| File name: | bloom.exe |
| Full analysis: | https://app.any.run/tasks/cee2bad3-1933-498e-860c-9e33518c8dda |
| Verdict: | Malicious activity |
| Analysis date: | August 15, 2024, 16:03:32 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64, for MS Windows |
| MD5: | 8D9E0C99A4A3EA89FEA641A072841817 |
| SHA1: | 789C59E630C8CF3288D0EA6F8EFBC4EDF1DCAE5E |
| SHA256: | 3C15D81C0BFCAFE14AC885B04E13A2C0C7E93832C6251A83F998B6AC3293D577 |
| SSDEEP: | 98304:AQWOuksuDfLYvI9yf+8Gm1MitPd+acSU5jqV5HjzE5DE1SUOHH5bPjlYiLonqMnv:n6E1Z7UqIpivysmHO63 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Process drops legitimate windows executable
- bloom.exe (PID: 6432)
Executable content was dropped or overwritten
- bloom.exe (PID: 6432)
Application launched itself
- bloom.exe (PID: 6432)
Loads Python modules
- bloom.exe (PID: 6500)
Process drops python dynamic module
- bloom.exe (PID: 6432)
Drops the executable file immediately after the start
- bloom.exe (PID: 6432)
The process drops C-runtime libraries
- bloom.exe (PID: 6432)
Starts CMD.EXE for commands execution
- bloom.exe (PID: 6500)
INFO
Checks supported languages
- bloom.exe (PID: 6432)
- bloom.exe (PID: 6500)
Reads the computer name
- bloom.exe (PID: 6432)
Create files in a temporary directory
- bloom.exe (PID: 6432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:05:17 13:10:48+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.38 |
| CodeSize: | 176640 |
| InitializedDataSize: | 108544 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb9e0 |
| OSVersion: | 5.2 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows command line |
Total processes
136
Monitored processes
5
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6432 | "C:\Users\admin\AppData\Local\Temp\bloom.exe" | C:\Users\admin\AppData\Local\Temp\bloom.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 6440 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | bloom.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6500 | "C:\Users\admin\AppData\Local\Temp\bloom.exe" | C:\Users\admin\AppData\Local\Temp\bloom.exe | — | bloom.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 6520 | C:\WINDOWS\system32\cmd.exe /c | C:\Windows\System32\cmd.exe | — | bloom.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6540 | C:\WINDOWS\system32\cmd.exe /c cls | C:\Windows\System32\cmd.exe | — | bloom.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
439
Read events
439
Write events
0
Delete events
0
Modification events
Executable files
25
Suspicious files
1
Text files
9
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\VCRUNTIME140.dll | executable | |
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6 | SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_queue.pyd | executable | |
MD5:6E00E0821BB519333CCFD4E61A83CB38 | SHA256:2AD02D49691A629F038F48FCDEE46A07C4FCC2CB0620086E7B09AC11915AE6B7 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_decimal.pyd | executable | |
MD5:21C73E7E0D7DAD7A1FE728E3B80CE073 | SHA256:A28C543976AA4B6D37DA6F94A280D72124B429F458D0D57B7DBCF71B4BEA8F73 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_brotli.cp312-win_amd64.pyd | executable | |
MD5:9AD5BB6F92EE2CFD29DDE8DD4DA99EB7 | SHA256:788ACBFD0EDD6CA3EF3E97A9487EEAEA86515642C71CB11BBCF25721E6573EC8 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_bz2.pyd | executable | |
MD5:C7CE973F261F698E3DB148CCAD057C96 | SHA256:02D772C03704FE243C8DE2672C210A5804D075C1F75E738D6130A173D08DFCDE | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_ctypes.pyd | executable | |
MD5:10FDCF63D1C3C3B7E5861FBB04D64557 | SHA256:BC3B83D2DC9E2F0E6386ED952384C6CF48F6EED51129A50DFD5EF6CBBC0A8FB3 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\certifi\cacert.pem | text | |
MD5:302B49C5F476C0AE35571430BB2E4AA0 | SHA256:CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\base_library.zip | compressed | |
MD5:3909F1A45B16C6C6EF797032DE7E3B61 | SHA256:56CCE68DA6A7EBD11AAB4B4A4E6A164647B42B29AE57656532C530D1E22E5B44 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\cryptography-42.0.7.dist-info\INSTALLER | text | |
MD5:365C9BFEB7D89244F2CE01C1DE44CB85 | SHA256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\cryptography-42.0.7.dist-info\LICENSE.APACHE | text | |
MD5:4E168CCE331E5C827D4C2B68A6200E1B | SHA256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
46
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5540 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5540 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6852 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6900 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4080 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
2064 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4080 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5336 | SearchApp.exe | 104.126.37.131:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5540 | svchost.exe | 40.126.31.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3260 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
th.bing.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |