File name:

49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe

Full analysis: https://app.any.run/tasks/396fe8c0-3668-4863-84f8-c2a75330c57d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 03, 2024, 09:41:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5:

CC4E1505C522D2FCE0C2A26350D93358

SHA1:

DA25347D9B53E41A7A59ABDFD276A18BF9DD2179

SHA256:

49411986F4AA94BA64416791D4ECDB0A0C0250FC1D220F760771AC45DA9C33AB

SSDEEP:

192:1O37tinq71IUJh8K1ZudYAhWZnd7jINaNSrZc7Fb4WlJdxqHX1Vki:14pPIUJhZ7djCWlJj+ki

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094158416.exe (PID: 5420)
      • 242603094230916.exe (PID: 1864)
      • 242603094148478.exe (PID: 7140)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094306791.exe (PID: 6932)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094148478.exe (PID: 7140)
      • 242603094230916.exe (PID: 1864)
      • 242603094158416.exe (PID: 5420)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094306791.exe (PID: 6932)

    • Starts CMD.EXE for commands execution

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094158416.exe (PID: 5420)
      • 242603094148478.exe (PID: 7140)
      • 242603094230916.exe (PID: 1864)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094306791.exe (PID: 6932)

    • The executable file from the user directory is run by the CMD process

      • 242603094139150.exe (PID: 6784)
      • 242603094148478.exe (PID: 7140)
      • 242603094158416.exe (PID: 5420)
      • 242603094230916.exe (PID: 1864)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094316259.exe (PID: 7008)
      • 242603094306791.exe (PID: 6932)

  • INFO

    • Reads the computer name

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094148478.exe (PID: 7140)
      • 242603094158416.exe (PID: 5420)
      • 242603094230916.exe (PID: 1864)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094316259.exe (PID: 7008)
      • 242603094306791.exe (PID: 6932)

    • Checks supported languages

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094148478.exe (PID: 7140)
      • 242603094158416.exe (PID: 5420)
      • 242603094230916.exe (PID: 1864)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094316259.exe (PID: 7008)
      • 242603094306791.exe (PID: 6932)

    • Checks proxy server information

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094148478.exe (PID: 7140)
      • 242603094158416.exe (PID: 5420)
      • 242603094230916.exe (PID: 1864)
      • 242603094257837.exe (PID: 6960)
      • 242603094241025.exe (PID: 5108)
      • 242603094316259.exe (PID: 7008)
      • 242603094306791.exe (PID: 6932)

    • Create files in a temporary directory

      • 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe (PID: 6232)
      • 242603094139150.exe (PID: 6784)
      • 242603094148478.exe (PID: 7140)
      • 242603094158416.exe (PID: 5420)
      • 242603094230916.exe (PID: 1864)
      • 242603094241025.exe (PID: 5108)
      • 242603094257837.exe (PID: 6960)
      • 242603094316259.exe (PID: 7008)
      • 242603094306791.exe (PID: 6932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.2)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 6
CodeSize: 9216
InitializedDataSize: 4096
UninitializedDataSize: -
EntryPoint: 0x3008
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
20
Malicious processes
9
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe conhost.exe no specs cmd.exe no specs 242603094139150.exe cmd.exe no specs 242603094148478.exe cmd.exe no specs 242603094158416.exe cmd.exe no specs 242603094230916.exe sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs 242603094241025.exe cmd.exe no specs 242603094257837.exe cmd.exe no specs 242603094306791.exe cmd.exe no specs 242603094316259.exe

