File name:

doc20250319-00812.bat

Full analysis: https://app.any.run/tasks/d39e7f97-818e-48da-a6b0-9033f1e20599
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:12:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
exfiltration
smtp
evasion
ultravnc
rmm-tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

03F67448DB4E4A7E0A6F3735B0AF43C2

SHA1:

E332BAD3D934B3E343986FCD56E51CDCCB34C512

SHA256:

21D9D1538062ED4D3044A2EA3664DAB908C851BED41BA7D1C6216BE8C1194EBB

SSDEEP:

49152:P9Il04r0poL/BpDFB/kBW9RyJinX1wd2/OMlWNUEaqm95fUakC9qnsYaqpDJS+l8:/u0poL/HD/yW9RMk1ebNan9qnsYaqpdK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6048)

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 7732)

    • Steals credentials from Web Browsers

      • msiexec.exe (PID: 7732)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • doc20250319-00812.bat.exe (PID: 4776)

    • Starts POWERSHELL.EXE for commands execution

      • doc20250319-00812.bat.exe (PID: 4776)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 6048)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • msiexec.exe (PID: 7732)

    • Connects to SMTP port

      • msiexec.exe (PID: 7732)

    • The process connected to a server suspected of theft

      • msiexec.exe (PID: 7732)

  • INFO

    • The sample compiled with english language support

      • doc20250319-00812.bat.exe (PID: 4776)

    • Checks supported languages

      • doc20250319-00812.bat.exe (PID: 4776)

    • Reads the computer name

      • doc20250319-00812.bat.exe (PID: 4776)

    • Create files in a temporary directory

      • doc20250319-00812.bat.exe (PID: 4776)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6048)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6048)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6048)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6048)

    • Checks proxy server information

      • msiexec.exe (PID: 7732)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7732)

    • Reads the software policy settings

      • msiexec.exe (PID: 7732)
      • slui.exe (PID: 5772)

    • Disables trace logs

      • msiexec.exe (PID: 7732)

    • ULTRAVNC has been detected

      • msiexec.exe (PID: 7732)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7732)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:05:11 20:03:42+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x30e2
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.5.0.0
ProductVersionNumber: 3.5.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: recommendatory
CompanyName: hjlpevirksomhederne slmninger ordrenavn
FileDescription: sudder flsk
FileVersion: 3.5.0.0
LegalCopyright: korrektes polonick akrteria
LegalTrademarks: agnostics
OriginalFileName: missyllabification.exe
ProductName: barbermaskiners pieshop beeware
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start doc20250319-00812.bat.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe msiexec.exe svchost.exe slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3784C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4776"C:\Users\admin\AppData\Local\Temp\doc20250319-00812.bat.exe" C:\Users\admin\AppData\Local\Temp\doc20250319-00812.bat.exe—explorer.exe
User:
admin
Company:
hjlpevirksomhederne slmninger ordrenavn
Integrity Level:
MEDIUM
Description:
sudder flsk
Exit code:
0
Version:
3.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\doc20250319-00812.bat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5772"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6048"powershell.exe" -windowstyle hidden " $Making=cat -raw 'C:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Mezzaninetage.Hit';$Kludetpperne=$Making.substring(12736,3);.$Kludetpperne($Making)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—doc20250319-00812.bat.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6544C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7732"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
8144C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
10 366
Read events
10 329
Write events
37
Delete events
0

Modification events

(PID) Process:(4776) doc20250319-00812.bat.exeKey:HKEY_CURRENT_USER\signalment\autoptically
Operation:writeName:palaeoniscoid
Value:
6F21
(PID) Process:(6544) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties
Operation:writeName:LID
Value:
0018001399B923AF
(PID) Process:(6544) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
6057E26700000000
(PID) Process:(6544) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
B8CC100000000000
(PID) Process:(6544) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
6357E26700000000
(PID) Process:(6544) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
60D8100000000000
(PID) Process:(6544) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02vomrtdzuvrmjqc
Operation:writeName:AppIdList
Value:
(PID) Process:(6544) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02vomrtdzuvrmjqc
Operation:writeName:Reason
Value:
(PID) Process:(6544) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18
Operation:writeName:ValidDeviceId
Value:
(PID) Process:(6544) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-1693682860-607145093-2874071422-1001\02lovhkbrcdhdqxh
Operation:writeName:AppIdList
Value:
Executable files
1
Suspicious files
8
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Regulatorens.uzb —
MD5:—
SHA256:—
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\blastocoelic.udh —
MD5:—
SHA256:—
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\radioblges\liberales.ske —
MD5:—
SHA256:—
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Engagements.txttext
MD5:6699B3214F48E4EAE5E5365B62D99FBD
SHA256:67F3F56FB3FA00CAA8FDDCA739D18886523A07C5A7CE0420978A86F11B6269E4
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Surterhvervede140.Jesbinary
MD5:B565DE72C3CC21AD9B4A54C1CE2C80B0
SHA256:C3B636A47531C24257236CF2E67ACF530B094F3988F8DF2A04EC38D7F195F7F0
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Afhndernes.jpgimage
MD5:ADB224FF686271068EA73A555F4591CA
SHA256:341AF8803E1B5A232803086BC1B60E8E83207CB9807708629D15F01DDC0CC7A2
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\fyldstoffet.barbinary
MD5:C597534C123E47AE1008065EC9BA84BD
SHA256:5080314DE8DFB413D94390425758F9A433E026882569626018EEA2EEB34F10A5
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Himles\stallenger.txttext
MD5:3D93F12FC3C0DCD44A6F44FC06622F99
SHA256:789A9A03C302A2CEF7FA21EB0905F0B4EAA7A66AAB3C8EFB58B2E18DC0852E03
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\divorced.initext
MD5:4B649E9C34B90DEB4D38AC7F83DC2450
SHA256:1A81EE0409CDB4F128BDD0FCB27CFD06BA81702362281D063B5BB5265FF3F05F
4776doc20250319-00812.bat.exeC:\Users\admin\AppData\Local\Temp\Reguardant30\taoist\Mezzaninetage.Hittext
MD5:7486868ADFAE0729F7387D9A76FA5726
SHA256:A0EE82059EA62FC302BA843F18FAF797AA3C441F613ED7EBA70C0E4779009502
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7792
SIHClient.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7792
SIHClient.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7732
msiexec.exe
GET
200
2.19.105.127:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
5256
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7732
msiexec.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5256
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5256
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.128
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 92.123.22.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7732
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7732
msiexec.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7732
msiexec.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
doc20250319-00812.bat