| File name: | down.exe |
| Full analysis: | https://app.any.run/tasks/2304da8b-1d25-43b2-89d7-d06ee45db67b |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | October 07, 2024, 14:51:17 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 13476835B5465CF91E4DD7E60E110E56 |
| SHA1: | 38AF4E6440237A3F0F7EB8378A9F82EA473FC9A4 |
| SHA256: | E84F3F36AA22F8B7F7399CE57C68014EA23140E88755516DB02B5E056D18DAD6 |
| SSDEEP: | 49152:YVTGljBxO5asoS9UI2nhAqu/X6GiNJAJb1/g/FF6Lan+b5UOxFXklZrNvDg1/n9q:YVKhBxO5asN9cnGqUY3o/I6+n+b5U8+D |
MALICIOUS
Uses Task Scheduler to run other applications
- cmd.exe (PID: 2608)
AutoIt loader has been detected (YARA)
- Kim.pif (PID: 6832)
Stealers network behavior
- Kim.pif (PID: 6832)
VIDAR has been detected (SURICATA)
- Kim.pif (PID: 6832)
SUSPICIOUS
Reads security settings of Internet Explorer
- down.exe (PID: 6292)
Get information on the list of running processes
- cmd.exe (PID: 5656)
Application launched itself
- cmd.exe (PID: 5656)
Executable content was dropped or overwritten
- cmd.exe (PID: 5656)
- Kim.pif (PID: 6832)
Starts application with an unusual extension
- cmd.exe (PID: 5656)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 5656)
- down.exe (PID: 6292)
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 5656)
The executable file from the user directory is run by the CMD process
- Kim.pif (PID: 6832)
Executing commands from a ".bat" file
- down.exe (PID: 6292)
INFO
Create files in a temporary directory
- down.exe (PID: 6292)
Checks supported languages
- down.exe (PID: 6292)
The process uses the downloaded file
- down.exe (PID: 6292)
Reads the computer name
- down.exe (PID: 6292)
Process checks computer location settings
- down.exe (PID: 6292)
Creates a new folder
- cmd.exe (PID: 4664)
Manual execution by a user
- cmd.exe (PID: 6464)
- cmd.exe (PID: 2608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2012:02:24 19:19:54+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 28160 |
| InitializedDataSize: | 445952 |
| UninitializedDataSize: | 16896 |
| EntryPoint: | 0x3883 |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
Total processes
146
Monitored processes
17
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 360 | cmd /c copy /b ..\Hb + ..\Rapid + ..\London + ..\Royal + ..\Charter + ..\Deck + ..\Pichunter + ..\Killing N | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2372 | findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2424 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2608 | cmd /c schtasks.exe /create /tn "Practices" /tr "wscript //B 'C:\Users\admin\AppData\Local\DataWave Sphere Co\SyncWave.js'" /sc minute /mo 5 /F | C:\Windows\SysWOW64\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3440 | findstr /I "wrsa opssvc" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4664 | cmd /c md 285204 | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4668 | findstr /V "AugQualificationDepthWidth" Course | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5128 | choice /d y /t 5 | C:\Windows\SysWOW64\choice.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Offers the user a choice Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5656 | "C:\Windows\System32\cmd.exe" /c move Devil Devil.bat & Devil.bat | C:\Windows\SysWOW64\cmd.exe | down.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5964 | schtasks.exe /create /tn "Practices" /tr "wscript //B 'C:\Users\admin\AppData\Local\DataWave Sphere Co\SyncWave.js'" /sc minute /mo 5 /F | C:\Windows\SysWOW64\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
4 456
Read events
4 453
Write events
3
Delete events
0
Modification events
| (PID) Process: | (6832) Kim.pif | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6832) Kim.pif | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6832) Kim.pif | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
2
Suspicious files
32
Text files
100
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Pichunter | binary | |
MD5:9B7919EA2318BEC3EF9666C982B77119 | SHA256:02F813B83CD0126E876F387AC82B51289A9888E7B142FE41A543AAF57E91D225 | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Hb | binary | |
MD5:EF5519B0E3D69AC10317974081E12222 | SHA256:3C4F40140A71ECFDE55326F84CA878E5C1A101D457107DA13017F5670C6A5BB4 | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Devil | text | |
MD5:97D7D087CF461FF97C4A4438102C1016 | SHA256:D97E4FAAA2B3F23B147A2A626634794E9E853A3E661472502D6D786EDB1C6C7A | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Royal | binary | |
MD5:F81ED71B4707976F2074491ADB2E4F3C | SHA256:207EB1026CAAC4EE644F3B7E1BE0D455AC93298B07E329371E1BBD81CC6DC50E | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Deck | binary | |
MD5:5BDEF9E70FA8AAC0118E96D47F1E1DBC | SHA256:75F00C8C8A5841C48D383384ED01D0D9FEA056FC8BB6B7E275E3A29EDF37FA7B | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Herself | binary | |
MD5:352D59010C3A1AD07C6CC631429C3898 | SHA256:F9D2FE0DFF05D8485CC1104E64940673055BD2EE3FF90297DAD183FB6356EAE3 | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Course | binary | |
MD5:6DA24F141475E1C94D0BAA534671730E | SHA256:71AC8F4534EB924876822260553E2C5FDFEE7FC9A50790FFD3842339D8A33E35 | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\Rapid | binary | |
MD5:78A2388D3143B203F0D68EDA1962FD9C | SHA256:3739A2C7BF513612F2D616BB10B0221512FA4CCE0222441D7BA96FFDFB553387 | |||
| 6292 | down.exe | C:\Users\admin\AppData\Local\Temp\London | binary | |
MD5:463606075E8BC9B04F96C6F893469F91 | SHA256:AF8444E8EE47F86FB80BCCA4B65C0E2DB813240A6479A44ED7C0D4AD310D43E2 | |||
| 6832 | Kim.pif | C:\Users\admin\AppData\Local\DataWave Sphere Co\SyncWave.scr | executable | |
MD5:18CE19B57F43CE0A5AF149C96AECC685 | SHA256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
54
DNS requests
17
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2120 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1336 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
420 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
420 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6416 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6832 | Kim.pif | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4324 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
8 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1336 | svchost.exe | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1336 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
zozDQDGGHgJTWDbznNIYnhesqUB.zozDQDGGHgJTWDbznNIYnhesqUB |
| unknown |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6832 | Kim.pif | A Network Trojan was detected | STEALER [ANY.RUN] Vidar TLS Connection Attempt |