File name:

f341b4a5c0a06527b76c573daad05db5.exe

Full analysis: https://app.any.run/tasks/071d4ab7-f69b-4417-a39a-57a44f0ab5f6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 28, 2024, 13:48:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
stealc
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

F341B4A5C0A06527B76C573DAAD05DB5

SHA1:

9001F1DFA4E5EEF13E10AA576D41D0561B7616E1

SHA256:

3D2718666C3752352B1EB6FFE954277708D1A75C607217A5C501C210929F11A4

SSDEEP:

24576:IyDG+W79BZvlf3gg76r3DJRKki1LlTBJ5NT4ETiP+9AbCpp50d:IyDG+W79BZvlf3gg76r3DJRKki1LlBJ4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • StealC has been detected

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • STEALC has been detected (SURICATA)

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Starts CMD.EXE for self-deleting

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Stealers network behavior

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Connects to the CnC server

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2632)
    • Starts CMD.EXE for commands execution

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Process requests binary or script from the Internet

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Reads security settings of Internet Explorer

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Executes application which crashes

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Windows Defender mutex has been found

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Potential Corporate Privacy Violation

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Connects to the server without a host name

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Contacting a server suspected of hosting an CnC

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
  • INFO

    • Creates files or folders in the user directory

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Checks supported languages

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Reads the computer name

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
    • Checks proxy server information

      • f341b4a5c0a06527b76c573daad05db5.exe (PID: 5284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (47.3)
.exe | Win32 Executable MS Visual C++ (generic) (35.5)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:05 09:24:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 605184
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0x606a
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 36.0.0.0
ProductVersionNumber: 95.0.0.0
FileFlagsMask: 0x765a
FileFlags: (none)
FileOS: Unknown (0x326)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Unknown (0324)
CharacterSet: Unknown (14E6)
FileVersions: 100.87.46.11
InternalName: PinchesHotLapas
FileDescription: Sandia
LegalCopyright: Copyright (C) 2023, Sheet
ProductName: Passia
ProductVersions: 10.7.12.48
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #STEALC f341b4a5c0a06527b76c573daad05db5.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1376timeout /t 5 C:\Windows\SysWOW64\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2632"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\admin\Desktop\f341b4a5c0a06527b76c573daad05db5.exe" & del "C:\ProgramData\*.dll"" & exitC:\Windows\SysWOW64\cmd.exef341b4a5c0a06527b76c573daad05db5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5284"C:\Users\admin\Desktop\f341b4a5c0a06527b76c573daad05db5.exe" C:\Users\admin\Desktop\f341b4a5c0a06527b76c573daad05db5.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\f341b4a5c0a06527b76c573daad05db5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6384C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5284 -s 1604C:\Windows\SysWOW64\WerFault.exe
f341b4a5c0a06527b76c573daad05db5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
6 467
Read events
6 464
Write events
3
Delete events
0

Modification events

(PID) Process:(5284) f341b4a5c0a06527b76c573daad05db5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5284) f341b4a5c0a06527b76c573daad05db5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5284) f341b4a5c0a06527b76c573daad05db5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_f341b4a5c0a06527_bacce55988d75fbdf3ae2593c0d11ef154211cf6_f18ce249_178f3845-dc23-4fa6-904e-7ad4064894ae\Report.wer
MD5:
SHA256:
6384WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE49C.tmp.dmpbinary
MD5:58AAD394B789615832A0E8CCC69A4927
SHA256:98392978263BA95E7F99C5A0A0F8A043D4D33C3FBAFAE2D12E95543C41C4D6D1
6384WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE5D7.tmp.xmlxml
MD5:F6D055A4AD41E859B1B1CFECFE5EE591
SHA256:31789C86040A1E5BB56CD68F2967ECE60F757F22EA206F7A7EE3E6DFBE49AF37
6384WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE5B6.tmp.WERInternalMetadata.xmlxml
MD5:194AE1CFCCA5FEF16859E3E29CA1E34A
SHA256:73761594DA0EFC00FA5A8AA98A9A7D14E1DF68DFBB5D3A9D24BE72C9905FAD48
6384WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\f341b4a5c0a06527b76c573daad05db5.exe.5284.dmpbinary
MD5:CFC77AB1A8DC59B9C6632C691D6D94EA
SHA256:1F1D8955C72D5CE9B0B826777FB6A17CF9D834836C593625E79FFA5B273F9545
5284f341b4a5c0a06527b76c573daad05db5.exeC:\ProgramData\chrome.dllexecutable
MD5:EDA18948A989176F4EEBB175CE806255
SHA256:81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
22
DNS requests
10
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5284
f341b4a5c0a06527b76c573daad05db5.exe
GET
200
194.15.46.65:80
http://194.15.46.65/
unknown
malicious
5284
f341b4a5c0a06527b76c573daad05db5.exe
POST
200
194.15.46.65:80
http://194.15.46.65/7e57db3b864b30f1.php
unknown
malicious
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5284
f341b4a5c0a06527b76c573daad05db5.exe
POST
200
194.15.46.65:80
http://194.15.46.65/7e57db3b864b30f1.php
unknown
malicious
1280
RUXIMICS.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5284
f341b4a5c0a06527b76c573daad05db5.exe
POST
200
194.15.46.65:80
http://194.15.46.65/7e57db3b864b30f1.php
unknown
malicious
5284
f341b4a5c0a06527b76c573daad05db5.exe
POST
200
194.15.46.65:80
http://194.15.46.65/7e57db3b864b30f1.php
unknown
malicious
5284
f341b4a5c0a06527b76c573daad05db5.exe
POST
200
194.15.46.65:80
http://194.15.46.65/7e57db3b864b30f1.php
unknown
malicious
1280
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5284
f341b4a5c0a06527b76c573daad05db5.exe
POST
200
194.15.46.65:80
http://194.15.46.65/7e57db3b864b30f1.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1280
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
whitelisted
5284
f341b4a5c0a06527b76c573daad05db5.exe
194.15.46.65:80
Zomro B.V.
NL
malicious
5488
MoUsoCoreWorker.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1280
RUXIMICS.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.143
  • 2.23.209.156
  • 2.23.209.141
  • 2.23.209.148
  • 2.23.209.142
  • 2.23.209.140
  • 2.23.209.154
  • 2.23.209.144
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.51
  • 2.16.164.43
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
self.events.data.microsoft.com
  • 20.189.173.5
whitelisted

Threats

PID
Process
Class
Message
5284
f341b4a5c0a06527b76c573daad05db5.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
5284
f341b4a5c0a06527b76c573daad05db5.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc HTTP POST Request
5284
f341b4a5c0a06527b76c573daad05db5.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting browsers Config from C2
5284
f341b4a5c0a06527b76c573daad05db5.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting plugins Config from C2
5284
f341b4a5c0a06527b76c573daad05db5.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Submitting System Information to C2
5284
f341b4a5c0a06527b76c573daad05db5.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
5284
f341b4a5c0a06527b76c573daad05db5.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity
5284
f341b4a5c0a06527b76c573daad05db5.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5284
f341b4a5c0a06527b76c573daad05db5.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1 ETPRO signatures available at the full report
No debug info