| File name: | file |
| Full analysis: | https://app.any.run/tasks/9e2aec92-ce21-4393-8522-7f851e2ad6c8 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | September 23, 2024, 22:22:29 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | D373B4B79DF48249752714876F9CA220 |
| SHA1: | B3A700F70E22287AED6A8E218FF239B77A70B461 |
| SHA256: | 5202F99BAF32BD7C0DF659637B99CFBD53F7BD3D171ECF61529FEC4DAF7E71B4 |
| SSDEEP: | 98304:lPIr3Zw2XRx+ZtgGrqdytJoER1fwT24nNsSkVMd3qhNPj97U/dumh+63LEANsJHy:iIk |
| .dll | | | Win32 Dynamic Link Library (generic) (43.5) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (29.8) |
| .exe | | | Generic Win/DOS Executable (13.2) |
| .exe | | | DOS Executable Generic (13.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:09:23 18:57:51+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 118272 |
| InitializedDataSize: | 2365952 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x69e000 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2084 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
Stealc(PID) Process(2084) file.exe C2185.215.113.37 Strings (212)INSERT_KEY_HERE 30 10 20 24 GetProcAddress LoadLibraryA lstrcatA OpenEventA CreateEventA CloseHandle Sleep GetUserDefaultLangID VirtualAllocExNuma VirtualFree GetSystemInfo VirtualAlloc HeapAlloc GetComputerNameA lstrcpyA GetProcessHeap GetCurrentProcess lstrlenA ExitProcess GlobalMemoryStatusEx GetSystemTime SystemTimeToFileTime advapi32.dll gdi32.dll user32.dll crypt32.dll ntdll.dll GetUserNameA CreateDCA GetDeviceCaps ReleaseDC CryptStringToBinaryA sscanf VMwareVMware HAL9TH JohnDoe DISPLAY %hu/%hu/%hu http://185.215.113.37 silence !| /e2b1563c6670f193.php /0d60be0de163924d/ save GetEnvironmentVariableA GetFileAttributesA GlobalLock HeapFree GetFileSize GlobalSize CreateToolhelp32Snapshot IsWow64Process Process32Next GetLocalTime FreeLibrary GetTimeZoneInformation GetSystemPowerStatus GetVolumeInformationA GetWindowsDirectoryA Process32First GetLocaleInfoA GetUserDefaultLocaleName GetModuleFileNameA DeleteFileA FindNextFileA LocalFree FindClose SetEnvironmentVariableA LocalAlloc GetFileSizeEx ReadFile SetFilePointer WriteFile CreateFileA FindFirstFileA CopyFileA VirtualProtect GetLogicalProcessorInformationEx GetLastError lstrcpynA MultiByteToWideChar GlobalFree WideCharToMultiByte GlobalAlloc OpenProcess TerminateProcess GetCurrentProcessId gdiplus.dll ole32.dll bcrypt.dll wininet.dll shlwapi.dll shell32.dll psapi.dll rstrtmgr.dll CreateCompatibleBitmap SelectObject BitBlt DeleteObject CreateCompatibleDC GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipSaveImageToStream GdipDisposeImage GdipFree GetHGlobalFromStream CreateStreamOnHGlobal CoUninitialize CoInitialize CoCreateInstance BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptDecrypt BCryptSetProperty BCryptDestroyKey BCryptOpenAlgorithmProvider GetWindowRect GetDesktopWindow GetDC CloseWindow wsprintfA EnumDisplayDevicesA GetKeyboardLayoutList CharToOemW wsprintfW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegEnumValueA CryptBinaryToStringA CryptUnprotectData SHGetFolderPathA ShellExecuteExA InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA HttpSendRequestA HttpOpenRequestA InternetReadFile InternetCrackUrlA StrCmpCA StrStrA StrCmpCW PathMatchSpecA GetModuleFileNameExA RmStartSession RmRegisterResources RmGetList RmEndSession sqlite3_open sqlite3_prepare_v2 sqlite3_step sqlite3_column_text sqlite3_finalize sqlite3_close sqlite3_column_bytes sqlite3_column_blob encrypted_key PATH C:\ProgramData\nss3.dll NSS_Init NSS_Shutdown PK11_GetInternalKeySlot PK11_FreeSlot PK11_Authenticate PK11SDR_Decrypt C:\ProgramData\ SELECT origin_url, username_value, password_value FROM logins browser: profile: url: login: password: Opera OperaGX Network cookies .txt SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies TRUE FALSE autofill SELECT name, value FROM autofill history SELECT url FROM urls LIMIT 1000 cc SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards name: month: year: card: Cookies Login Data Web Data History logins.json formSubmitURL usernameField encryptedUsername encryptedPassword guid SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies | |||||||||||||||
