File name:

malware_domains.exe

Full analysis: https://app.any.run/tasks/d0e12061-b29c-4325-ac48-d1add59ee7e1
Verdict: Malicious activity
Analysis date: July 18, 2024, 11:57:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

2E3914C51DCABC18C645B2458B16A9BB

SHA1:

9E3B203415EF8669AB65057CDE96B7A16E4B9D7C

SHA256:

0748A98947305672BA68F4A643D349150474EF0D243B4EA9ADBBC667A027A46A

SSDEEP:

98304:BXEdnnIY96Tl+2e958CWjn0BjmWxYeAMVTreRplC9O4qQWUdfKaeMwQ3y8lxAUnK:OdxWyWeq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • malware_domains.exe (PID: 6992)

  • SUSPICIOUS

    • Process drops python dynamic module

      • malware_domains.exe (PID: 6992)

    • The process drops C-runtime libraries

      • malware_domains.exe (PID: 6992)

    • Process drops legitimate windows executable

      • malware_domains.exe (PID: 6992)

    • Executable content was dropped or overwritten

      • malware_domains.exe (PID: 6992)

    • Application launched itself

      • malware_domains.exe (PID: 6992)

    • Loads Python modules

      • malware_domains.exe (PID: 6292)

    • Starts CMD.EXE for commands execution

      • malware_domains.exe (PID: 6292)

  • INFO

    • Checks supported languages

      • malware_domains.exe (PID: 6992)
      • malware_domains.exe (PID: 6292)
      • curl.exe (PID: 7420)
      • curl.exe (PID: 6156)
      • curl.exe (PID: 8024)

    • Reads the computer name

      • malware_domains.exe (PID: 6992)
      • curl.exe (PID: 7420)
      • curl.exe (PID: 6156)
      • curl.exe (PID: 8024)

    • Create files in a temporary directory

      • malware_domains.exe (PID: 6992)

