File name:

malbomb.exe

Full analysis: https://app.any.run/tasks/9922030d-a378-4c65-8bba-657c730d6dbd
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 27, 2023, 19:02:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
kelihos
trojan
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

1B39F40A03129F2B640E61FEAAC089A6

SHA1:

EFAABEC12D2C13D2A07B1C9699158D6ABF1E76A1

SHA256:

3176AAB6F98D39995829E4C2C501FD5B02D16F2768E8B7E7FFA368EA937403F7

SSDEEP:

1536:ud3syM2MGPPwM2MGnkM2MGpvM2MG4G0M2MGpvM2MG4GuhftMvV+t:sDM2MGPPwM2MGnkM2MGpvM2MG4G0M2M5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • malbomb.exe (PID: 2040)

    • KELIHOS has been detected (SURICATA)

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Block-list domains

      • malbomb.exe (PID: 2040)

    • Reads security settings of Internet Explorer

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Reads the Internet Settings

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Connects to unusual port

      • malbomb.exe (PID: 5596)
      • malbomb.exe (PID: 2040)

    • Connects to the server without a host name

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Checks Windows Trust Settings

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Process requests binary or script from the Internet

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

  • INFO

    • Drops the executable file immediately after the start

      • malbomb.exe (PID: 2040)

    • Checks proxy server information

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Checks supported languages

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Reads the computer name

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Reads the machine GUID from the registry

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)

    • Create files in a temporary directory

      • malbomb.exe (PID: 2040)

    • Manual execution by a user

      • malbomb.exe (PID: 5596)

    • Creates files or folders in the user directory

      • malbomb.exe (PID: 2040)
      • malbomb.exe (PID: 5596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:27 20:04:38+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 18944
InitializedDataSize: 12800
UninitializedDataSize: -
EntryPoint: 0x4ada
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #KELIHOS malbomb.exe #KELIHOS malbomb.exe

Process information

PID
CMD
Path
Indicators
Parent process
2040"C:\Users\admin\Desktop\malbomb.exe" C:\Users\admin\Desktop\malbomb.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\malbomb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\api-ms-win-core-timezone-l1-1-0.dll
c:\windows\system32\api-ms-win-core-file-l2-1-0.dll
5596"C:\Users\admin\Desktop\malbomb.exe" C:\Users\admin\Desktop\malbomb.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\malbomb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\api-ms-win-core-timezone-l1-1-0.dll
c:\windows\system32\api-ms-win-core-file-l2-1-0.dll
Total events
30 949
Read events
30 874
Write events
75
Delete events
0

Modification events

(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(2040) malbomb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionTime
Value:
58815650F738DA01
Executable files
0
Suspicious files
129
Text files
67
Unknown types
1

Dropped files

PID
Process
Filename
Type
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:CB666A11D397575FC80608F6076C15D2
SHA256:9CA75A6081D1D764D36BB63DC8E7177ACBEB11A281E5F0CCB7893C35441F7B54
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_89709BA6A8E04CB298EC71539929CC6Dbinary
MD5:6CAC4922B97F2D2FA08603DA0E18B366
SHA256:703C67957EBF805D708B632C17959DDC4B6318F09464B7537303FDDD9931D5B4
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:9E999E95FFB9281CCB9D1CEDACE21D1A
SHA256:672335D5D1DE2C5A2DB77A576EB3075F313EDDC1640FA81A06BBD156F2D09520
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_89709BA6A8E04CB298EC71539929CC6Dbinary
MD5:2375463B063B7C7A00DA1A395CACD52F
SHA256:14FDB8E7FF9B8A43C682EBA02ED2B34745A1250D9976E0A54FB904AB0C52929C
2040malbomb.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\XV9KCFAY.txttext
MD5:8859A75824828EEB5FE751DCD2C610B5
SHA256:474E076D2DBF3482521289298E9D9180BF566DABBB19D499ACBDB424C6019BEC
2040malbomb.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:56E2AF7ED8478272CFE5C55A5DBE5E7A
SHA256:29FF494FAF1329CA7A5695CD8856D9737D8FB58815AC19FFDE7F82D2AE424579
2040malbomb.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\text[1].txttext
MD5:ABBD1DEC6BC172E111CC34BE6D7CFC8B
SHA256:FAD1532A9928B1D74B0C7E9301CB261D3B52B5A90C7FF9D47EA945A58C7A8636
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
632
TCP/UDP connections
2 451
DNS requests
354
Threats
1 610

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2040
malbomb.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
2040
malbomb.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEH3wUWDKXSh7Z3b6AuDWurw%3D
unknown
binary
1.40 Kb
unknown
2040
malbomb.exe
GET
—
185.81.157.152:333
http://185.81.157.152:333/sodium/sodium.jpg
unknown
—
—
unknown
2040
malbomb.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
2040
malbomb.exe
GET
—
185.16.38.38:555
http://185.16.38.38:555/24/b.jpg
unknown
—
—
unknown
2040
malbomb.exe
GET
—
185.172.128.32:80
http://185.172.128.32/ama.exe
unknown
—
—
unknown
2040
malbomb.exe
GET
—
77.91.68.21:80
http://77.91.68.21/nova/foxi.exe
unknown
—
—
unknown
2040
malbomb.exe
GET
404
77.91.68.21:80
http://77.91.68.21/red/line.exe
unknown
html
162 b
unknown
2040
malbomb.exe
GET
—
185.172.128.53:80
http://185.172.128.53/timeSync.exe
unknown
—
—
unknown
2040
malbomb.exe
GET
—
85.209.176.59:80
http://85.209.176.59/server/execution/WinScp.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2040
malbomb.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2040
malbomb.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2040
malbomb.exe
104.18.20.226:80
ocsp2.globalsign.com
CLOUDFLARENET
—
shared
2040
malbomb.exe
185.85.191.197:443
www.bakirkoynakliyat.gen.tr
Ideal Hosting Teknoloji A.S.
TR
unknown
2040
malbomb.exe
162.159.135.233:443
cdn.discordapp.com
CLOUDFLARENET
—
shared
2040
malbomb.exe
185.81.157.152:333
—
Inulogic Sarl
FR
unknown
2040
malbomb.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
www.bakirkoynakliyat.gen.tr
  • 185.85.191.197
unknown
cdn.discordapp.com
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.129.233
  • 162.159.134.233
  • 162.159.130.233
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted
moscow-post.ru.com
  • 127.0.0.1
unknown
artemcraft.temp.swtest.ru
  • 77.222.40.147
unknown
tmpfiles.org
  • 172.67.195.247
  • 104.21.21.16
malicious
1qwqewrewqweqwrqe.sbs
  • 104.21.94.207
  • 172.67.140.12
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
2040
malbomb.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2040
malbomb.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 21
2040
malbomb.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2040
malbomb.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2040
malbomb.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
2040
malbomb.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
2040
malbomb.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2040
malbomb.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
2040
malbomb.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malbomb.exe