| URL: | https://github.com/KOYiX/SKRIPT.GG-CRACK-BY-KOYiX |
| Full analysis: | https://app.any.run/tasks/efdc51ba-815d-4ddc-af10-e264332c6d70 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 04, 2024, 12:46:29 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | F5F2FFD5CECA6640351A0021FFA933E6 |
| SHA1: | 5E5C196EF65835FD81389F794B097E9445767CE6 |
| SHA256: | E3A260CBD8682CC9D4D95AD7F65557974E647851BF77E9306250DCB77C1617E5 |
| SSDEEP: | 3:N8tEd15NZ3kmua8m/:2upLUZ3w |
MALICIOUS
Drops the executable file immediately after the start
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
Gets path to any of the special folders (SCRIPT)
- wscript.exe (PID: 2892)
- wscript.exe (PID: 2912)
- wscript.exe (PID: 2976)
Actions looks like stealing of personal data
- RtkBtManServ.exe (PID: 2400)
- splwow64.exe (PID: 3020)
- snuvcdsm.exe (PID: 2820)
- xwizard.exe (PID: 2728)
DISCORDGRABBER has been detected (YARA)
- RtkBtManServ.exe (PID: 2400)
Password recovery utility (NirSoft) for browsers is detected
- snuvcdsm.exe (PID: 2820)
Steals credentials from Web Browsers
- snuvcdsm.exe (PID: 2820)
- hh.exe (PID: 2896)
- xwizard.exe (PID: 2728)
Uses NirSoft utilities to collect credentials
- snuvcdsm.exe (PID: 2820)
Steals credentials
- snuvcdsm.exe (PID: 2820)
The tool for viewing Firefox cookies (NirSoft) is detected
- splwow64.exe (PID: 3020)
The tool for viewing Edge cookies (NirSoft) is detected
- hh.exe (PID: 2896)
The tool for viewing Chrome cookies (NirSoft) is detected
- winhlp32.exe (PID: 2992)
Web Browser History Viewer utility (NirSoft) is detected
- xwizard.exe (PID: 2728)
SUSPICIOUS
Executable content was dropped or overwritten
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
Reads security settings of Internet Explorer
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
Reads the Internet Settings
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
- wscript.exe (PID: 2892)
- wscript.exe (PID: 2912)
- wscript.exe (PID: 2976)
Reads browser cookies
- RtkBtManServ.exe (PID: 2400)
The process executes VB scripts
- RtkBtManServ.exe (PID: 2400)
Reads settings of System Certificates
- RtkBtManServ.exe (PID: 2400)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 2892)
- wscript.exe (PID: 2912)
- wscript.exe (PID: 2976)
The executable file from the user directory is run by the CMD process
- snuvcdsm.exe (PID: 2820)
- winhlp32.exe (PID: 2992)
- splwow64.exe (PID: 3020)
- hh.exe (PID: 2896)
- xwizard.exe (PID: 2728)
Runs shell command (SCRIPT)
- wscript.exe (PID: 2892)
- wscript.exe (PID: 2912)
- wscript.exe (PID: 2976)
Executing commands from a ".bat" file
- wscript.exe (PID: 2912)
- wscript.exe (PID: 2892)
- wscript.exe (PID: 2976)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 2912)
- wscript.exe (PID: 2892)
- wscript.exe (PID: 2976)
- RtkBtManServ.exe (PID: 2400)
Loads DLL from Mozilla Firefox
- splwow64.exe (PID: 3020)
The process connected to a server suspected of theft
- RtkBtManServ.exe (PID: 2400)
INFO
Application launched itself
- chrome.exe (PID: 3972)
Checks supported languages
- wmpnscfg.exe (PID: 2348)
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
- snuvcdsm.exe (PID: 2820)
- winhlp32.exe (PID: 2992)
- splwow64.exe (PID: 3020)
- hh.exe (PID: 2896)
- xwizard.exe (PID: 2728)
Reads the computer name
- wmpnscfg.exe (PID: 2348)
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
- snuvcdsm.exe (PID: 2820)
Drops the executable file immediately after the start
- chrome.exe (PID: 568)
- WinRAR.exe (PID: 992)
- chrome.exe (PID: 3972)
The process uses the downloaded file
- chrome.exe (PID: 1212)
- WinRAR.exe (PID: 992)
Manual execution by a user
- wmpnscfg.exe (PID: 2348)
- SKRIPTGG_BY_KOY.exe (PID: 2560)
Executable content was dropped or overwritten
- chrome.exe (PID: 568)
- WinRAR.exe (PID: 992)
Create files in a temporary directory
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
- snuvcdsm.exe (PID: 2820)
- winhlp32.exe (PID: 2992)
- splwow64.exe (PID: 3020)
- hh.exe (PID: 2896)
- xwizard.exe (PID: 2728)
Reads the machine GUID from the registry
- SKRIPTGG_BY_KOY.exe (PID: 2560)
- RtkBtManServ.exe (PID: 2400)
- snuvcdsm.exe (PID: 2820)
Reads Environment values
- RtkBtManServ.exe (PID: 2400)
Creates files in the program directory
- RtkBtManServ.exe (PID: 2400)
Reads the software policy settings
- RtkBtManServ.exe (PID: 2400)
Creates files or folders in the user directory
- splwow64.exe (PID: 3020)
- xwizard.exe (PID: 2728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
