File name:

2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2

Full analysis: https://app.any.run/tasks/a4f700e9-4551-49e3-b51b-8136c6f4b91b
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 11:32:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dbatloader
delphi
fileshare
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

51B9FF03237BE0D2B963CECEE17844DC

SHA1:

821A54AA0FD28336D98BCA841A41F6B5E8FAEE76

SHA256:

2335A09E51DC8DD9EADCC23AFA908605A0678AA0B0FD46F180E6DD628745A0F2

SSDEEP:

98304:RyTeqQ+sMBLsnSkE5IQCtXSVhQ/BMYRyJwSuPc:B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DBATLOADER has been detected (YARA)

      • 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe (PID: 7484)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe (PID: 7484)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7172)

    • Executable content was dropped or overwritten

      • 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe (PID: 7484)

  • INFO

    • Checks supported languages

      • 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe (PID: 7484)

    • Manual execution by a user

      • wscript.exe (PID: 7172)

    • Compiled with Borland Delphi (YARA)

      • 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe (PID: 7484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DBatLoader

(PID) Process(7484) 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe
C2 (1)https://onedrive.live.com/download?resid=D2FF5C6240820574%21426&authkey=!AMDl8A5aTsh9KYQ
No Malware configuration.

TRiD

.exe | InstallShield setup (35.1)
.exe | Win32 EXE PECompact compressed (generic) (33.9)
.exe | Win32 Executable Delphi generic (11.5)
.scr | Windows screen saver (10.6)
.exe | Win32 Executable (generic) (3.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 403968
InitializedDataSize: 1469952
UninitializedDataSize: -
EntryPoint: 0x63878
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DBATLOADER 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe sppextcomobj.exe no specs slui.exe no specs sndvol.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1852/c copy "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\admin\AppData\Local\Temp\DB1" /VC:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5988"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—wscript.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
3221225534
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
7172"C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
7392C:\Windows\System32\SndVol.exeC:\Windows\SysWOW64\SndVol.exe—2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Volume Mixer
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sndvol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
7484"C:\Users\admin\AppData\Local\Temp\2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe" C:\Users\admin\AppData\Local\Temp\2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
DBatLoader
(PID) Process(7484) 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe
C2 (1)https://onedrive.live.com/download?resid=D2FF5C6240820574%21426&authkey=!AMDl8A5aTsh9KYQ
7512C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7544"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 110
Read events
1 106
Write events
4
Delete events
0

Modification events

(PID) Process:(7484) 2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Nvvzjdwl
Value:
C:\Users\Public\Nvvzjdwl.url
(PID) Process:(7172) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7172) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7172) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7172wscript.exeC:\Users\admin\AppData\Roaming\K1A5O4VA\K1Alogrg.iniimage
MD5:4AADF49FED30E4C9B3FE4A3DD6445EBE
SHA256:75034BEB7BDED9AEAB5748F4592B9E1419256CAEC474065D43E531EC5CC21C56
1852cmd.exeC:\Users\admin\AppData\Local\Temp\DB1binary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7172wscript.exeC:\Users\admin\AppData\Roaming\K1A5O4VA\K1Alogrc.inibinary
MD5:E03F207A7B9CFC4D877ED2EC64BE028E
SHA256:B17183098B6E349844A3151456EDF62C8E41B2348D2445A610C0FF1E29963067
7172wscript.exeC:\Users\admin\AppData\Roaming\K1A5O4VA\K1Alogrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
7172wscript.exeC:\Users\admin\AppData\Roaming\K1A5O4VA\K1Alogim.jpegbinary
MD5:127B5ED9C00FB0146D4B0E7986BF8480
SHA256:19D2788AEB084FFEBFB8DF72D181663FCE37B9C7B7F3BF9FD6D83EFF84C2A99A
7172wscript.exeC:\Users\admin\AppData\Roaming\K1A5O4VA\K1Alogri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
74842335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exeC:\Users\Public\Libraries\Nvvzjdwl.PIFexecutable
MD5:51B9FF03237BE0D2B963CECEE17844DC
SHA256:2335A09E51DC8DD9EADCC23AFA908605A0678AA0B0FD46F180E6DD628745A0F2
74842335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exeC:\Users\Public\Nvvzjdwl.urlbinary
MD5:F3FC7D13DD0CC6C59FAEB83AB46148B4
SHA256:8503875229614C94552A725FA8AE90D5F7A6FEFCF0BC81A89FB3DBD71E83D79A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4172
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.158
  • 23.48.23.173
  • 23.48.23.166
  • 23.48.23.162
  • 23.48.23.145
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.65
  • 40.126.32.140
  • 20.190.160.128
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
onedrive.live.com
  • 13.107.137.11
  • 13.107.139.11
whitelisted

Threats

PID
Process
Class
Message
7484
2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Downloading from a file sharing service is observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2