Process information

PID
CMD
Path
Indicators
Parent process
1008C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1864C:\Users\admin\AppData\Local\Temp\242603094230916.exe 000004C:\Users\admin\AppData\Local\Temp\242603094230916.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\242603094230916.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
2308C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\242603094241025.exe 000005C:\Windows\System32\cmd.exe—242603094230916.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4360C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\242603094158416.exe 000003C:\Windows\System32\cmd.exe—242603094148478.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5108C:\Users\admin\AppData\Local\Temp\242603094241025.exe 000005C:\Users\admin\AppData\Local\Temp\242603094241025.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\242603094241025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
5176"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5420C:\Users\admin\AppData\Local\Temp\242603094158416.exe 000003C:\Users\admin\AppData\Local\Temp\242603094158416.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\242603094158416.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
5840C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\242603094230916.exe 000004C:\Windows\System32\cmd.exe—242603094158416.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6232"C:\Users\admin\AppData\Local\Temp\49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe" C:\Users\admin\AppData\Local\Temp\49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
6240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 000
Read events
4 000
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
623249411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exeC:\Users\admin\AppData\Local\Temp\242603094139150.exeexecutable
MD5:EF7AF0A7E836DEC88C703961F8EB96C5
SHA256:D1F9909CB1C0D8BB384BDC1BBA64582481E0225A9C6B678C0C99AE919D2EB0E9
1864242603094230916.exeC:\Users\admin\AppData\Local\Temp\242603094241025.exeexecutable
MD5:D63F53777D76A85F259341BF39743630
SHA256:A4F0B2D91CEC8FE58A0149325BBC03691592432B2E8AD2D7B3C16A583F8F052D
5108242603094241025.exeC:\Users\admin\AppData\Local\Temp\242603094257837.exeexecutable
MD5:5EC8E30542BD1E8B8AE13D25F478192E
SHA256:609DB0874603413CFA3E4BECB7322840D37119B683D16B428EAB418E9DBB3A5A
6960242603094257837.exeC:\Users\admin\AppData\Local\Temp\242603094306791.exeexecutable
MD5:6E98BEEEA7E05DCF46525B4E6AA6CD98
SHA256:2A253EDD0A9ADF96CF56303CF30C34CC8ABBDE8602E1D5F32A6FF2C10CEC2396
6932242603094306791.exeC:\Users\admin\AppData\Local\Temp\242603094316259.exeexecutable
MD5:B6FD29B531DF6361C7442B4FBCEFFD29
SHA256:9CD3A15D9386B2BA2DB1BA698174F31DB1002A2E5A1725F05B915FB3C72EB5D4
5420242603094158416.exeC:\Users\admin\AppData\Local\Temp\242603094230916.exeexecutable
MD5:1277AFF644BC15C3A0C7F1BD81E33E30
SHA256:E8402FA714191C52BFC3DCC2A87BE7B8C62A4AAB4942CFD3F909AF3FD7287733
7140242603094148478.exeC:\Users\admin\AppData\Local\Temp\242603094158416.exeexecutable
MD5:D55B6B08A5C0D9F2EFBE98D25F0024DC
SHA256:4886EAD834C3B21B32C241247CABD1006AAC28D99BAE29AC01D6D1B1EB3DD539
6784242603094139150.exeC:\Users\admin\AppData\Local\Temp\242603094148478.exeexecutable
MD5:CE594676D21287B47F03DFEC8CD112A9
SHA256:C2E1D8E0D5895A7BB9CED3B5B54832F282055C48141E605082539DF3A5AF2F61
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
66
DNS requests
25
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3396
svchost.exe
GET
200
62.115.252.162:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
6232
49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe
GET
200
193.70.94.19:80
http://wdit.jxoy.v5.mrmpzjjhn3sgtq5w.pro/v5/ucph/yzxt/242603094139150/000abb000ffa/000000/cnaf.bin
unknown
—
—
unknown
1604
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
3396
svchost.exe
GET
200
96.6.16.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
7140
242603094148478.exe
GET
—
193.70.94.19:80
http://koen.iovj.v5.mrmpzjjhn3sgtq5w.pro/v5/ucph/yzxt/242603094158416/000a7c000ffa/000002/qhbc.bin
unknown
—
—
unknown
6784
242603094139150.exe
GET
200
193.70.94.19:80
http://szgw.zucv.v5.mrmpzjjhn3sgtq5w.pro/v5/ucph/yzxt/242603094148478/000a9a000ffa/000001/ljjb.bin
unknown
—
—
unknown
6168
SIHClient.exe
GET
200
96.6.16.217:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6168
SIHClient.exe
GET
200
96.6.16.217:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
1864
242603094230916.exe
GET
—
193.70.94.19:80
http://iatz.tgpg.v5.mrmpzjjhn3sgtq5w.pro/v5/ucph/yzxt/242603094241025/000a6b000ffa/000004/svgt.bin
unknown
—
—
unknown
7140
242603094148478.exe
GET
200
193.70.94.19:80
http://koen.iovj.v5.mrmpzjjhn3sgtq5w.pro/v5/ucph/yzxt/242603094158416/000a7c000ffa/000002/qhbc.bin
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3396
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2280
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6232
49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe
193.70.94.19:80
wdit.jxoy.v5.mrmpzjjhn3sgtq5w.pro
OVH SAS
PL
unknown
3396
svchost.exe
62.115.252.162:80
crl.microsoft.com
Telia Company AB
ES
unknown
3396
svchost.exe
96.6.16.217:80
www.microsoft.com
AKAMAI-AS
NO
unknown
4680
SearchApp.exe
23.36.79.43:443
—
Akamai International B.V.
NO
unknown
4680
SearchApp.exe
23.36.79.24:443
—
Akamai International B.V.
NO
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
wdit.jxoy.v5.mrmpzjjhn3sgtq5w.pro
  • 193.70.94.19
unknown
crl.microsoft.com
  • 62.115.252.162
  • 62.115.252.171
whitelisted
www.microsoft.com
  • 96.6.16.217
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.64
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.67
whitelisted
go.microsoft.com
  • 104.110.17.248
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
szgw.zucv.v5.mrmpzjjhn3sgtq5w.pro
  • 193.70.94.19
unknown
koen.iovj.v5.mrmpzjjhn3sgtq5w.pro
  • 193.70.94.19
unknown
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
49411986f4aa94ba64416791d4ecdb0a0c0250fc1d220f760771ac45da9c33ab.exe