File name:

39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829

Full analysis: https://app.any.run/tasks/836ed0a5-40e2-4d95-a28e-a2c9f113f6ed
Verdict: Malicious activity
Threats:

Glupteba is a loader with information-stealing and traffic routing functionality. It is designed primarily to install other viruses on infected PCs but can do much more than that. In addition, it is being constantly updated, making this virus one to watch out for.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 18:29:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
uac
stealc
stealer
delphi
loader
smokeloader
smoke
trojan
glupteba
discord
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9AC50BB83FB3E38F1527374B33BF363A

SHA1:

8250E4071A4A872F7E590C147AFA0AB78DEDB4BC

SHA256:

39EDA85740817DA8E123ED2C96FBE131356B31A6A98231A522E271CD35748829

SSDEEP:

98304:0VdrE3mb7b6UNJptpIEY2yDdvM+eFzZonBceWMm/p4s6qgGETgA3I6trKPSJ+r7r:pNojiOdRH2Gn1DP8C8N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7800)
      • latestX.exe (PID: 7824)
      • latestX.exe (PID: 7900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)
      • updater.exe (PID: 4892)

    • STEALC mutex has been found

      • stealc_test2_2023-11-10_20-53.exe (PID: 7660)

    • STEALC has been detected

      • stealc_test2_2023-11-10_20-53.exe (PID: 7660)

    • Bypass User Account Control (Modify registry)

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7800)

    • Bypass User Account Control (fodhelper)

      • fodhelper.exe (PID: 7240)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • toolspub2.exe (PID: 8044)

    • SMOKE mutex has been found

      • explorer.exe (PID: 5492)

    • Modifies exclusions in Windows Defender

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)

    • Changes the autorun value in the registry

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)

    • Glupteba is detected

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 5492)

    • Uses Task Scheduler to autorun other applications

      • csrss.exe (PID: 2268)

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 5492)

    • Changes Windows Defender settings

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe (PID: 7604)
      • InstallSetup5.exe (PID: 7744)
      • explorer.exe (PID: 5492)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)
      • latestX.exe (PID: 7900)

    • Reads security settings of Internet Explorer

      • 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe (PID: 7604)

    • Windows Defender mutex has been found

      • stealc_test2_2023-11-10_20-53.exe (PID: 7660)

    • Executes application which crashes

      • stealc_test2_2023-11-10_20-53.exe (PID: 7660)
      • toolspub2.exe (PID: 8044)

    • Application launched itself

      • toolspub2.exe (PID: 7772)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)

    • Changes default file association

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7800)

    • The process bypasses the loading of PowerShell profile settings

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)

    • Starts POWERSHELL.EXE for commands execution

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)
      • explorer.exe (PID: 5492)

    • The process hides Powershell's copyright startup banner

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)

    • There is functionality for taking screenshot (YARA)

      • InstallSetup5.exe (PID: 7744)

    • Starts CMD.EXE for commands execution

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7800)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)
      • explorer.exe (PID: 5492)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 7820)

    • The process creates files with name similar to system file names

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)

    • Starts itself from another location

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)

    • Creates a software uninstall entry

      • csrss.exe (PID: 2268)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 5640)

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 5492)

    • Manipulates environment variables

      • powershell.exe (PID: 728)

    • Stops a currently running service

      • sc.exe (PID: 4268)
      • sc.exe (PID: 2344)
      • sc.exe (PID: 5352)
      • sc.exe (PID: 6940)
      • sc.exe (PID: 6760)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 7360)

    • Windows service management via SC.EXE

      • sc.exe (PID: 904)
      • sc.exe (PID: 8072)
      • sc.exe (PID: 8080)

    • Drops a system driver (possible attempt to evade defenses)

      • csrss.exe (PID: 2268)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7556)

    • The process executes via Task Scheduler

      • updater.exe (PID: 4892)

  • INFO

    • Reads the computer name

      • 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe (PID: 7604)
      • Broom.exe (PID: 7832)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7800)
      • stealc_test2_2023-11-10_20-53.exe (PID: 7660)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)

    • Process checks computer location settings

      • 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe (PID: 7604)

    • Checks supported languages

      • stealc_test2_2023-11-10_20-53.exe (PID: 7660)
      • 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe (PID: 7604)
      • InstallSetup5.exe (PID: 7744)
      • toolspub2.exe (PID: 7772)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7800)
      • Broom.exe (PID: 7832)
      • latestX.exe (PID: 7900)
      • toolspub2.exe (PID: 8044)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)

    • Create files in a temporary directory

      • 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe (PID: 7604)
      • InstallSetup5.exe (PID: 7744)

    • The sample compiled with english language support

      • InstallSetup5.exe (PID: 7744)
      • csrss.exe (PID: 2268)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 8012)
      • WerFault.exe (PID: 2108)
      • explorer.exe (PID: 5492)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 900)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 7468)
      • csrss.exe (PID: 2268)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 4724)
      • powershell.exe (PID: 7596)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 7200)
      • powershell.exe (PID: 5436)
      • powershell.exe (PID: 2504)

    • Compiled with Borland Delphi (YARA)

      • Broom.exe (PID: 7832)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4724)
      • powershell.exe (PID: 7596)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 7200)
      • powershell.exe (PID: 5436)
      • powershell.exe (PID: 2504)

    • Reads security settings of Internet Explorer

      • cmd.exe (PID: 6632)
      • fodhelper.exe (PID: 7240)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4724)
      • powershell.exe (PID: 7596)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 7200)
      • powershell.exe (PID: 2504)
      • powershell.exe (PID: 5436)