    • Reads the machine GUID from the registry

      • malware_domains.exe (PID: 6292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:07:18 11:57:35+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.34
CodeSize: 166400
InitializedDataSize: 152576
UninitializedDataSize: -
EntryPoint: 0xa6a0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start malware_domains.exe conhost.exe no specs malware_domains.exe no specs cmd.exe no specs curl.exe curl.exe curl.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—malware_domains.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2928C:\WINDOWS\system32\cmd.exe /c curl -I --url "www.onradsradar.com" && curl -I --url "www.paipan.info" && curl -I --url "www.pieroricca.org" && curl -I --url "www.jackburton.blogspot.com" && curl -I --url "jalanhitam19.blogspot.com" && curl -I --url "www.javacoolsoftware.com" && curl -I --url "janquim.blogspot.com" && curl -I --url "obomcombate.blogspot.com" && curl -I --url "jaredswhite.blogspot.com" && curl -I --url "jaringanmelayumal.blogspot.com" && curl -I --url "joniandbob.blogspot.com" && curl -I --url "jonjayray.wordpress.com" && curl -I --url "jdtonline.blogspot.com" && curl -I --url "www.tweakbit.com" && curl -I --url "www.nonworkingmonkey.com" && curl -I --url "biographic.com" && curl -I --url "jenguk1kedah.blogspot.com" && curl -I --url "jenniferabel.com" && curl -I --url "geekiest.net" && curl -I --url "momocrats.com" && curl -I --url "petervenkman102.blogspot.com" && curl -I --url "www.sitehouston.com" && curl -I --url "www.splutterfish.com" && curl -I --url "yeekee365.com" && curl -I --url "lastlightsofftheblackwest.com" && curl -I --url "monsters-for-toddlers.it.softonic.com" && curl -I --url "apticirl.com" && curl -I --url "eleburic.com" && curl -I --url "toddler-cars.it.softonic.com" && curl -I --url "www.strobecorp.com" && curl -I --url "fashion-girls.it.softonic.com" && curl -I --url "cindy-s-dressup-friends.it.softonic.com" && curl -I --url "www.dragonjarcon.org" && curl -I --url "www.troy-project.com" && curl -I --url "hronia.blogalia.com" && curl -I --url "faucet.it.softonic.com" && curl -I --url "hidden-object-adventure-enchanted-spring-scenes.it.softonic.com" && curl -I --url "for-kakao-xck.de.softonic.com" && curl -I --url "kevinfeazey.blogspot.com" && curl -I --url "www.jonathanlethem.com" && curl -I --url "stadium-horn-free.softonic-id.com" && curl -I --url "citizen-calculator.de.softonic.com" && curl -I --url "os-x-server.de.softonic.com" && curl -I --url "block-puzzle-block-game.it.softonic.com" && curl -I --url "hydraulic-press-pocket.it.softonic.com" && curl -I --url "lifting-hero.softonic.com" && curl -I --url "lifting-hero.en.softonic.com" && curl -I --url "lifting-hero.softonic-id.com" && curl -I --url "www.reactionarytimes.com" && curl -I --url "presets-for-lightroom-lr-2022.softonic-id.com" && curl -I --url "www.heredown.com" && curl -I --url "www.theartofannihilation.com" && curl -I --url "jlealopez.blogspot.com" && curl -I --url "hostroset.com" && curl -I --url "www.microenterpriseworks.org" && curl -I --url "blog.eset.com" && curl -I --url "apple.blognewschannel.com" && curl -I --url "alienbikes.com" && curl -I --url "www.capitolinus.blogspot.com" && curl -I --url "kaitect.com" && curl -I --url "www.discreete-linux.org" && curl -I --url "kakimotong.blogspot.com" && curl -I --url "tm.durusau.net" && curl -I --url "shooting-terrorist-strike-free-fps-shooting-game.de.softonic.com" && curl -I --url "nightmares-from-the-deep-the-cursed-heart-windows-10.de.softonic.com" && curl -I --url "www.elgarmuseum.org" && curl -I --url "www.adlightning.com" && curl -I --url "kathleenvolp.com" && curl -I --url "www.babasupport.org" && curl -I --url "free.lavasoft.com" && curl -I --url "www.forkosh.com" && curl -I --url "wikilovesmonuments.ru" && curl -I --url "hotel-le-coureau.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "novotel-thalassa-oleron-saint-trojan.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "hotel-homard-bleu.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "hotel-le-nautile.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "hotel-mer-et-foret.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "www.ainfosystems.com" && curl -I --url "hotel-les-pins.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "hotel-les-cleunes.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "les-bris.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "village-club-arc-en-ciel.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "domaine-residentiel-de-plein-air-odalys-monplaisir-1.saint-trojan-les-bains.hotels-fr.net" && curl -I --url "greciangeek.blogspot.com" && curl -I --url "btoauto.com" && curl -I --url "www.drinksamerica.com" && curl -I --url "status.vanta.com" && curl -I --url "www.kfmonkey.blogspot.com" && curl -I --url "ashley-the-story-of-survival.softonic.com" && curl -I --url "trojansgallery.blogspot.com" && curl -I --url "www.abzar20.com" && curl -I --url "sports-bar-ps-vr-ps4.de.softonic.com" && curl -I --url "raw-data-ps-vr-ps4.de.softonic.com" && curl -I --url "dive.softonic.com" && curl -I --url "www.mycountryroads.com" && curl -I --url "www.technocracia.com" && curl -I --url "sparc-ps-vr-ps4.de.softonic.com" && curl -I --url "t2833598138554gt.sztangsong.com" && curl -I --url "loco-mania.softonic.com" && curl -I --url "astral-arrows.softonic.com"C:\Windows\System32\cmd.exe—malware_domains.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5116C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6156curl -I --url "www.paipan.info" C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\cryptsp.dll
6292"C:\Users\admin\AppData\Local\Temp\malware_domains.exe" C:\Users\admin\AppData\Local\Temp\malware_domains.exe—malware_domains.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\malware_domains.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6992"C:\Users\admin\AppData\Local\Temp\malware_domains.exe" C:\Users\admin\AppData\Local\Temp\malware_domains.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\malware_domains.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7420curl -I --url "www.onradsradar.com" C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
8024curl -I --url "www.pieroricca.org" C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\cryptsp.dll
Total events
1 272
Read events
1 272
Write events
0
Delete events
0

