File name:

Bitcoin_Private_Key_Hunter.rar

Full analysis: https://app.any.run/tasks/15c9b19b-6147-4652-ae00-ee7af0381503
Verdict: Malicious activity
Analysis date: December 20, 2023, 08:33:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

19493325FC93DF0D218DDA0B9E2D2ADD

SHA1:

73C555A5CE779095356FAC96DE4279B50B748971

SHA256:

F243CEEF18A29ECF5FB522388E2D5882B2F9917B24DEF6F134A37D037C2373AF

SSDEEP:

98304:Sxq8fi8yjsBD+Gq78sEIJhTQfkxVP/bIJRSyKn3NrxYff7x3MvK1hIoeyJivlowa:bODXFa6CWwUmhi3Sy1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • LZMYBCTLTD.exe (PID: 1036)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)
      • Key Hunter.exe (PID: 2308)

    • Uses Task Scheduler to run other applications

      • LZMYBCTLTD.exe (PID: 1036)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2084)

    • Reads the BIOS version

      • Key Hunter.exe (PID: 1936)
      • Key Hunter.exe (PID: 2308)
      • LZMYBCTLTD.exe (PID: 1036)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)

    • Reads the Internet Settings

      • Key Hunter.exe (PID: 1936)
      • Key Hunter.exe (PID: 2308)
      • powershell.exe (PID: 2296)
      • powershell.exe (PID: 2192)
      • LZMYBCTLTD.exe (PID: 1036)
      • powershell.exe (PID: 2388)
      • powershell.exe (PID: 2828)
      • LZMYBCTLTD.exe (PID: 3024)
      • powershell.exe (PID: 3040)
      • powershell.exe (PID: 3056)
      • LZMYBCTLTD.exe (PID: 3200)
      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 3276)
      • LZMYBCTLTD.exe (PID: 3660)
      • powershell.exe (PID: 4036)
      • powershell.exe (PID: 4084)

    • Application launched itself

      • Key Hunter.exe (PID: 1936)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2192)
      • powershell.exe (PID: 2388)
      • powershell.exe (PID: 2828)
      • powershell.exe (PID: 3056)
      • powershell.exe (PID: 3040)
      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 3276)
      • powershell.exe (PID: 4036)
      • powershell.exe (PID: 4084)
      • powershell.exe (PID: 2296)

    • Executing commands from a ".bat" file

      • Key Hunter.exe (PID: 2308)

    • Starts CMD.EXE for commands execution

      • Key Hunter.exe (PID: 2308)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2588)

    • Script adds exclusion path to Windows Defender

      • LZMYBCTLTD.exe (PID: 1036)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)
      • Key Hunter.exe (PID: 2308)

    • Starts POWERSHELL.EXE for commands execution

      • LZMYBCTLTD.exe (PID: 1036)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)
      • Key Hunter.exe (PID: 2308)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3660)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2084)

    • Reads the computer name

      • Key Hunter.exe (PID: 1936)
      • wmpnscfg.exe (PID: 2840)
      • LZMYBCTLTD.exe (PID: 1036)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)
      • Key Hunter.exe (PID: 2308)

    • Manual execution by a user

      • WinRAR.exe (PID: 2084)
      • Key Hunter.exe (PID: 1936)
      • wmpnscfg.exe (PID: 2840)
      • taskmgr.exe (PID: 2836)

    • Checks supported languages

      • Key Hunter.exe (PID: 1936)
      • Key Hunter.exe (PID: 2308)
      • LZMYBCTLTD.exe (PID: 1036)
      • wmpnscfg.exe (PID: 2840)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)

    • Process checks are UAC notifies on

      • Key Hunter.exe (PID: 2308)
      • LZMYBCTLTD.exe (PID: 1036)
      • LZMYBCTLTD.exe (PID: 3024)
      • LZMYBCTLTD.exe (PID: 3200)
      • LZMYBCTLTD.exe (PID: 3660)

    • Create files in a temporary directory

      • Key Hunter.exe (PID: 2308)

    • Creates files in the program directory

      • Key Hunter.exe (PID: 2308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
23
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs key hunter.exe no specs key hunter.exe powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs wmpnscfg.exe no specs taskmgr.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036"C:\ProgramData\active\LZMYBCTLTD.exe" C:\ProgramData\active\LZMYBCTLTD.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1936"C:\Users\admin\Desktop\Bitcoin Private Key Hunter\Key Hunter.exe" C:\Users\admin\Desktop\Bitcoin Private Key Hunter\Key Hunter.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Logon Application
Exit code:
1
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\bitcoin private key hunter\key hunter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2040"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bitcoin_Private_Key_Hunter.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2084"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Bitcoin Private Key Hunter.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2192"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Key Hunter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2296"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Key Hunter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2308"C:\Users\admin\Desktop\Bitcoin Private Key Hunter\Key Hunter.exe" C:\Users\admin\Desktop\Bitcoin Private Key Hunter\Key Hunter.exe
Key Hunter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\bitcoin private key hunter\key hunter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2388"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2588C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\s1s4.0.bat" "C:\Windows\System32\cmd.exe—Key Hunter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2724"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LZMYBCTLTD" /tr C:\ProgramData\active\LZMYBCTLTD.exe /fC:\Windows\System32\schtasks.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
9 679
Read events
9 454
Write events
225
Delete events
0

Modification events

(PID) Process:(2040) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
3
Suspicious files
22
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2040.18685\Bitcoin Private Key Hunter.rar —
MD5:—
SHA256:—
2084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2084.19917\Bitcoin Private Key Hunter\Data\Configuration.cfg —
MD5:—
SHA256:—
2084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2084.19917\Bitcoin Private Key Hunter\Key Hunter.exe —
MD5:—
SHA256:—
2308Key Hunter.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
2296powershell.exeC:\Users\admin\AppData\Local\Temp\t20gwwud.mxk.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2388powershell.exeC:\Users\admin\AppData\Local\Temp\uyal3fet.x3u.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2084.19917\Bitcoin Private Key Hunter\x86\SQLite.Interop.dllexecutable
MD5:8BE215ABF1F36AA3D23555A671E7E3BE
SHA256:83F332EA9535814F18BE4EE768682ECC7720794AEDC30659EB165E46257A7CAE
2296powershell.exeC:\Users\admin\AppData\Local\Temp\40u3y2dm.n1h.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2192powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2388powershell.exeC:\Users\admin\AppData\Local\Temp\tbn2htzw.wlq.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bitcoin_Private_Key_Hunter.rar