| File name: | walliant.exe |
| Full analysis: | https://app.any.run/tasks/30deacbd-e66d-468f-8795-b5ae2d5cff81 |
| Verdict: | Malicious activity |
| Analysis date: | February 20, 2024, 21:17:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 96A2CBE809B25C20CCC7D01E0C76E10E |
| SHA1: | F39FEF0E78B05D5F1878F68E160D83BDF24AB50F |
| SHA256: | E85C9EB65C1A2EAA03C64D4A7B30C2B245D42B8C34689AF0F90C8FD7068ECDE0 |
| SSDEEP: | 98304:E+cD4dnlQCg/FAtdSA6C97QqCSf7i0760R3PtEQ5EFwexAuVJaDPWbzPk814mVXa:OQmkZ2lYUq |
MALICIOUS
Drops the executable file immediately after the start
- walliant.exe (PID: 3700)
SUSPICIOUS
Reads settings of System Certificates
- walliant.tmp (PID: 3656)
Reads the Windows owner or organization settings
- walliant.tmp (PID: 3656)
Executable content was dropped or overwritten
- walliant.exe (PID: 3700)
INFO
Reads the computer name
- walliant.tmp (PID: 3656)
Checks supported languages
- walliant.exe (PID: 3700)
- walliant.tmp (PID: 3656)
Reads the machine GUID from the registry
- walliant.tmp (PID: 3656)
Reads the software policy settings
- walliant.tmp (PID: 3656)
Create files in a temporary directory
- walliant.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:04:14 16:10:23+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 88064 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.12.0 |
| ProductVersionNumber: | 1.0.12.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Walliant |
| FileDescription: | Walliant Setup |
| FileVersion: | 1.0.12.0 |
| LegalCopyright: | Copyright © 2023 Walliant |
| OriginalFileName: | |
| ProductName: | Walliant |
| ProductVersion: | 1.0.12.0 |
Total processes
37
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3656 | "C:\Users\admin\AppData\Local\Temp\is-KH6F6.tmp\walliant.tmp" /SL5="$E0170,3299812,830976,C:\Users\admin\AppData\Local\Temp\walliant.exe" | C:\Users\admin\AppData\Local\Temp\is-KH6F6.tmp\walliant.tmp | walliant.exe | ||||||||||||
User: admin Company: Walliant Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 3700 | "C:\Users\admin\AppData\Local\Temp\walliant.exe" | C:\Users\admin\AppData\Local\Temp\walliant.exe | explorer.exe | ||||||||||||
User: admin Company: Walliant Integrity Level: MEDIUM Description: Walliant Setup Exit code: 0 Version: 1.0.12.0 Modules
| |||||||||||||||
Total events
3 207
Read events
3 190
Write events
17
Delete events
0
Modification events
| (PID) Process: | (3656) walliant.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 480E0000F0533F364264DA01 | |||
| (PID) Process: | (3656) walliant.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: F898610F15B8301B5943255B463DF77B2DF4D06E2B9D95A06AFF07BB3645C737 | |||
| (PID) Process: | (3656) walliant.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (3656) walliant.tmp | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3700 | walliant.exe | C:\Users\admin\AppData\Local\Temp\is-KH6F6.tmp\walliant.tmp | executable | |
MD5:A3749A3CD8E5C62925030B52015816BE | SHA256:AE8DDE6B3F08E5C93DE0FEF186FA2803EE80D316390F8DA014865DF1A7B8B6CD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3656 | walliant.tmp | 104.21.57.77:443 | stats.walliant.com | CLOUDFLARENET | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
stats.walliant.com |
| unknown |