File name:

252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe

Full analysis: https://app.any.run/tasks/261d7dc6-741d-4036-8170-d7d1c919edcc
Verdict: Malicious activity
Analysis date: February 27, 2024, 03:55:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C0B35F4104C86A49E25177941D7A7014

SHA1:

8E5DE6EF45FF073EA5C23177B12F40EC2B439FAD

SHA256:

252C26A5EA749569E41B4CE291EA4FF21D08CA884123C8FF171433A359455033

SSDEEP:

24576:GmwvLvu1luK64OlT6IQERGhR4cAMY3/zZR+BBWiG4Xife9D2q0JRU519iIA0lWsF:GmwvLvu1luK64OlT6IQERG0cAMY3/zZW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

    • Executable content was dropped or overwritten

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

  • INFO

    • Checks supported languages

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

    • Reads the computer name

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

    • Creates files or folders in the user directory

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

    • Create files in a temporary directory

      • 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe (PID: 2696)

    • Checks proxy server information

      • slui.exe (PID: 4144)

    • Reads the software policy settings

      • slui.exe (PID: 4144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:01 00:33:34+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 3782656
UninitializedDataSize: 1024
EntryPoint: 0x31ce
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: fdevareannoncer
CompanyName: vegetate
FileVersion: 2.1.0.0
InternalName: uomtvisteliges gobbo.exe
LegalCopyright: entodermic reprokameraerne modskrifter
LegalTrademarks: piroplasm
OriginalFileName: uomtvisteliges gobbo.exe
ProductName: wellholes galvanoteknikkernes annalia
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2696"C:\Users\admin\AppData\Local\Temp\252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe" C:\Users\admin\AppData\Local\Temp\252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe
explorer.exe
User:
admin
Company:
vegetate
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4144C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
3 896
Read events
3 860
Write events
36
Delete events
0

Modification events

(PID) Process:(2696) 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Ekskommuniceres225\Uninstall\mammonite\Suspired35
Operation:writeName:palaverne
Value:
1
Executable files
1
Suspicious files
13
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Cryolite.Ultbinary
MD5:433C8704EC4179684909C195EC0C0F3B
SHA256:CD0B803B9425AD5BA5F6B3D6694876EBB06250548687469452C414180416D539
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\Temp\Setup.initext
MD5:9B1323CB958B743E5D2DA6EA113669D1
SHA256:D3B25A2E18EDD0F31A3AC4B4CAEC165433EF23FFD8D99D2279B0D4ADC904BC8C
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Konsulatet\Toppingness\Langbenet\rusen.pedbinary
MD5:31DCD26CD5B7A9B1D8B750C0A5084B32
SHA256:B6D414B645AB9D377D7B9F6F6D173817BF7D54593CC759562365AD7DBD99340E
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Kontrolafdelings216\Huldsagligst\Interties\Marioneteatret.unbbinary
MD5:60FEF47E6BD9F7C263CFF641CC8FE04F
SHA256:53D091B6A6F3DE87BC79070D2732ED72BA77F68A7D96E0275D35865F6A583D7A
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Sistningen159\Unshrewish\Fusus.txttext
MD5:36F7F42E523C5DCBCBB1BDB9D741BE9D
SHA256:FBC57234C4DCDD3B1D523731FC5438455F7E4A55CB2F591DD0BD7B81A53E69A6
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Konsulatet\Toppingness\Langbenet\bistandslovs.sugbinary
MD5:1FFA44AC8DB21CD73EBBFEA41967E09B
SHA256:F1FB4832D3424E3C418FFF4A4055C1C7DD88566F6D263CAC097E6F1CF79A39EB
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Konsulatet\Toppingness\Langbenet\beraabelsernes.mutbinary
MD5:EEDE50BEF8DB7C08DA538AF0C1267BE3
SHA256:EE256FD2BCCC7A7E4BECEEFD63E3AE6E10CBDE54DA600112630971D1DF9B680C
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Konsulatet\Toppingness\Langbenet\Throwout.sexbinary
MD5:646AD1D53D22C74CD54D3DF03CEA89A3
SHA256:21C90607AD6BFCA84A2CA8063721D109EF991A6E85F920E0703D0411A9CB8ABB
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Konsulatet\Toppingness\Langbenet\Twinemaking.skrabr
MD5:EF36912877948015D2A6489C5630B2FF
SHA256:4147A6D277BB33683EB9584CCD12A1E8D28F47B1B3EAD2251AC77843147276D0
2696252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exeC:\Users\admin\AppData\Local\olaf\eclairs\capitalised\Konsulatet\Toppingness\Langbenet\kong.tjabinary
MD5:F2697B92E93280E6F4B8B39139781E19
SHA256:D16C16832D4A1304E91F6505CCF06F2EE53615153E9783BBD3AADA9994DBA1DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6896
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
5928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1312
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
6256
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
2464
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5928
svchost.exe
40.126.32.74:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6896
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5928
svchost.exe
20.190.160.20:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5928
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
6256
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
492
backgroundTaskHost.exe
92.123.104.31:443
www.bing.com
Akamai International B.V.
DE
unknown
6896
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.31
  • 92.123.104.32
  • 92.123.104.38
  • 92.123.104.63
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033.exe