File name:

SonicGliders.exe

Full analysis: https://app.any.run/tasks/ea56ef2c-e699-4eb6-be80-87b4c8861e0e
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: November 13, 2023, 06:07:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
evasion
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

D9B68815EDC5C050E95C7D917D415FF9

SHA1:

8C250DB16D84F3E7B667C72275927AA1D4BF69E3

SHA256:

3FF7C0CAA6BDF36EF8DA7D9FDDD8AC754BA400F5E82CCA7A4E678306CB42DCB4

SSDEEP:

786432:l0U8BaeLLoABQ6bVKc8nOfzUA2Vm92YLJRQy7uBBjUD:l0TLLoABbbl8nOfzUA2AgY9RQy7uBBjA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SonicGliders.exe (PID: 2336)
      • Skyday_Game_Setup.exe (PID: 1532)

    • Steals credentials

      • Skyday_Game_Setup.exe (PID: 1532)

    • Actions looks like stealing of personal data

      • Skyday_Game_Setup.exe (PID: 1532)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • SonicGliders.exe (PID: 2336)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SonicGliders.exe (PID: 2336)

    • Process drops legitimate windows executable

      • SonicGliders.exe (PID: 2336)

    • Drops 7-zip archiver for unpacking

      • SonicGliders.exe (PID: 2336)

    • Application launched itself

      • Skyday_Game_Setup.exe (PID: 1532)

    • Reads the Internet Settings

      • Skyday_Game_Setup.exe (PID: 1532)

    • Reads settings of System Certificates

      • Skyday_Game_Setup.exe (PID: 1532)

    • Starts CMD.EXE for commands execution

      • Skyday_Game_Setup.exe (PID: 1532)

    • Get information on the list of running processes

      • cmd.exe (PID: 1940)
      • Skyday_Game_Setup.exe (PID: 1532)
      • cmd.exe (PID: 2868)

    • Uses REG/REGEDIT.EXE to modify registry

      • Skyday_Game_Setup.exe (PID: 1532)

    • Reads browser cookies

      • Skyday_Game_Setup.exe (PID: 1532)

    • Checks for external IP

      • Skyday_Game_Setup.exe (PID: 1532)

  • INFO

    • Checks supported languages

      • SonicGliders.exe (PID: 2336)
      • Skyday_Game_Setup.exe (PID: 1532)
      • Skyday_Game_Setup.exe (PID: 2576)
      • Skyday_Game_Setup.exe (PID: 2796)
      • Skyday_Game_Setup.exe (PID: 2300)
      • Skyday_Game_Setup.exe (PID: 364)

    • Create files in a temporary directory

      • SonicGliders.exe (PID: 2336)
      • Skyday_Game_Setup.exe (PID: 1532)

    • Reads the computer name

      • SonicGliders.exe (PID: 2336)
      • Skyday_Game_Setup.exe (PID: 1532)
      • Skyday_Game_Setup.exe (PID: 2576)
      • Skyday_Game_Setup.exe (PID: 2796)
      • Skyday_Game_Setup.exe (PID: 2300)

    • Reads the machine GUID from the registry

      • SonicGliders.exe (PID: 2336)
      • Skyday_Game_Setup.exe (PID: 1532)

    • Reads Environment values

      • Skyday_Game_Setup.exe (PID: 1532)

    • Reads product name

      • Skyday_Game_Setup.exe (PID: 1532)

    • Creates files or folders in the user directory

      • Skyday_Game_Setup.exe (PID: 1532)
      • Skyday_Game_Setup.exe (PID: 2796)

    • Process checks computer location settings

      • Skyday_Game_Setup.exe (PID: 364)
      • Skyday_Game_Setup.exe (PID: 1532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:26:14+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Skyday_Game_Setup
FileDescription: Skyday_Game_Setup is a video game
FileVersion: 1.0.0
LegalCopyright: Copyright © 2023 Skyday_Game_Setup
ProductName: Skyday_Game_Setup
ProductVersion: 1.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sonicgliders.exe no specs skyday_game_setup.exe skyday_game_setup.exe no specs skyday_game_setup.exe skyday_game_setup.exe no specs cmd.exe no specs reg.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs skyday_game_setup.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364"C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Skyday_Game_Setup" --app-path="C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1660 --field-trial-handle=1248,i,14219065011518059604,3573842118757395464,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe—Skyday_Game_Setup.exe
User:
admin
Company:
Skyday_Game_Setup
Integrity Level:
LOW
Description:
Skyday_Game_Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\skyday_game_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1532C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe
SonicGliders.exe
User:
admin
Company:
Skyday_Game_Setup
Integrity Level:
MEDIUM
Description:
Skyday_Game_Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\skyday_game_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1940C:\Windows\system32\cmd.exe /d /s /c "tasklist"C:\Windows\System32\cmd.exe—Skyday_Game_Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2208C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsBootManager /t REG_SZ /d C:\Users\admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /fC:\Windows\System32\reg.exe—Skyday_Game_Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2300"C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Skyday_Game_Setup" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1412 --field-trial-handle=1248,i,14219065011518059604,3573842118757395464,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe—Skyday_Game_Setup.exe
User:
admin
Company:
Skyday_Game_Setup
Integrity Level:
LOW
Description:
Skyday_Game_Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\skyday_game_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2336"C:\Users\admin\AppData\Local\Temp\SonicGliders.exe" C:\Users\admin\AppData\Local\Temp\SonicGliders.exe—explorer.exe
User:
admin
Company:
Skyday_Game_Setup
Integrity Level:
MEDIUM
Description:
Skyday_Game_Setup is a video game
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\sonicgliders.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2576"C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Skyday_Game_Setup" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1248,i,14219065011518059604,3573842118757395464,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe—Skyday_Game_Setup.exe
User:
admin
Company:
Skyday_Game_Setup
Integrity Level:
LOW
Description:
Skyday_Game_Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\skyday_game_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2580tasklistC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2796"C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\Skyday_Game_Setup" --mojo-platform-channel-handle=1436 --field-trial-handle=1248,i,14219065011518059604,3573842118757395464,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Temp\2XLM29lmnWF4Jtt0HTz0HZaMo8M\Skyday_Game_Setup.exe
Skyday_Game_Setup.exe
User:
admin
Company:
Skyday_Game_Setup
Integrity Level:
MEDIUM
Description:
Skyday_Game_Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\skyday_game_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2xlm29lmnwf4jtt0htz0hzamo8m\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2848tasklistC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 345
Read events
2 331
Write events
14
Delete events
0

Modification events

(PID) Process:(1532) Skyday_Game_Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
23
Suspicious files
156
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\app-64.7z —
MD5:—
SHA256:—
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\chrome_200_percent.pakbinary
MD5:7059AF03603F93898F66981FEB737064
SHA256:04D699CFC36565FA9C06206BA1C0C51474612C8FE481C6FD1807197DC70661E6
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\locales\bg.pakbinary
MD5:6673C15B24452ED317A2143FAC853EA2
SHA256:99FEE30E8F3DC7C66EEE4F7A4B08D385CA5CC3E076D18DEC4BD83AD4693643A6
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\locales\am.pakbinary
MD5:CEA549409055B1C6FE04C6932740E94F
SHA256:FAB95A53EA884BCDD304ACF6771E6AD77C2ED0B3D019CA78D3313F9665E64420
2336SonicGliders.exeC:\Users\admin\AppData\Local\Temp\nsuC839.tmp\7z-out\locales\ar.pakbinary
MD5:A1924E7F237E038BC916FEB9365FF3FE
SHA256:FAF5D56309AAA2576214371F4A55360C2BAFE2EB6674D0FB72F2A1DC3AAE93B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
15
DNS requests
5
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2796
Skyday_Game_Setup.exe
95.168.222.18:443
r7---sn-n02xgoxufvg3-2gbz.gvt1.com
—
—
whitelisted
1532
Skyday_Game_Setup.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
2796
Skyday_Game_Setup.exe
142.250.185.238:443
redirector.gvt1.com
GOOGLE
US
whitelisted
1532
Skyday_Game_Setup.exe
188.114.97.3:443
wdb.life
CLOUDFLARENET
NL
unknown
1532
Skyday_Game_Setup.exe
162.159.129.233:443
cdn.discordapp.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
ipinfo.io
  • 34.117.59.81
shared
redirector.gvt1.com
  • 142.250.185.238
whitelisted
r7---sn-n02xgoxufvg3-2gbz.gvt1.com
  • 95.168.222.18
whitelisted
wdb.life
  • 188.114.97.3
  • 188.114.96.3
unknown
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.133.233
  • 162.159.135.233
  • 162.159.130.233
  • 162.159.134.233
shared

Threats

PID
Process
Class
Message
1532
Skyday_Game_Setup.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
324
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
1532
Skyday_Game_Setup.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SonicGliders.exe