We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
27 November 2024, 13:35
Analysis environment:
Windows 10 Pro, build 19045, x64
https://electrum-usdt.com/download/windows
MD5:
FA0F311E6B0AB38F3396FA04EAE69F21
SHA1:
5A3AFDC34CB9BE0840980D3DBD6B24A125EEF8F0
SHA256:
FC729E79B93A9FD9A967D68DA2167B10F3B978B975B81E42A8BAE102D8FAC3CC
Analysis result
Threat level:
Malicious activity
Tags:
adware
advancedinstaller
loader
rat
rurat
Full analysis:
Analysis https://electrum-usdt.com/download/windows Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
ADVANCEDINSTALLER has been detected (SURICATA)
Electrum-usdt-4.7.5.exe (PID: 4840)
msiexec.exe (PID: 1988)
Electrum-usdt-4.7.5.exe (PID: 7568)
Run PowerShell with an invisible window
powershell.exe (PID: 644)
Changes powershell execution policy (RemoteSigned)
cmd.exe (PID: 7920)
Executing a file with an untrusted certificate
rfusclient.exe (PID: 372)
rutserv.exe (PID: 2136)
rutserv.exe (PID: 7708)
Changes powershell execution policy (Bypass)
msiexec.exe (PID: 5584)
Bypass execution policy to execute commands
powershell.exe (PID: 3852)
SUSPICIOUS
Process drops legitimate windows executable
Electrum-usdt-4.7.5.exe (PID: 4840)
msiexec.exe (PID: 4540)
setupdrv.exe (PID: 5116)
Electrum-usdt-4.7.5.exe (PID: 7568)
Starts CMD.EXE for commands execution
powershell.exe (PID: 644)
Electrum-usdt-4.7.5.exe (PID: 4840)
powershell.exe (PID: 5500)
Electrum-usdt-4.7.5.exe (PID: 7568)
cmd.exe (PID: 4864)
cmd.exe (PID: 1496)
Starts process via Powershell
powershell.exe (PID: 644)
Executable content was dropped or overwritten
Electrum-usdt-4.7.5.exe (PID: 4840)
spoolsv.exe (PID: 7444)
setupdrv.exe (PID: 5116)
srvinst.exe (PID: 8024)
Electrum-usdt-4.7.5.exe (PID: 7568)
Access to an unwanted program domain was detected
Electrum-usdt-4.7.5.exe (PID: 4840)
msiexec.exe (PID: 1988)
Electrum-usdt-4.7.5.exe (PID: 7568)
Kill processes via PowerShell
powershell.exe (PID: 4160)
Executing commands from a ".bat" file
Electrum-usdt-4.7.5.exe (PID: 4840)
Electrum-usdt-4.7.5.exe (PID: 7568)
cmd.exe (PID: 4864)
cmd.exe (PID: 1496)
Starts POWERSHELL.EXE for commands execution
cmd.exe (PID: 7920)
msiexec.exe (PID: 5584)
The process drops C-runtime libraries
msiexec.exe (PID: 4540)
Connects to SMTP port
rutserv.exe (PID: 8152)
Application launched itself
rfusclient.exe (PID: 4972)
Electrum-usdt-4.7.5.exe (PID: 4840)
cmd.exe (PID: 4864)
rutserv.exe (PID: 8152)
cmd.exe (PID: 1496)
Connects to unusual port
rutserv.exe (PID: 8152)
Uses REG/REGEDIT.EXE to modify registry
cmd.exe (PID: 7348)
cmd.exe (PID: 5484)
cmd.exe (PID: 640)
powershell.exe (PID: 3852)
Uses ATTRIB.EXE to modify file attributes
cmd.exe (PID: 7348)
powershell.exe (PID: 3852)
cmd.exe (PID: 4864)
cmd.exe (PID: 1496)
Potential Corporate Privacy Violation
msiexec.exe (PID: 4540)
The process executes Powershell scripts
msiexec.exe (PID: 5584)
The process hide an interactive prompt from the user
msiexec.exe (PID: 5584)
Likely accesses (executes) a file from the Public directory
attrib.exe (PID: 7896)
attrib.exe (PID: 4828)
The process bypasses the loading of PowerShell profile settings
msiexec.exe (PID: 5584)
INFO
Reads the computer name
identity_helper.exe (PID: 7788)
Checks supported languages
identity_helper.exe (PID: 7788)
Application launched itself
msedge.exe (PID: 5972)
msedge.exe (PID: 7760)
Reads Environment values
identity_helper.exe (PID: 7788)
Executable content was dropped or overwritten
msedge.exe (PID: 5972)
msedge.exe (PID: 4300)
msiexec.exe (PID: 4540)
Drops Remote Utils RAT executable file
msiexec.exe (PID: 4540)
Threats
PID
Process
Class
Message
4540
msiexec.exe
Potential Corporate Privacy Violation
ET POLICY Observed MSI Download
4540
msiexec.exe
Potential Corporate Privacy Violation
ET HUNTING Suspicious Windows Installer UA for non-MSI