File name:

1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af

Full analysis: https://app.any.run/tasks/b23cc658-ad84-4113-87ea-0bf4a2adde4e
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 05:45:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
dbatloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

6A5A8893D6D7274DFE3E8193B17AC279

SHA1:

B087B8734092699A75DF72FE7155E416A9A3E499

SHA256:

1868A740C4A9AD3F6DF9EE149C74DE5744E3488FAA33BF3C9811882FBB5D76AF

SSDEEP:

98304:3eLQhkW20pZul3nv33H018xW0zsa1s9VWbgyb5QsOG3SSfdKLhU+0351U5h53BKG:p20K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DBATLOADER has been detected (YARA)

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Changes the autorun value in the registry

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Reads security settings of Internet Explorer

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Drops a file with a rarely used extension (PIF)

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Executable content was dropped or overwritten

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Executes application which crashes

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

  • INFO

    • Checks supported languages

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Reads the computer name

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Compiled with Borland Delphi (YARA)

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Checks proxy server information

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Reads the software policy settings

      • 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe (PID: 6656)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DBatLoader

(PID) Process(6656) 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe
C2 (1)https://onedrive.live.com/download?resid=D2FF5C6240820574%21390&authkey=!AGUKBnnUxTdHEVQ
No Malware configuration.

TRiD

.exe | InstallShield setup (53.2)
.exe | Win32 Executable Delphi generic (17.5)
.scr | Windows screen saver (16.1)
.exe | Win32 Executable (generic) (5.5)
.exe | Win16/32 Executable Delphi generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 364032
InitializedDataSize: 2095616
UninitializedDataSize: -
EntryPoint: 0x59bf4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DBATLOADER 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe sppextcomobj.exe no specs colorcpl.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1128C:\Windows\System32\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe—1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Color Control Panel
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\colorcpl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1764C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6656 -s 1844C:\Windows\SysWOW64\WerFault.exe—1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6656"C:\Users\admin\AppData\Local\Temp\1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe" C:\Users\admin\AppData\Local\Temp\1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
DBatLoader
(PID) Process(6656) 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe
C2 (1)https://onedrive.live.com/download?resid=D2FF5C6240820574%21390&authkey=!AGUKBnnUxTdHEVQ
7148C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Total events
2 137
Read events
2 136
Write events
1
Delete events
0

Modification events

(PID) Process:(6656) 1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Grcfiidq
Value:
C:\Users\Public\Grcfiidq.url
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1764WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1868a740c4a9ad3f_5a2e6b8e8327505aaaa3127c79679429b48e1b_124a437a_e0e2a263-4eec-41ce-8126-83f6c5307451\Report.wer —
MD5:—
SHA256:—
1764WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2E13.tmp.WERInternalMetadata.xmlbinary
MD5:0AE39732CF08CEA4B2D7E9CE294E1E83
SHA256:3EE494F4E3C161A577F7148FE9EBBA7E866202C0D0E96780F20754D1C2CD058D
66561868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exeC:\Users\Public\Libraries\Grcfiidq.PIFexecutable
MD5:6A5A8893D6D7274DFE3E8193B17AC279
SHA256:1868A740C4A9AD3F6DF9EE149C74DE5744E3488FAA33BF3C9811882FBB5D76AF
1764WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exe.6656.dmpbinary
MD5:29490C2F7424542257890A1BC6B3E2A6
SHA256:EE5A391C764EAEA5062FFEE5954D811815B5742E910399F1D3C3D3C89F7BB436
66561868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af.exeC:\Users\Public\Grcfiidq.urlbinary
MD5:5E92F24B9A597C6E1F0B89F891BC10FF
SHA256:A21F5CD107B94F092003982545C34FAE5E2D429FE38F497BCD0BB7729B037753
1764WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2EFE.tmp.xmlxml
MD5:3079A6F900B396C0E67C6DC033BC4188
SHA256:D47538D6D91D67D9461060479ACBC8232F3500F996B5914E5BA2D0B89EC42BEE
1764WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2C9B.tmp.dmpbinary
MD5:DFA1ED525DDE4AFD8B915055CD576171
SHA256:3B3F33D4A4C3619485F3163CDAEB75F4372EA311169D4A245BAFC4E7A91A9BE2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
—
—
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.71
  • 40.126.31.129
  • 20.190.159.130
  • 20.190.159.75
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
onedrive.live.com
  • 13.107.137.11
  • 13.107.139.11
whitelisted
0bcbtq.bn.files.1drv.com
  • 13.107.42.12
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1868a740c4a9ad3f6df9ee149c74de5744e3488faa33bf3c9811882fbb5d76af