| (PID) Process: | (2084) file.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2084) file.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2084) file.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2084 | file.exe | C:\ProgramData\HDGIEBGHDAEBGDGCFIID | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 2084 | file.exe | C:\ProgramData\DHIJDHIDBGHJKECBFIIDAAEHJK | sqlite | |
MD5:06AD9E737639FDC745B3B65312857109 | SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404 | |||
| 2084 | file.exe | C:\ProgramData\KECGDBFCBKFIDHIDHDHIECGDHC | — | |
MD5:— | SHA256:— | |||
| 2084 | file.exe | C:\ProgramData\EHCAEGDH | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 2084 | file.exe | C:\ProgramData\CFCBAAEBKEGHIEBFIJJKEBAFBA | binary | |
MD5:0038776EBF9A0DBB1B684F8086FED757 | SHA256:9CD06F52792D10BD70992DD6C9B617435725B3A5F03DE62050E8A52FAE2A709C | |||
| 2084 | file.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\mozglue[1].dll | executable | |
MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9 | SHA256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A | |||
| 2084 | file.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\freebl3[1].dll | executable | |
MD5:550686C0EE48C386DFCB40199BD076AC | SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA | |||
| 2084 | file.exe | C:\ProgramData\freebl3.dll | executable | |
MD5:550686C0EE48C386DFCB40199BD076AC | SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA | |||
| 2084 | file.exe | C:\ProgramData\BGIJEGCG | binary | |
MD5:95FFD778940E6DF4846B0B12C8DD5821 | SHA256:21A2DEBD389DB456465DFEFFDB15F0AF3FBC46F007CBA67513A13EB10D14E94F | |||
| 2084 | file.exe | C:\ProgramData\EHCAEGDHJKFHJKFIJKJE | sqlite | |
MD5:29A644B1F0D96166A05602FE27B3F4AD | SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
2084 | file.exe | GET | 200 | 185.215.113.37:80 | http://185.215.113.37/ | unknown | — | — | unknown |
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
2120 | MoUsoCoreWorker.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
2084 | file.exe | GET | 200 | 185.215.113.37:80 | http://185.215.113.37/0d60be0de163924d/sqlite3.dll | unknown | — | — | unknown |
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
2084 | file.exe | POST | 200 | 185.215.113.37:80 | http://185.215.113.37/e2b1563c6670f193.php | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6248 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5092 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 23.52.120.96:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4324 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2084 | file.exe | 185.215.113.37:80 | — | 1337team Limited | SC | malicious |
2064 | svchost.exe | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2064 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2084 | file.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] Stealc HTTP POST Request |
2084 | file.exe | Malware Command and Control Activity Detected | ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in |
2084 | file.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/Stealc Requesting plugins Config from C2 |
2084 | file.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/Stealc Requesting browsers Config from C2 |
2084 | file.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/Stealc Submitting System Information to C2 |
2084 | file.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host DLL Request |
2084 | file.exe | A suspicious filename was detected | ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity |
2084 | file.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2084 | file.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2084 | file.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host DLL Request |
Process | Message |
|---|---|
file.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|