File name:

pablo.exe

Full analysis: https://app.any.run/tasks/5e215924-8354-4ea7-ba76-ecaef29a8cfa
Verdict: Malicious activity
Threats:

Meduza Stealer is an information-stealing malware primarily targeting Windows systems, designed to harvest sensitive data such as login credentials, browsing histories, cookies, cryptocurrency wallets, and password manager data. It has advanced anti-detection mechanisms, allowing it to evade many antivirus programs. The malware is distributed through various means, including phishing emails and malicious links. It’s marketed on underground forums and Telegram channels.

Malware Trends Tracker     >>>
Analysis date: January 18, 2025, 20:27:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
meduza
stealer
exfiltration
amsi-bypass
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

A45A9D7F9D4FC7EAFD45F10EAE62AD88

SHA1:

6955187B25889FC75D42A0A84AF97C6E071EB7CB

SHA256:

3A0297561D1CAB1471CD84E4C5308F19A9A33606784938235C7FF2EAA85D001C

SSDEEP:

98304:ZLmgzT65F9N9+9mEl91DoPKm9peOEkCJH5PPwH5X:ETknag

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MEDUZASTEALER has been detected (SURICATA)

      • pablo.exe (PID: 3080)

    • Steals credentials from Web Browsers

      • pablo.exe (PID: 3080)

    • Actions looks like stealing of personal data

      • pablo.exe (PID: 3080)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • pablo.exe (PID: 3080)

    • Checks Windows Trust Settings

      • pablo.exe (PID: 3080)

    • Potential Corporate Privacy Violation

      • pablo.exe (PID: 3080)

    • The process connected to a server suspected of theft

      • pablo.exe (PID: 3080)

    • Connects to unusual port

      • pablo.exe (PID: 3080)

    • Possibly patching Antimalware Scan Interface function (YARA)

      • pablo.exe (PID: 3080)

    • Searches for installed software

      • pablo.exe (PID: 3080)

    • Checks for external IP

      • pablo.exe (PID: 3080)

    • There is functionality for taking screenshot (YARA)

      • pablo.exe (PID: 3080)

  • INFO

    • Checks supported languages

      • pablo.exe (PID: 1144)
      • pablo.exe (PID: 3080)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 4740)

    • Reads the machine GUID from the registry

      • pablo.exe (PID: 1144)
      • pablo.exe (PID: 3080)

    • The process uses the downloaded file

      • dllhost.exe (PID: 4740)

    • Checks transactions between databases Windows and Oracle

      • pablo.exe (PID: 1144)

    • Reads the computer name

      • pablo.exe (PID: 1144)
      • pablo.exe (PID: 3080)

    • Process checks computer location settings

      • pablo.exe (PID: 3080)

    • Reads product name

      • pablo.exe (PID: 3080)

    • Reads Environment values

      • pablo.exe (PID: 3080)

    • Checks proxy server information

      • pablo.exe (PID: 3080)

    • Reads the software policy settings

      • pablo.exe (PID: 3080)

    • Reads the time zone

      • pablo.exe (PID: 3080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:18 12:49:56+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 314880
InitializedDataSize: 2441216
UninitializedDataSize: -
EntryPoint: 0x3e230
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pablo.exe no specs CMSTPLUA no specs Color Management no specs #MEDUZASTEALER pablo.exe

Process information

PID
CMD
Path
Indicators
Parent process
1144"C:\Users\admin\Desktop\pablo.exe" C:\Users\admin\Desktop\pablo.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1630
Modules
Images
c:\users\admin\desktop\pablo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3080"C:\Users\admin\Desktop\pablo.exe" C:\Users\admin\Desktop\pablo.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\pablo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4544C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
4740C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
Total events
4 172
Read events
4 170
Write events
1
Delete events
1

Modification events

(PID) Process:(4544) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\Calibration
Operation:writeName:DisplayCalibrator
Value:
C:\Users\admin\Desktop\pablo.exe
(PID) Process:(4544) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\Calibration
Operation:delete valueName:DisplayCalibrator
Value:
C:\Users\admin\Desktop\pablo.exe
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
6
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.26.12.205:443
https://api.ipify.org/
unknown
text
14 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4536
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4536
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4536
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3080
pablo.exe
45.130.145.152:15666
—
LLC Baxet
RU
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.173
  • 23.48.23.156
  • 23.48.23.176
  • 23.48.23.147
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
api.ipify.org
  • 104.26.12.205
  • 104.26.13.205
  • 172.67.74.152
shared
self.events.data.microsoft.com
  • 52.182.143.211
whitelisted

Threats

PID
Process
Class
Message
3080
pablo.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3080
pablo.exe
Potential Corporate Privacy Violation
ET INFO Possible IP Check api.ipify.org
3080
pablo.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Meduza Stealer
3080
pablo.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)
3080
pablo.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1
3080
pablo.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1
3080
pablo.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)
3080
pablo.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)
3080
pablo.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Meduza Stealer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pablo.exe