File name:

Helper.exe

Full analysis: https://app.any.run/tasks/5e0c7974-2a8e-409f-9264-b89a8ba72a7e
Verdict: Malicious activity
Analysis date: January 03, 2024, 06:23:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

990E25511989DB7757B85679B5A7F6A9

SHA1:

76DD1A6D3ACD81ADFF7BF586A51529D58D2BBDBA

SHA256:

E39390C891A10D39ABF51A4D7FC9A13579E5A1040C71C95A36C8EBB75498D032

SSDEEP:

98304:EqpNIV+wd+8Va4d5heoptuEL1rLqS/hxTLFSgU6e3ee/MyvUkJHwnLg81BpvVNXI:qz1Z6PLZ038XKS9+iISBKTqgK6kuO8/0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process uses IPCONFIG to clear DNS cache

      • nsAD0.tmp (PID: 1784)
      • ns8D8.tmp (PID: 668)
      • ns9D4.tmp (PID: 1316)
      • nsA52.tmp (PID: 2128)
      • ns956.tmp (PID: 1588)
      • ns85A.tmp (PID: 2408)
      • nsB4E.tmp (PID: 1536)
      • nsDC4.tmp (PID: 148)
      • nsC4A.tmp (PID: 188)
      • nsCC8.tmp (PID: 2632)
      • nsD46.tmp (PID: 2572)
      • nsE42.tmp (PID: 2588)
      • nsBCC.tmp (PID: 2296)
      • ns104A.tmp (PID: 2748)
      • nsFCC.tmp (PID: 2100)
      • ns12A1.tmp (PID: 3068)
      • ns10B8.tmp (PID: 1000)
      • ns1127.tmp (PID: 2540)
      • ns11A5.tmp (PID: 2496)
      • ns1223.tmp (PID: 2360)
      • nsEC0.tmp (PID: 1572)
      • nsF3E.tmp (PID: 2504)
      • ns139D.tmp (PID: 3020)
      • ns141B.tmp (PID: 2676)
      • ns1499.tmp (PID: 3236)
      • ns1517.tmp (PID: 3136)
      • ns1585.tmp (PID: 3008)
      • ns1603.tmp (PID: 3204)
      • ns1681.tmp (PID: 3296)
      • ns131F.tmp (PID: 2968)
      • ns17FB.tmp (PID: 3504)
      • ns1975.tmp (PID: 3380)
      • ns1879.tmp (PID: 3492)
      • ns18F7.tmp (PID: 3652)
      • ns19F3.tmp (PID: 3972)
      • ns1A71.tmp (PID: 3892)
      • ns1AEF.tmp (PID: 2132)
      • ns1B6D.tmp (PID: 4040)
      • ns16FF.tmp (PID: 3328)
      • ns177D.tmp (PID: 2772)
      • ns1BEB.tmp (PID: 864)
      • ns1CE7.tmp (PID: 1044)
      • ns1C69.tmp (PID: 532)
      • ns1D65.tmp (PID: 1836)
      • ns1DE3.tmp (PID: 1496)
      • ns1E61.tmp (PID: 1848)

    • Starts application with an unusual extension

      • Helper.exe (PID: 2080)

  • INFO

    • Create files in a temporary directory

      • Helper.exe (PID: 2080)

    • Checks supported languages

      • Helper.exe (PID: 2080)
      • ns9D4.tmp (PID: 1316)
      • nsA52.tmp (PID: 2128)
      • nsBCC.tmp (PID: 2296)
      • nsAD0.tmp (PID: 1784)
      • nsC4A.tmp (PID: 188)
      • nsCC8.tmp (PID: 2632)
      • nsD46.tmp (PID: 2572)
      • nsDC4.tmp (PID: 148)
      • nsE42.tmp (PID: 2588)
      • nsB4E.tmp (PID: 1536)
      • ns85A.tmp (PID: 2408)
      • ns956.tmp (PID: 1588)
      • ns8D8.tmp (PID: 668)
      • nsF3E.tmp (PID: 2504)
      • nsFCC.tmp (PID: 2100)
      • ns10B8.tmp (PID: 1000)
      • ns104A.tmp (PID: 2748)
      • ns11A5.tmp (PID: 2496)
      • ns1223.tmp (PID: 2360)
      • ns12A1.tmp (PID: 3068)
      • nsEC0.tmp (PID: 1572)
      • ns1127.tmp (PID: 2540)
      • ns139D.tmp (PID: 3020)
      • ns141B.tmp (PID: 2676)
      • ns1499.tmp (PID: 3236)
      • ns1517.tmp (PID: 3136)
      • ns1681.tmp (PID: 3296)
      • ns1585.tmp (PID: 3008)
      • ns1603.tmp (PID: 3204)
      • ns16FF.tmp (PID: 3328)
      • ns131F.tmp (PID: 2968)
      • ns17FB.tmp (PID: 3504)
      • ns18F7.tmp (PID: 3652)
      • ns1879.tmp (PID: 3492)
      • ns1AEF.tmp (PID: 2132)
      • ns1975.tmp (PID: 3380)
      • ns19F3.tmp (PID: 3972)
      • ns1A71.tmp (PID: 3892)
      • ns1BEB.tmp (PID: 864)
      • ns1B6D.tmp (PID: 4040)
      • ns177D.tmp (PID: 2772)
      • ns1C69.tmp (PID: 532)
      • ns1D65.tmp (PID: 1836)
      • ns1DE3.tmp (PID: 1496)
      • ns1E61.tmp (PID: 1848)
      • wmpnscfg.exe (PID: 1784)
      • ns1CE7.tmp (PID: 1044)

    • Reads the computer name

      • Helper.exe (PID: 2080)
      • wmpnscfg.exe (PID: 1784)

    • Drops the executable file immediately after the start

      • Helper.exe (PID: 2080)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 01:54:20+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x33fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Hindi
CharacterSet: Unicode
Comments: -
CompanyName: KpoJIuK
FileDescription: Adobe Installer
FileVersion: 1.0.0.0
LegalCopyright: © KpoJIuK
ProductName: Adobe Installer
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
95
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start helper.exe ns85a.tmp no specs ipconfig.exe no specs ns8d8.tmp no specs ipconfig.exe no specs ns956.tmp no specs ipconfig.exe no specs ns9d4.tmp no specs ipconfig.exe no specs nsa52.tmp no specs ipconfig.exe no specs nsad0.tmp no specs ipconfig.exe no specs nsb4e.tmp no specs ipconfig.exe no specs nsbcc.tmp no specs ipconfig.exe no specs nsc4a.tmp no specs ipconfig.exe no specs nscc8.tmp no specs ipconfig.exe no specs nsd46.tmp no specs ipconfig.exe no specs nsdc4.tmp no specs ipconfig.exe no specs nse42.tmp no specs ipconfig.exe no specs nsec0.tmp no specs ipconfig.exe no specs nsf3e.tmp no specs ipconfig.exe no specs nsfcc.tmp no specs ipconfig.exe no specs ns104a.tmp no specs ipconfig.exe no specs ns10b8.tmp no specs ipconfig.exe no specs ns1127.tmp no specs ipconfig.exe no specs ns11a5.tmp no specs ipconfig.exe no specs ns1223.tmp no specs ipconfig.exe no specs ns12a1.tmp no specs ipconfig.exe no specs ns131f.tmp no specs ipconfig.exe no specs ns139d.tmp no specs ipconfig.exe no specs ns141b.tmp no specs ipconfig.exe no specs ns1499.tmp no specs ipconfig.exe no specs ns1517.tmp no specs ipconfig.exe no specs ns1585.tmp no specs ipconfig.exe no specs ns1603.tmp no specs ipconfig.exe no specs ns1681.tmp no specs ipconfig.exe no specs ns16ff.tmp no specs ipconfig.exe no specs ns177d.tmp no specs ipconfig.exe no specs ns17fb.tmp no specs ipconfig.exe no specs ns1879.tmp no specs ipconfig.exe no specs ns18f7.tmp no specs ipconfig.exe no specs ns1975.tmp no specs ipconfig.exe no specs ns19f3.tmp no specs ipconfig.exe no specs ns1a71.tmp no specs ipconfig.exe no specs ns1aef.tmp no specs ipconfig.exe no specs ns1b6d.tmp no specs ipconfig.exe no specs ns1beb.tmp no specs ipconfig.exe no specs ns1c69.tmp no specs ipconfig.exe no specs ns1ce7.tmp no specs ipconfig.exe no specs ns1d65.tmp no specs ipconfig.exe no specs ns1de3.tmp no specs ipconfig.exe no specs ns1e61.tmp no specs ipconfig.exe no specs wmpnscfg.exe no specs helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Users\admin\AppData\Local\Temp\Helper.exe" C:\Users\admin\AppData\Local\Temp\Helper.exe—explorer.exe
User:
admin
Company:
KpoJIuK
Integrity Level:
MEDIUM
Description:
Adobe Installer
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\helper.exe
c:\windows\system32\ntdll.dll
148"C:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsDC4.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsDC4.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsf84a.tmp\nsdc4.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
188"C:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsC4A.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsC4A.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsf84a.tmp\nsc4a.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
480ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns1C69.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
532"C:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns1C69.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns1C69.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsf84a.tmp\ns1c69.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
568ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—nsF3E.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
604ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns1585.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
668"C:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns8D8.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns8D8.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsf84a.tmp\ns8d8.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
844ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns1E61.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
864"C:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns1BEB.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns1BEB.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsf84a.tmp\ns1beb.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 456
Read events
1 456
Write events
0
Delete events
0

Modification events

No data
Executable files
47
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2080Helper.exeC:\Windows\system32\drivers\etc\hoststext
MD5:D8BCEF35968A80DB39F62FF867A3909B
SHA256:C748216463CCD3DA2940193163852EB0E544E9745A7DE5EDBA41DF8F4A6B7355
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsExec.dllexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns9D4.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns956.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns8D8.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\ns85A.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsB4E.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsA52.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsAD0.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2080Helper.exeC:\Users\admin\AppData\Local\Temp\nsf84A.tmp\nsEC0.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Helper.exe