F3C77AD013AE02ECD1FC47C1A00A80
SHA256:0B49EFE340E81BA3A5E1CC9013E550E3494FE1D4490DB1617B66D9130F33138C
1928iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:9B00BEC0B7CC6CACE83B620AB3B5BF9F
SHA256:58A8B7C7E561AB70879052AB58B508514229EE5FBDE0CDFE5B5A7D91E237D343
2236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{F954FB82-184C-11EA-AB41-5254004A04AF}.datbinary
MD5:2CCEE070F7C579FE8509C8A1DDABD287
SHA256:C18C0437F6FE21D4CDE3333C5BAB94B8093F89A8318DAA2FF94F0D62577CB11A
1928iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z6F0ZMVX\vstat[1]o
MD5:C6F3C77AD013AE02ECD1FC47C1A00A80
SHA256:0B49EFE340E81BA3A5E1CC9013E550E3494FE1D4490DB1617B66D9130F33138C
1928iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:63E30DDCF85013A19369AFA2DF75B089
SHA256:5E942CED32D4EAF71D649C4A3D2C3DFB917A3A15829EFEBF6980C27046A51642
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1928
iexplore.exe
GET
200
104.244.76.14:80
http://104.244.76.14/eBxUk/vstat
US
o
486 Kb
malicious
2236
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2236
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1928
iexplore.exe
104.244.76.14:80
—
FranTech Solutions
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
1928
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY Executable and linking format (ELF) file download Over HTTP
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://104.244.76.14/eBxUk/vstat