66
Monitored processes
28
Malicious processes
11
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 304 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2036 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 568 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3288 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 864 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1088 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 992 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\SKRIPT.GG-CRACK-BY-KOYiX-main.zip" | C:\Program Files\WinRAR\WinRAR.exe | chrome.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1064 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1508 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1248 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1212 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3236 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1248 | "C:\Windows\System32\cmd.exe" /c compile.bat | C:\Windows\System32\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1580 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2020 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1836 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1428 --field-trial-handle=1156,i,4593399862339537393,4875149258903107452,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
Total events
22 634
Read events
22 487
Write events
140
Delete events
7
Modification events
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3972) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
9
Suspicious files
37
Text files
43
Unknown types
30
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1043a2.TMP | — | |
MD5:— | SHA256:— | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1043d1.TMP | text | |
MD5:358570F689377CE6838812643E03734B | SHA256:5B41FCC2E1A843AEAB9437B06E27B798870FF10D86A51B163BF48862BCD32590 | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:9C016064A1F864C8140915D77CF3389A | SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787 | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:825B582C78EC88D54C215EFDF1EAD639 | SHA256:367995D01A8F13E5C30C79499F86B034775BFD009D83DC97635DE438D47DFA37 | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF104e02.TMP | — | |
MD5:— | SHA256:— | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF1046bf.TMP | text | |
MD5:65239F35CB63C76EA1F59EF64F7AAFF4 | SHA256:252EF82CC03FDE4BEF13CF81CD1AC5CE45854212D1A7359035E7A5D6BEDBE229 | |||
| 3972 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old~RF106004.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
30
DNS requests
34
Threats
11
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3972 | chrome.exe | 239.255.255.250:1900 | — | — | — | unknown |
1116 | chrome.exe | 140.82.121.4:443 | github.com | GITHUB | US | unknown |
1116 | chrome.exe | 142.251.31.84:443 | accounts.google.com | GOOGLE | US | unknown |
1116 | chrome.exe | 185.199.111.133:443 | avatars.githubusercontent.com | FASTLY | US | unknown |
1116 | chrome.exe | 185.199.108.154:443 | github.githubassets.com | FASTLY | US | unknown |
1116 | chrome.exe | 142.250.185.170:443 | safebrowsing.googleapis.com | GOOGLE | US | whitelisted |
1116 | chrome.exe | 172.217.16.138:443 | content-autofill.googleapis.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
accounts.google.com |
| shared |
github.com |
| shared |
safebrowsing.googleapis.com |
| whitelisted |
github.githubassets.com |
| whitelisted |
avatars.githubusercontent.com |
| whitelisted |
github-cloud.s3.amazonaws.com |
| shared |
user-images.githubusercontent.com |
| whitelisted |
content-autofill.googleapis.com |
| whitelisted |
collector.github.com |
| whitelisted |
api.github.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1088 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .gq Domain |
1088 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
— | — | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
1088 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
2400 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
— | — | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
2400 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
2400 | RtkBtManServ.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
2400 | RtkBtManServ.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
2400 | RtkBtManServ.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |