| File name: | bloom.exe |
| Full analysis: | https://app.any.run/tasks/cee2bad3-1933-498e-860c-9e33518c8dda |
| Verdict: | Malicious activity |
| Analysis date: | August 15, 2024, 16:03:32 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64, for MS Windows |
| MD5: | 8D9E0C99A4A3EA89FEA641A072841817 |
| SHA1: | 789C59E630C8CF3288D0EA6F8EFBC4EDF1DCAE5E |
| SHA256: | 3C15D81C0BFCAFE14AC885B04E13A2C0C7E93832C6251A83F998B6AC3293D577 |
| SSDEEP: | 98304:AQWOuksuDfLYvI9yf+8Gm1MitPd+acSU5jqV5HjzE5DE1SUOHH5bPjlYiLonqMnv:n6E1Z7UqIpivysmHO63 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops the executable file immediately after the start
- bloom.exe (PID: 6432)
Process drops legitimate windows executable
- bloom.exe (PID: 6432)
Process drops python dynamic module
- bloom.exe (PID: 6432)
The process drops C-runtime libraries
- bloom.exe (PID: 6432)
Executable content was dropped or overwritten
- bloom.exe (PID: 6432)
Application launched itself
- bloom.exe (PID: 6432)
Starts CMD.EXE for commands execution
- bloom.exe (PID: 6500)
Loads Python modules
- bloom.exe (PID: 6500)
INFO
Reads the computer name
- bloom.exe (PID: 6432)
Checks supported languages
- bloom.exe (PID: 6432)
- bloom.exe (PID: 6500)
Create files in a temporary directory
- bloom.exe (PID: 6432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:05:17 13:10:48+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.38 |
| CodeSize: | 176640 |
| InitializedDataSize: | 108544 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb9e0 |
| OSVersion: | 5.2 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows command line |
Total processes
136
Monitored processes
5
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6432 | "C:\Users\admin\AppData\Local\Temp\bloom.exe" | C:\Users\admin\AppData\Local\Temp\bloom.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 6440 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | bloom.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6500 | "C:\Users\admin\AppData\Local\Temp\bloom.exe" | C:\Users\admin\AppData\Local\Temp\bloom.exe | — | bloom.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 6520 | C:\WINDOWS\system32\cmd.exe /c | C:\Windows\System32\cmd.exe | — | bloom.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6540 | C:\WINDOWS\system32\cmd.exe /c cls | C:\Windows\System32\cmd.exe | — | bloom.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
439
Read events
439
Write events
0
Delete events
0
Modification events
Executable files
25
Suspicious files
1
Text files
9
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_socket.pyd | executable | |
MD5:899380B2D48DF53414B974E11BB711E3 | SHA256:B38E66E6EE413E5955EF03D619CADD40FCA8BE035B43093D2342B6F3739E883E | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_uuid.pyd | executable | |
MD5:3C8737723A903B08D5D718336900FD8C | SHA256:BB418E91E543C998D11F9E65FD2A4899B09407FF386E059A88FE2A16AED2556B | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_ssl.pyd | executable | |
MD5:9B4E74FD1DE0F8A197E4AA1E16749186 | SHA256:A4CE52A9E0DADDBBE7A539D1A7EDA787494F2173DDCC92A3FAF43B7CF597452B | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_queue.pyd | executable | |
MD5:6E00E0821BB519333CCFD4E61A83CB38 | SHA256:2AD02D49691A629F038F48FCDEE46A07C4FCC2CB0620086E7B09AC11915AE6B7 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_wmi.pyd | executable | |
MD5:EE33F4C8D17D17AD62925E85097B0109 | SHA256:79ADCA5037D9145309D3BD19F7A26F7BB7DA716EE86E01073C6F2A9681E33DAD | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\_brotli.cp312-win_amd64.pyd | executable | |
MD5:9AD5BB6F92EE2CFD29DDE8DD4DA99EB7 | SHA256:788ACBFD0EDD6CA3EF3E97A9487EEAEA86515642C71CB11BBCF25721E6573EC8 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\charset_normalizer\md__mypyc.cp312-win_amd64.pyd | executable | |
MD5:BF9A9DA1CF3C98346002648C3EAE6DCF | SHA256:4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\base_library.zip | compressed | |
MD5:3909F1A45B16C6C6EF797032DE7E3B61 | SHA256:56CCE68DA6A7EBD11AAB4B4A4E6A164647B42B29AE57656532C530D1E22E5B44 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\certifi\cacert.pem | text | |
MD5:302B49C5F476C0AE35571430BB2E4AA0 | SHA256:CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748 | |||
| 6432 | bloom.exe | C:\Users\admin\AppData\Local\Temp\_MEI64322\cryptography-42.0.7.dist-info\LICENSE | text | |
MD5:8C3617DB4FB6FAE01F1D253AB91511E4 | SHA256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
46
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5540 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | binary | 471 b | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | US | binary | 313 b | whitelisted |
5540 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | binary | 471 b | whitelisted |
6852 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | US | binary | 471 b | whitelisted |
6900 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | US | binary | 471 b | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | US | binary | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4080 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
2064 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4080 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5336 | SearchApp.exe | 104.126.37.131:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5540 | svchost.exe | 40.126.31.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3260 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
th.bing.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |