File name:

espartu.exe

Full analysis: https://app.any.run/tasks/5200bfcd-9a74-4b79-a01e-13a54d062478
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: July 21, 2024, 23:23:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
botnet
zharkbot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

61547B701D759958B78B75AECA77279C

SHA1:

21E5B345BDCAAEADF6DF1359F805F63AAFABE223

SHA256:

0A18067C173A7C4BDC24B8D3A847814B30733CECFDCC305C431A3D1FCC322536

SSDEEP:

6144:JI+AhhXgL362gAxLcOgInHLgriujyLC5xg7+Qvxp:4hh43dgAxDgInrgWujeCUvxp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • espartu.exe (PID: 2648)

    • Uses Task Scheduler to run other applications

      • espartu.exe (PID: 2648)
      • espartu.exe (PID: 6928)

    • Changes the autorun value in the registry

      • espartu.exe (PID: 2648)
      • espartu.exe (PID: 6928)

    • ZHARKBOT has been detected (SURICATA)

      • espartu.exe (PID: 6928)

  • SUSPICIOUS

    • Reads the BIOS version

      • espartu.exe (PID: 2648)
      • espartu.exe (PID: 6928)
      • espartu.exe (PID: 2704)
      • espartu.exe (PID: 7192)
      • espartu.exe (PID: 3228)
      • espartu.exe (PID: 7536)
      • espartu.exe (PID: 6840)

    • Executable content was dropped or overwritten

      • espartu.exe (PID: 2648)

    • Reads the date of Windows installation

      • espartu.exe (PID: 2648)

    • Starts itself from another location

      • espartu.exe (PID: 2648)

    • Reads security settings of Internet Explorer

      • espartu.exe (PID: 6928)
      • espartu.exe (PID: 2648)

    • The process executes via Task Scheduler

      • espartu.exe (PID: 7192)
      • espartu.exe (PID: 2704)
      • espartu.exe (PID: 3228)
      • espartu.exe (PID: 7536)
      • espartu.exe (PID: 6840)

    • Connects to the server without a host name

      • espartu.exe (PID: 6928)

  • INFO

    • Checks supported languages

      • espartu.exe (PID: 2648)
      • espartu.exe (PID: 6928)
      • espartu.exe (PID: 7192)
      • espartu.exe (PID: 2704)
      • espartu.exe (PID: 3228)
      • espartu.exe (PID: 7536)
      • espartu.exe (PID: 6840)

    • Create files in a temporary directory

      • espartu.exe (PID: 2648)

    • Reads the computer name

      • espartu.exe (PID: 2648)
      • espartu.exe (PID: 6928)
      • espartu.exe (PID: 7192)
      • espartu.exe (PID: 2704)
      • espartu.exe (PID: 3228)
      • espartu.exe (PID: 7536)
      • espartu.exe (PID: 6840)

    • Reads Environment values

      • espartu.exe (PID: 6928)

    • Process checks computer location settings

      • espartu.exe (PID: 2648)

    • Checks proxy server information

      • espartu.exe (PID: 6928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:14 22:53:48+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 254464
InitializedDataSize: 86528
UninitializedDataSize: -
EntryPoint: 0x218ab
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
15
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start espartu.exe schtasks.exe no specs conhost.exe no specs #ZHARKBOT espartu.exe schtasks.exe no specs conhost.exe no specs slui.exe no specs slui.exe no specs espartu.exe no specs espartu.exe no specs espartu.exe no specs espartu.exe no specs ucpdmgr.exe no specs conhost.exe no specs espartu.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2648"C:\Users\admin\Desktop\espartu.exe" C:\Users\admin\Desktop\espartu.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\espartu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2704"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\110000000011111\espartu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3228"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\110000000011111\espartu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3836C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4816C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe" /FC:\Windows\SysWOW64\schtasks.exe—espartu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6440\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6840"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\110000000011111\espartu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6928"C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe" C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe
espartu.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\110000000011111\espartu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6968C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe" /FC:\Windows\SysWOW64\schtasks.exe—espartu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6972"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
5 195
Read events
5 110
Write events
85
Delete events
0

Modification events

(PID) Process:(2648) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\110000000011111
(PID) Process:(2648) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:espartu.exe
Value:
C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe
(PID) Process:(2648) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2648) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2648) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2648) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6928) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\110000000011111
(PID) Process:(6928) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:espartu.exe
Value:
C:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exe
(PID) Process:(6928) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6928) espartu.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2648espartu.exeC:\Users\admin\AppData\Local\Temp\110000000011111\espartu.exeexecutable
MD5:61547B701D759958B78B75AECA77279C
SHA256:0A18067C173A7C4BDC24B8D3A847814B30733CECFDCC305C431A3D1FCC322536
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
52
DNS requests
15
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6928
espartu.exe
GET
200
185.196.10.57:80
http://185.196.10.57/ev643v4/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
6928
espartu.exe
GET
200
185.196.10.57:80
http://185.196.10.57/ev643v4/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
6928
espartu.exe
GET
200
185.196.10.57:80
http://185.196.10.57/ev643v4/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
6928
espartu.exe
GET
200
185.196.10.57:80
http://185.196.10.57/ev643v4/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
6928
espartu.exe
GET
200
185.196.10.57:80
http://185.196.10.57/ev643v4/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7856
svchost.exe
4.209.33.156:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6928
espartu.exe
185.196.10.57:80
—
Simple Carrier LLC
US
unknown
2760
svchost.exe
40.115.3.253:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3404
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.136
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.130
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

PID
Process
Class
Message
6928
espartu.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
6928
espartu.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
6928
espartu.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
6928
espartu.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
6928
espartu.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
6928
espartu.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
espartu.exe