Modification events

No data
Executable files
51
Suspicious files
1
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\VCRUNTIME140.dllexecutable
MD5:4A365FFDBDE27954E768358F4A4CE82E
SHA256:6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:49C3FFD47257DBCB67A6BE9EE112BA7F
SHA256:322D963D2A2AEFD784E99697C59D494853D69BED8EFD4B445F59292930A6B165
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:CCE27FF9B1E78B61955682788452F785
SHA256:8EE2DE377A045C52BBB05087AE3C2F95576EDFB0C2767F40B13454F2D9F779DE
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\_bz2.pydexecutable
MD5:E91B4F8E1592DA26BACACEB542A220A8
SHA256:20895FA331712701EBFDBB9AB87E394309E910F1D782929FD65B59ED76D9C90F
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\_hashlib.pydexecutable
MD5:7C69CB3CB3182A97E3E9A30D2241EBED
SHA256:12A84BACB071B1948A9F751AC8D0653BA71A8F6B217A69FE062608E532065C20
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\_lzma.pydexecutable
MD5:493C33DDF375B394B648C4283B326481
SHA256:6384DED31408788D35A89DC3F7705EA2928F6BBDEB8B627F0D1B2D7B1EA13E16
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\_socket.pydexecutable
MD5:FD1CFE0F0023C5780247F11D8D2802C9
SHA256:258A5F0B4D362B2FED80B24EEABCB3CDD1602E32FF79D87225DA6D15106B17A6
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\_ssl.pydexecutable
MD5:34B1D4DB44FC3B29E8A85DD01432535F
SHA256:E4AA33B312CEC5AA5A0B064557576844879E0DCCC40047C9D0A769A1D03F03F6
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:E5912B05988259DAD0D6D04C8A17D19B
SHA256:9F3608C15C5DE2F577A2220CE124B530825717D778F1E3941E536A3AB691F733
6992malware_domains.exeC:\Users\admin\AppData\Local\Temp\_MEI69922\api-ms-win-core-libraryloader-l1-1-0.dllexecutable
MD5:5D5FAE1A17961D6EE37637F04FE99B8A
SHA256:8E01EB923FC453F927A7ECA1C8AA5643E43B360C76B648088F51B31488970AA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
16
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7420
curl.exe
HEAD
301
142.250.186.51:80
http://www.onradsradar.com/
unknown
—
—
whitelisted
6156
curl.exe
HEAD
301
104.219.55.130:80
http://www.paipan.info/
unknown
—
—
unknown
8024
curl.exe
HEAD
—
104.21.68.62:80
http://www.pieroricca.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
20.103.156.88:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4716
svchost.exe
20.190.159.71:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7420
curl.exe
142.250.186.51:80
www.onradsradar.com
GOOGLE
US
unknown
6156
curl.exe
104.219.55.130:80
www.paipan.info
ATLANTIC-NET-1
US
unknown
3616
backgroundTaskHost.exe
20.223.35.26:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2760
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
www.onradsradar.com
  • 142.250.186.51
unknown
www.paipan.info
  • 104.219.55.130
unknown
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
www.pieroricca.org
  • 104.21.68.62
  • 172.67.191.35
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.128
  • 104.126.37.184
  • 104.126.37.130
  • 104.126.37.137
  • 104.126.37.186
  • 104.126.37.163
  • 104.126.37.168
  • 104.126.37.139
whitelisted
licensing.mp.microsoft.com
  • 4.209.32.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malware_domains.exe