URL:

http://dxstat.club/tom.exe

Full analysis: https://app.any.run/tasks/ca29b3ec-b95c-442e-9798-a386f1b430c1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 13, 2019, 09:52:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

86FB4E2E212237ACEB45524F155B15EB

SHA1:

1CAF21251796EE85EB8239BB58E9F34C18A5FF5D

SHA256:

0C4DBA63E239B967FA39BCC62E3374D5E155C65F6EF4B3F18BAEC120DB60E0C5

SSDEEP:

3:N1KadNLeQHKs2AC:CadE5s2AC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • tom[1].exe (PID: 2712)
      • exqjwf.exe (PID: 2996)
      • exqjwf.exe (PID: 2388)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3512)

    • Loads the Task Scheduler DLL interface

      • tom[1].exe (PID: 2712)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3512)
      • iexplore.exe (PID: 3024)
      • tom[1].exe (PID: 2712)

    • Creates files in the program directory

      • tom[1].exe (PID: 2712)

    • Executed via Task Scheduler

      • exqjwf.exe (PID: 2996)
      • exqjwf.exe (PID: 2388)

    • Creates files in the Windows directory

      • tom[1].exe (PID: 2712)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3512)
      • iexplore.exe (PID: 3024)

    • Application launched itself

      • iexplore.exe (PID: 3024)

    • Changes internet zones settings

      • iexplore.exe (PID: 3024)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 3512)
      • tom[1].exe (PID: 2712)

    • Reads the hosts file

      • exqjwf.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe tom[1].exe exqjwf.exe no specs exqjwf.exe

Process information

PID
CMD
Path
Indicators
Parent process
2388C:\ProgramData\pxuq\exqjwf.exe start2C:\ProgramData\pxuq\exqjwf.exe
taskeng.exe
User:
admin
Company:
ExxonMobil
Integrity Level:
MEDIUM
Description:
Dreams Kaizen Vs2005 No
Exit code:
0
Version:
7.2.2.1
Modules
Images
c:\programdata\pxuq\exqjwf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
2712"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\tom[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\tom[1].exe
iexplore.exe
User:
admin
Company:
ExxonMobil
Integrity Level:
MEDIUM
Description:
Dreams Kaizen Vs2005 No
Exit code:
0
Version:
7.2.2.1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\lh043oam\tom[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2996C:\ProgramData\pxuq\exqjwf.exe start2C:\ProgramData\pxuq\exqjwf.exe—taskeng.exe
User:
admin
Company:
ExxonMobil
Integrity Level:
MEDIUM
Description:
Dreams Kaizen Vs2005 No
Exit code:
0
Version:
7.2.2.1
Modules
Images
c:\programdata\pxuq\exqjwf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3024"C:\Program Files\Internet Explorer\iexplore.exe" "http://dxstat.club/tom.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3512"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3024 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
761
Read events
708
Write events
50
Delete events
3

Modification events

(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{2BEB2779-D60C-11E9-B86F-5254004A04AF}
Value:
0
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(3024) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307090005000D000900340012009E03
Executable files
3
Suspicious files
3
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
3024iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF01C535CFBB663A16.TMP —
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF003ABB335B3DF400.TMP —
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{2BEB2779-D60C-11E9-B86F-5254004A04AF}.dat —
MD5:—
SHA256:—
2712tom[1].exeC:\ProgramData\pxuq\exqjwf.exe\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
3024iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2BEB277A-D60C-11E9-B86F-5254004A04AF}.datbinary
MD5:—
SHA256:—
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M40JV6A6\tom[1].exeexecutable
MD5:—
SHA256:—
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019091320190914\index.datdat
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
5
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2388
exqjwf.exe
GET
—
204.13.164.118:80
http://204.13.164.118/tor/status-vote/current/consensus
US
—
—
suspicious
2388
exqjwf.exe
GET
—
89.245.113.114:9030
http://89.245.113.114:9030/tor/server/fp/d503fbb19be69f63d7acaa9b67caa2ac7b448b11
DE
—
—
suspicious
2388
exqjwf.exe
GET
—
89.245.113.114:9030
http://89.245.113.114:9030/tor/server/fp/d1b1a550fee3a05e71ca9080d14cca3b746c0c17
DE
—
—
suspicious
3512
iexplore.exe
GET
200
5.101.181.35:80
http://dxstat.club/tom.exe
EE
executable
575 Kb
suspicious
3024
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2388
exqjwf.exe
204.13.164.118:80
—
Riseup Networks
US
suspicious
3512
iexplore.exe
5.101.181.35:80
dxstat.club
Fastvps Eesti Ou
EE
suspicious
2388
exqjwf.exe
188.120.234.26:443
—
JSC ISPsystem
RU
malicious
2388
exqjwf.exe
89.245.113.114:9030
—
1&1 Versatel Deutschland GmbH
DE
suspicious
—
—
89.245.113.114:9030
—
1&1 Versatel Deutschland GmbH
DE
suspicious
3024
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2388
exqjwf.exe
23.23.73.124:443
api.ipify.org
Amazon.com, Inc.
US
malicious
2388
exqjwf.exe
31.184.196.232:53
—
Petersburg Internet Network ltd.
RU
unknown

DNS requests

Domain
IP
Reputation
dxstat.club
  • 5.101.181.35
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
tom.bit
  • —
suspicious
api.ipify.org
  • 23.23.73.124
  • 23.23.83.153
  • 54.243.147.226
  • 23.21.121.219
  • 23.23.229.94
  • 50.19.218.16
  • 54.243.198.12
  • 23.23.243.154
shared

Threats

PID
Process
Class
Message
3512
iexplore.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
3512
iexplore.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3512
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2388
exqjwf.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
2388
exqjwf.exe
Potentially Bad Traffic
ET INFO DNS Query Domain .bit
2388
exqjwf.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2388
exqjwf.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2388
exqjwf.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 331
2388
exqjwf.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 252
2388
exqjwf.exe
Potential Corporate Privacy Violation
ET P2P TOR 1.0 Server Key Retrieval
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://dxstat.club/tom.exe