File name:

28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1

Full analysis: https://app.any.run/tasks/6eda160b-7f7e-4448-8167-10a2115cb1c2
Verdict: Malicious activity
Analysis date: June 21, 2024, 02:23:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
netreactor
smtp
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

664EEDDDC4B4C9FB0A0E49031FF336B5

SHA1:

F242FC3E7125D08E904AC858B9B6EE85B3646B2D

SHA256:

28226B0D4031F520FD0FB0DB89DF6E6FD6A01460B1948F941D945AEB7E586BC1

SSDEEP:

24576:ssDcKjjB3A3U3WbXcI3ZTLc5m6vCxmdqOPgWMQ+4SlmOg/CTr+BRMdEhx0iCrhM5:sc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3212)

    • Changes the autorun value in the registry

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3212)

    • Application launched itself

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • ivou.exe (PID: 1504)
      • ivou.exe (PID: 2864)

    • The process executes via Task Scheduler

      • ivou.exe (PID: 1504)
      • ivou.exe (PID: 2864)

    • Connects to unusual port

      • ivou.exe (PID: 1980)

    • Connects to SMTP port

      • ivou.exe (PID: 1980)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3416)
      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3212)
      • ivou.exe (PID: 1504)
      • ivou.exe (PID: 1980)
      • ivou.exe (PID: 2864)
      • ivou.exe (PID: 3676)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3416)

    • Reads the computer name

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • wmpnscfg.exe (PID: 3416)
      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3212)
      • ivou.exe (PID: 1504)
      • ivou.exe (PID: 1980)
      • ivou.exe (PID: 2864)

    • Reads the machine GUID from the registry

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • ivou.exe (PID: 1504)
      • ivou.exe (PID: 2864)

    • .NET Reactor protector has been detected

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)
      • ivou.exe (PID: 1504)
      • ivou.exe (PID: 2864)

    • Creates files or folders in the user directory

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3380)

    • Creates files in the program directory

      • 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe (PID: 3212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:15 11:16:38+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 4436480
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x43d1fa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: natruncontrol
FileVersion: 1.0.0.0
InternalName: natruncontrol.exe
LegalCopyright: Copyright © 2020
LegalTrademarks: -
OriginalFileName: natruncontrol.exe
ProductName: natruncontrol
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe wmpnscfg.exe no specs 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe THREAT ivou.exe no specs ivou.exe THREAT ivou.exe no specs ivou.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1504C:\ProgramData\epnlld\ivou.exe C:\ProgramData\epnlld\ivou.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Description:
natruncontrol
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\epnlld\ivou.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1980"C:\ProgramData\epnlld\ivou.exe"C:\ProgramData\epnlld\ivou.exe
ivou.exe
User:
admin
Integrity Level:
MEDIUM
Description:
natruncontrol
Version:
1.0.0.0
Modules
Images
c:\programdata\epnlld\ivou.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2864C:\ProgramData\epnlld\ivou.exe C:\ProgramData\epnlld\ivou.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Description:
natruncontrol
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\epnlld\ivou.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3212"C:\Users\admin\AppData\Local\Temp\28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe"C:\Users\admin\AppData\Local\Temp\28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe
28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
natruncontrol
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3380"C:\Users\admin\AppData\Local\Temp\28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe" C:\Users\admin\AppData\Local\Temp\28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
natruncontrol
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3416"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3676"C:\ProgramData\epnlld\ivou.exe"C:\ProgramData\epnlld\ivou.exe—ivou.exe
User:
admin
Integrity Level:
MEDIUM
Description:
natruncontrol
Version:
1.0.0.0
Modules
Images
c:\programdata\epnlld\ivou.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
887
Read events
886
Write events
1
Delete events
0

Modification events

(PID) Process:(3380) 28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Immmsbclaz
Value:
C:\Users\admin\AppData\Roaming\Immmsbclaz.exe
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
321228226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exeC:\Windows\Tasks\Test Task17.jobbinary
MD5:7AF8406A833BEF9CCC29C98C87A5C78B
SHA256:74E3A2D537142594E35368636D702C78CEC3E21A3F19412F9D1A1010622B84BF
338028226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exeC:\Users\admin\AppData\Roaming\Immmsbclaz.exeexecutable
MD5:664EEDDDC4B4C9FB0A0E49031FF336B5
SHA256:28226B0D4031F520FD0FB0DB89DF6E6FD6A01460B1948F941D945AEB7E586BC1
321228226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1.exeC:\ProgramData\epnlld\ivou.exeexecutable
MD5:664EEDDDC4B4C9FB0A0E49031FF336B5
SHA256:28226B0D4031F520FD0FB0DB89DF6E6FD6A01460B1948F941D945AEB7E586BC1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
87
DNS requests
58
Threats
33

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a9f83325acc8ca75
unknown
—
—
unknown
1372
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1372
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
1060
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1980
ivou.exe
185.43.220.45:4000
claywyaeropumps.com
WIBO Baltic UAB
NL
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
claywyaeropumps.com
  • 185.43.220.45
unknown
smtp.frontiernet.net
  • 66.133.129.10
shared
mail.atlanticbb.net
  • 38.111.141.32
unknown
smtp.vinsysinfo.com
  • 23.81.68.43
unknown
smtp.iprimus.com.au
  • 203.134.153.82
shared
smtp.freemail.hu
  • 84.2.43.67
unknown

Threats

PID
Process
Class
Message
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
1980
ivou.exe
Generic Protocol Command Decode
SURICATA SMTP invalid reply
1980
ivou.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
28226b0d4031f520fd0fb0db89df6e6fd6a01460b1948f941d945aeb7e586bc1