File name:

1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe

Full analysis: https://app.any.run/tasks/43d221c8-5f27-4ce4-bac5-212c9b15c9f6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: April 15, 2025, 19:11:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
smoke
loader
smokeloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

805D475D63CB9E43DD2B2A4E51FEF22E

SHA1:

2CD2F35437E227BFDCC5D493C53AA33EA96EF6E8

SHA256:

1C1D81EAF1A389D4DAFC6BA71A3E3BFAA477A49B4D3591956CAB660165648028

SSDEEP:

12288:eTh5JY0pVjcB7QkVVVVVVVVVVVlVVVVVVVVVVVVVOGDbfbDOv:SRjcB7QKX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 5492)
    • Runs injected code in another process

      • 1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe (PID: 6584)
    • SMOKE mutex has been found

      • explorer.exe (PID: 5492)
    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 5492)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 5492)
  • INFO

    • The sample compiled with czech language support

      • 1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe (PID: 6584)
      • explorer.exe (PID: 5492)
    • Creates files or folders in the user directory

      • explorer.exe (PID: 5492)
    • Checks proxy server information

      • explorer.exe (PID: 5492)
    • Reads the software policy settings

      • explorer.exe (PID: 5492)
    • Checks supported languages

      • 1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe (PID: 6584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:28 06:24:28+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 130560
InitializedDataSize: 185344
UninitializedDataSize: -
EntryPoint: 0x177e
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 66.0.0.0
ProductVersionNumber: 5.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Patched, Private build, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Czech
CharacterSet: Unknown (01E2)
FileVersion: 23.53.15.58
ProductVersion: 2.39.3.51
InternalName: Sleep
LegalCopyright: Landing
CompanyName: Idel
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe no specs sppextcomobj.exe no specs slui.exe no specs #SMOKE explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
2140"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4112C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5492C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
6584"C:\Users\admin\AppData\Local\Temp\1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe" C:\Users\admin\AppData\Local\Temp\1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
780
Read events
779
Write events
1
Delete events
0

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000300000000000000
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5492explorer.exeC:\Users\admin\AppData\Roaming\bjcgshjexecutable
MD5:805D475D63CB9E43DD2B2A4E51FEF22E
SHA256:1C1D81EAF1A389D4DAFC6BA71A3E3BFAA477A49B4D3591956CAB660165648028
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5492
explorer.exe
POST
301
69.57.162.18:80
http://yosoborno.com/tmp/
unknown
5512
SIHClient.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
5512
SIHClient.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5492
explorer.exe
69.57.162.18:80
yosoborno.com
NAMECHEAP-NET
US
unknown
5492
explorer.exe
69.57.162.18:443
yosoborno.com
NAMECHEAP-NET
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.67
  • 40.126.32.133
  • 20.190.160.65
  • 20.190.160.5
  • 20.190.160.130
  • 20.190.160.132
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
yosoborno.com
  • 69.57.162.18
unknown
wshcnsd.xyz
unknown
nusdhj.ws
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
No debug info