| File name: | 60ec5c8fa096f_Main-lnstall-v7.1.zip |
| Full analysis: | https://app.any.run/tasks/abd17d39-adbe-4d16-b1ce-d58dfc3fe5ba |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | July 13, 2021, 22:26:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 4866A761DDF36B47EBCDAF2094D1F1C5 |
| SHA1: | 24D44E12FAAA781FEF93824C8BF752C532421BCA |
| SHA256: | FD94ADD9F55D6CE4BCF4428A4EA78C6A311D5EF26CF63E98BF39D4CDD4A573A1 |
| SSDEEP: | 196608:Iqkr3+qZVbbFpd+eTrnKXaIX5cDjZmrZN2lmK7I:Iqk3TzFue35o5cDGZNm7I |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipFileName: | Main-lnstall-v7.1.exe |
|---|---|
| ZipUncompressedSize: | 705008656 |
| ZipCompressedSize: | 7363267 |
| ZipCRC: | 0x9457e07d |
| ZipModifyDate: | 2021:07:12 15:14:23 |
| ZipCompression: | Deflated |
| ZipBitFlag: | 0x0001 |
| ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 240 | C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 280 | \??\C:\Windows\system32\conhost.exe "-1440799351228553031-1748615682-1514047465-1166498968-616591428-12104245102129099103" | \??\C:\Windows\system32\conhost.exe | — | csrss.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 280 | C:\Users\Public\run.exe | C:\Users\Public\run.exe | — | run.exe | |||||||||||
User: admin Company: EdmRelationshipNavigationPropertyAttribute Corporation. Integrity Level: HIGH Description: ListenActivity Application App Exit code: 0 Version: 449.466.103.491 Modules
| |||||||||||||||
| 316 | \??\C:\Windows\system32\conhost.exe "2042275696-39882532196777256820368848913885349621737105098-2090374072-1377877967" | \??\C:\Windows\system32\conhost.exe | — | csrss.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 316 | C:\Users\Public\run.exe | C:\Users\Public\run.exe | — | run.exe | |||||||||||
User: admin Company: EdmRelationshipNavigationPropertyAttribute Corporation. Integrity Level: HIGH Description: ListenActivity Application App Exit code: 0 Version: 449.466.103.491 Modules
| |||||||||||||||
| 324 | \??\C:\Windows\system32\conhost.exe "1807618700935668893320359107127984848-745097267-6483708401196815589637883028" | \??\C:\Windows\system32\conhost.exe | — | csrss.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 324 | C:\Users\admin\AppData\Local\Temp\Pupdate.exe | C:\Users\admin\AppData\Local\Temp\Pupdate.exe | Setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 336 | taskkill /im ZA_Q3L8vS0E4GccBjGfJVJLe.exe /f | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 336 | C:\Users\Public\run.exe | C:\Users\Public\run.exe | — | run.exe | |||||||||||
User: admin Company: EdmRelationshipNavigationPropertyAttribute Corporation. Integrity Level: HIGH Description: ListenActivity Application App Exit code: 0 Version: 449.466.103.491 Modules
| |||||||||||||||
| 360 | "C:\Program Files\Browzar\Tritiation.exe" | C:\Program Files\Browzar\Tritiation.exe | — | BrowzarBrowser_j6.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\60ec5c8fa096f_Main-lnstall-v7.1.zip | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3928 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3928.7135\Main-lnstall-v7.1.exe | — | |
MD5:— | SHA256:— | |||
| 3228 | Main-lnstall-v7.1.exe | C:\Users\admin\AppData\Local\Temp\Setup.exe | — | |
MD5:— | SHA256:— | |||
| 3316 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 2444 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 3316 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF374654.TMP | binary | |
MD5:— | SHA256:— | |||
| 2444 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RCSS382R7EE42TGLEOEW.temp | binary | |
MD5:— | SHA256:— | |||
| 3004 | Setup.exe | C:\Windows\PublicGaming\prun.exe | — | |
MD5:— | SHA256:— | |||
| 1328 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ILVD12NQIAFK8O2V1KD0.temp | binary | |
MD5:— | SHA256:— | |||
| 3316 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T2TAY8JE9BG8F9CLZ4MB.temp | binary | |
MD5:— | SHA256:— | |||
