File name:

4968e32954f17682001974e1c8535bfb13563e8dcae49e719d5f40aa0bdcacdc.exe

Full analysis: https://app.any.run/tasks/b3db1b47-78ff-45ee-871f-5b321cd1bc2c
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 23:27:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
sality
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

3F95497BC142E5005086D30C6BDC2150

SHA1:

1898A149538BE1710496249ED00F1480405874CE

SHA256:

4968E32954F17682001974E1C8535BFB13563E8DCAE49E719D5F40AA0BDCACDC

SSDEEP:

3072:w+Uu27UVrL+qO1PWBGOP7W0wiHotXzuJYS3Y:w+k72biPWB77W0lIxuJZI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SALITY mutex has been found

      • 139a3f.exe (PID: 4428)
      • rundll32.exe (PID: 4516)
      • 13b24c.exe (PID: 6304)
      • 139adc.exe (PID: 4052)
      • 13b23c.exe (PID: 6292)

    • UAC/LUA settings modification

      • 139a3f.exe (PID: 4428)
      • 139adc.exe (PID: 4052)
      • 13b24c.exe (PID: 6304)

    • Changes Security Center notification settings

      • 139a3f.exe (PID: 4428)
      • 139adc.exe (PID: 4052)
      • 13b24c.exe (PID: 6304)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 4516)
      • 139a3f.exe (PID: 4428)
      • 13b24c.exe (PID: 6304)

  • INFO

    • Checks supported languages

      • 139a3f.exe (PID: 4428)
      • 139adc.exe (PID: 4052)
      • 13b24c.exe (PID: 6304)

    • Creates files or folders in the user directory

      • 139a3f.exe (PID: 4428)
      • 139adc.exe (PID: 4052)
      • 13b24c.exe (PID: 6304)

    • Reads the computer name

      • 139a3f.exe (PID: 4428)
      • 139adc.exe (PID: 4052)
      • 13b24c.exe (PID: 6304)

    • Create files in a temporary directory

      • rundll32.exe (PID: 4516)
      • 139a3f.exe (PID: 4428)
      • 13b24c.exe (PID: 6304)

    • UPX packer has been detected

      • 13b24c.exe (PID: 6304)
      • 13b23c.exe (PID: 6292)
      • 139adc.exe (PID: 4052)
      • 139a3f.exe (PID: 4428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1e9b7
UninitializedDataSize: -
InitializedDataSize: 512
CodeSize: 121856
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, DLL
TimeStamp: 2010:11:05 20:30:50+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY rundll32.exe #SALITY 139a3f.exe #SALITY 139adc.exe no specs #SALITY 13b23c.exe no specs #SALITY 13b24c.exe

Process information

PID
CMD
Path
Indicators
Parent process
4516"C:\WINDOWS\SysWOW64\rundll32.exe" C:\Users\admin\Desktop\4968e32954f17682001974e1c8535bfb13563e8dcae49e719d5f40aa0bdcacdc.exe.dll, #1C:\Windows\SysWOW64\rundll32.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4428C:\Users\admin\AppData\Local\Temp\139a3f.exeC:\Users\admin\AppData\Local\Temp\139a3f.exe
rundll32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\139a3f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4052C:\Users\admin\AppData\Local\Temp\139adc.exeC:\Users\admin\AppData\Local\Temp\139adc.exe
rundll32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\139adc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6292C:\Users\admin\AppData\Local\Temp\13b23c.exeC:\Users\admin\AppData\Local\Temp\13b23c.exe
rundll32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\13b23c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6304C:\Users\admin\AppData\Local\Temp\13b24c.exeC:\Users\admin\AppData\Local\Temp\13b24c.exe
rundll32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\13b24c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
936
Read events
652
Write events
208
Delete events
76

Modification events

(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(4428) 139a3f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:FirewallOverride
Value:
1
Executable files
6
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4516rundll32.exeC:\Users\admin\AppData\Local\Temp\139a3f.exeexecutable
MD5:73FDB8FC5AB1D8747CCD6B9EB19E5C7F
SHA256:71BEBBB11034BD0E5668FF3D5E1418F6269407DE4529453CCFA650918FE27716
4516rundll32.exeC:\Users\admin\AppData\Local\Temp\139adc.exeexecutable
MD5:73FDB8FC5AB1D8747CCD6B9EB19E5C7F
SHA256:71BEBBB11034BD0E5668FF3D5E1418F6269407DE4529453CCFA650918FE27716
4516rundll32.exeC:\Users\admin\AppData\Local\Temp\13b23c.exeexecutable
MD5:73FDB8FC5AB1D8747CCD6B9EB19E5C7F
SHA256:71BEBBB11034BD0E5668FF3D5E1418F6269407DE4529453CCFA650918FE27716
4428139a3f.exeC:\Windows\system.inibinary
MD5:D44AF8C1E42FC7113C0EF98DB8B9A9A2
SHA256:C2930F943393A57506BAF0AACD2FD1479F9DB08528EDD508ED409E5F6B983488
4516rundll32.exeC:\Users\admin\AppData\Local\Temp\13b24c.exeexecutable
MD5:73FDB8FC5AB1D8747CCD6B9EB19E5C7F
SHA256:71BEBBB11034BD0E5668FF3D5E1418F6269407DE4529453CCFA650918FE27716
630413b24c.exeC:\Users\admin\AppData\Local\Temp\winuaxyqj.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
4428139a3f.exeC:\Users\admin\AppData\Local\Temp\winpqxgu.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
18
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4504
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4504
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4504
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4504
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4504
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3464
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
unknown
google.com
  • 142.250.186.142
unknown
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
unknown
www.microsoft.com
  • 184.30.21.171
unknown
self.events.data.microsoft.com
  • 13.89.179.10
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4968e32954f17682001974e1c8535bfb13563e8dcae49e719d5f40aa0bdcacdc.exe