    • Checks proxy server information

      • explorer.exe (PID: 5492)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2196)
      • csrss.exe (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:10 20:15:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 13404672
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xcca9ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: newumma.exe
LegalCopyright:
OriginalFileName: newumma.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
211
Monitored processes
79
Malicious processes
11
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exe #STEALC stealc_test2_2023-11-10_20-53.exe installsetup5.exe no specs installsetup5.exe toolspub2.exe no specs e0cbefcb1af40c7d4aff4aca26621a98.exe no specs latestx.exe no specs broom.exe no specs latestx.exe werfault.exe no specs toolspub2.exe cmd.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe e0cbefcb1af40c7d4aff4aca26621a98.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs #GLUPTEBA e0cbefcb1af40c7d4aff4aca26621a98.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs #SMOKE explorer.exe csrss.exe powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs mountvol.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe conhost.exe no specs powershell.exe conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe conhost.exe no specs updater.exe no specs schtasks.exe no specs conhost.exe no specs slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
300mountvol B: /dC:\Windows\SysWOW64\mountvol.exe—csrss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Mount Volume Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mountvol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900"C:\Users\admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe" C:\Users\admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe—fodhelper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
904sc sdset WinmonFS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)C:\Windows\SysWOW64\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188powercfg /x -standby-timeout-dc 0C:\Windows\System32\powercfg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2108C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8044 -s 400C:\Windows\SysWOW64\WerFault.exe—toolspub2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2192schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\WINDOWS\rss\csrss.exe" /TN csrss /FC:\Windows\System32\schtasks.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
56 217
Read events
56 171
Write events
44
Delete events
2

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:00000000000402CC
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(7832) Broom.exeKey:HKEY_CURRENT_USER\SOFTWARE\Broom
Operation:writeName:Key
Value:
XZWEN-27MCX-Z9JD1-USCSW
(PID) Process:(7832) Broom.exeKey:HKEY_CURRENT_USER\SOFTWARE\Broom
Operation:writeName:Date
Value:
ABBD89A6785CE640
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:OSArchitecture
Value:
64-bit
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:IsAdmin
Value:
1
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:CPU
Value:
Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CLASSES_ROOT\ms-settings\shell\open\command
Operation:writeName:DelegateExecute
Value:
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:Servers
Value:
https://realupdate.ru
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:UUID
Value:
(PID) Process:(7800) e0cbefcb1af40c7d4aff4aca26621a98.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:FirstInstallDate
Value:
FF262A6800000000
Executable files
12
Suspicious files
10
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
8012WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stealc_test2_202_79d96d8e5f81342a9bcf3fbfc1dbecbc3fe7fc4_208d8927_bd04798d-ad9c-4cd7-8df2-981ae2a13ec7\Report.wer —
MD5:—
SHA256:—
2108WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_toolspub2.exe_d9d067e465df2dd78a76b198b1f34a7811154948_1046aabe_060ad37c-0d3c-49e1-a10f-300f42b84a68\Report.wer —
MD5:—
SHA256:—
760439eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exeC:\Users\admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeexecutable
MD5:C17EBD5D9F6D55B9A332C12759AD399A
SHA256:925BF37C3AF92E3D122776D4314CCDDCE0EC08DA4975D0966DDED34DF81DA9AC
760439eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exeC:\Users\admin\AppData\Local\Temp\InstallSetup5.exeexecutable
MD5:BC3354A4CD405A2F2F98E8B343A7D08D
SHA256:FFFC160A4C555057143383FEC606841CD2C319F79F52596E0D27322A677DCA0B
760439eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829.exeC:\Users\admin\AppData\Local\Temp\stealc_test2_2023-11-10_20-53.exeexecutable
MD5:2D6C7296D5AFC3DB438EACDE190EF214
SHA256:0DFF3ED25841BFAEE12C7D6FE7ED329D0A1586DA066F173444B9242BD05A4E94
7744InstallSetup5.exeC:\Users\admin\AppData\Local\Temp\Broom.exeexecutable
MD5:00E93456AA5BCF9F60F84B0C0760A212
SHA256:FF3025F9CF19323C5972D14F00F01296D6D7A71547ECA7E4016BFD0E1F27B504
8012WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\stealc_test2_2023-11-10_20-53.exe.7660.dmpbinary
MD5:98FAAE6E5D32D67011AD6AA31B937D37
SHA256:3FE0DB0CC848F6C055179D8BB14F7DEF74BFB2084642B0A4E21129B29E625D21
8012WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD024.tmp.WERInternalMetadata.xmlbinary
MD5:290AA629FF98C0D9BDA0931A4A65487D
SHA256:B94E46E190DC3073A7F7439FB3D96E03565CB8D750F54FD5A3557622BFDB7D43
2108WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE236.tmp.xmlxml
MD5:955F979921F919BA71F85F142FA52D43
SHA256:F6A11339B8C7D01923C594DD7092A4BE6796E5ABBD9BDBB2AF232D09EA84E29A
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
28
DNS requests
21
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.174:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
188.40.141.211:80
http://host-file-host6.com/
unknown
—
—
malicious
7268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
188.40.141.211:80
http://host-file-host6.com/
unknown
—
—
malicious
—
—
GET
200
23.48.23.174:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.174:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.174:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.174
  • 23.48.23.166
  • 23.48.23.163
  • 23.48.23.175
  • 23.48.23.158
  • 23.48.23.170
  • 23.48.23.169
  • 23.48.23.161
  • 23.48.23.157
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 216.58.212.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.65
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
host-file-host6.com
  • 188.40.141.211
malicious
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
5492
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
2268
csrss.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829