| 1328 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF374a2c.TMP | binary | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4504 | SMCh1.tmp | HEAD | 200 | 63.250.33.126:80 | http://requested404.com/C_Pirlo/sysMonitor.exe | US | — | — | suspicious |
496 | IDWCH2.tmp | HEAD | 200 | 63.250.33.126:80 | http://requested404.com/C_Pirlo/IDownload.exe | US | — | — | suspicious |
3664 | LabPicV2.tmp | HEAD | 200 | 63.250.33.126:80 | http://requested404.com/C_Pirlo/PicturesLab.exe | US | — | — | suspicious |
996 | lsass.exe | GET | 200 | 195.138.255.17:80 | http://crl.identrust.com/DSTROOTCAX3CRL.crl | DE | der | 1.16 Kb | whitelisted |
996 | lsass.exe | GET | 200 | 195.138.255.16:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgS8tNLAQkZB74GlzskVxiDiZQ%3D%3D | DE | der | 503 b | shared |
996 | lsass.exe | GET | 200 | 195.138.255.16:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNNqn9%2FnsFRcp9pdHKYPIeI7A%3D%3D | DE | der | 503 b | shared |
2352 | vguuu.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | text | 255 b | malicious |
3568 | Xteat12.exe | GET | 200 | 2.56.59.245:80 | http://2.56.59.245/server.txt | unknown | text | 18 b | suspicious |
3208 | askinstall50.exe | GET | 200 | 93.184.220.29:80 | http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D | US | der | 471 b | whitelisted |
3664 | LabPicV2.tmp | GET | 200 | 63.250.33.126:80 | http://requested404.com/C_Pirlo/PicturesLab.exe | US | executable | 294 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
996 | lsass.exe | 67.26.75.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
996 | lsass.exe | 104.117.200.9:80 | x1.c.lencr.org | TPG Telecom Limited | US | unknown |
996 | lsass.exe | 195.138.255.16:80 | r3.o.lencr.org | AS33891 Netzbetrieb GmbH | DE | suspicious |
996 | lsass.exe | 195.138.255.17:80 | crl.identrust.com | AS33891 Netzbetrieb GmbH | DE | whitelisted |
3004 | Setup.exe | 195.181.169.68:443 | echo.bluewavecdn.com | — | GB | suspicious |
2980 | appsetup.exe | 195.181.164.195:443 | green.cablesparking.net | Datacamp Limited | GB | malicious |
2284 | prun.exe | 195.181.169.68:443 | echo.bluewavecdn.com | — | GB | suspicious |
2352 | vguuu.exe | 208.95.112.1:80 | ip-api.com | IBURST | — | malicious |
3568 | Xteat12.exe | 2.56.59.245:80 | — | — | — | suspicious |
3568 | Xteat12.exe | 34.117.59.81:443 | ipinfo.io | — | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
spark.lightburst.xyz |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
crl.identrust.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
echo.bluewavecdn.com |
| suspicious |
green.cablesparking.net |
| unknown |
server.sproutfrost.com |
| whitelisted |
cdn.coinchargery.com |
| whitelisted |
bucket.swiftlaunchx.com |
| suspicious |
PID | Process | Class | Message |
|---|---|---|---|
3004 | Setup.exe | Potentially Bad Traffic | ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz) |
3568 | Xteat12.exe | A Network Trojan was detected | ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) |
3568 | Xteat12.exe | Potential Corporate Privacy Violation | ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) |
2540 | umbr.exe | Potential Corporate Privacy Violation | ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
2540 | umbr.exe | A Network Trojan was detected | ET INFO AutoIt User-Agent Downloading ZIP |
2352 | vguuu.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
2352 | vguuu.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
4504 | SMCh1.tmp | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
496 | IDWCH2.tmp | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1272 | Browzar.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
Process | Message |
|---|---|
WerFault.exe | Error - |
WerFault.exe | ReadProcessMemory failed while trying to read PebBaseAddress |
WerFault.exe | |
WerFault.exe | Error - |
WerFault.exe | Failed to read the peb from the process |
WerFault.exe | |
WerFault.exe | Error - |
WerFault.exe | ReadProcessMemory failed while trying to read PebBaseAddress |
WerFault.exe | |
WerFault.exe | Error - |