File name:

523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe

Full analysis: https://app.any.run/tasks/fc4968df-495a-4e6c-b5c5-fb04cf8dc0fa
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:01:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trox
stealer
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections
MD5:

C786FCD79742EA09472FE571B4F0CC3E

SHA1:

E4324DE7DC10A8F230044CE7FAD3FAE8EA6636EC

SHA256:

523D6973C4E72D8D97089788D415A19F235BBE84A6D85AE1AFFBA0AE03E51F3B

SSDEEP:

98304:DgKBngw0eicgcGV7Tee2wQPwmG4HDiwjJ8fVnCyX+kyPi0Z0O/RXKzmQFVbVLkNM:XNjXluICRKI9z2dufV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TROX has been detected

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

  • SUSPICIOUS

    • Process drops python dynamic module

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • The process drops C-runtime libraries

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Process drops legitimate windows executable

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Executable content was dropped or overwritten

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Loads Python modules

      • main.exe (PID: 1532)

  • INFO

    • The sample compiled with english language support

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Create files in a temporary directory

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Checks supported languages

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)
      • main.exe (PID: 1532)

    • Reads the machine GUID from the registry

      • main.exe (PID: 1532)

    • Reads the computer name

      • main.exe (PID: 1532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:14 05:29:34+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.43
CodeSize: 86016
InitializedDataSize: 7505920
UninitializedDataSize: 150528
EntryPoint: 0x10ba
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.2.1.0
ProductVersionNumber: 0.2.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductName: mablo
ProductVersion: 0.2.1.0
FileVersion: 0.2.1.0
OriginalFileName: main.exe
InternalName: main
FileDescription: main.exe
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #TROX 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe sppextcomobj.exe no specs slui.exe no specs main.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1532C:\Users\admin\AppData\Local\Temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\main.exe—523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe
User:
admin
Integrity Level:
MEDIUM
Description:
main.exe
Version:
0.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\onefile_4756_133917949045326862\main.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3884"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4756"C:\Users\admin\AppData\Local\Temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe" C:\Users\admin\AppData\Local\Temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
main.exe
Version:
0.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
321
Read events
321
Write events
0
Delete events
0

Modification events

No data
Executable files
22
Suspicious files
2
Text files
916
Unknown types
0

Dropped files

PID
Process
Filename
Type
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\main.exeexecutable
MD5:AB59F778E4E7510FF6096073F3D2A343
SHA256:112411BDA52E24D04F50869DBCFECD1C73B6831090AAD54FD2918E2AC79D6B41
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\libcrypto-1_1.dllexecutable
MD5:C0E55A25DD5C5447F15EED0CA6552AB7
SHA256:9FEFBA93FA3300732B7E68FB3B4DBB57BF2726889772A1D0D6694A71820D71F3
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\python3.dllexecutable
MD5:65BF7CFE0395E5743B944F05E79F7719
SHA256:5C65274ADFA565EBBC0E8F4A59C1628BCDE1250278A72DD926A15D842EC4F5BE
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_socket.pydexecutable
MD5:A4BD8E0C0597A22C3F0601FE798668AA
SHA256:96B0A3CFC16E215F0EF5D1E206F0137B4255005052720E91A58BC98CDE8C898E
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_ssl.pydexecutable
MD5:CC5C8EB32ACB2261C42A7285D436CCA9
SHA256:07EA50E536886F68473635FFEFCFCAA7266E63C478EF039BA100DDF02F88CE61
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\charset_normalizer\md.pydexecutable
MD5:27CC5F8716CE37C834BE9D61233A2685
SHA256:52A5C53F1505A252854C1C7AB13C635118BFFA1B555261002BC587F6E3D42850
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_queue.pydexecutable
MD5:8807DC228BB761439DC6525A2966E27E
SHA256:B7ED6DFB6882E8EC4267D9F80CD5B1DC0A43519382FCB72AB5E74C47875C209D
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\python37.dllexecutable
MD5:D49EAC0FAA510F2B2A8934A0F4E4A46F
SHA256:625CA7BB2D34A3986F77C0C5CE572A08FEBFCACF5050A986507E822FF694DCAA
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_hashlib.pydexecutable
MD5:E84E1BA269371E439C2D52024ACA6535
SHA256:2FCB297733E6080480AC24CF073FF5E239FB02A1CE9694313C5047F9C58D781B
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\tcl86t.dllexecutable
MD5:30195AA599DD12AC2567DE0815ADE5E6
SHA256:E79443E9413BA9A4442CA7DB8EE91A920E61AC2FB55BE10A6AB9A9C81F646DBB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
19
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6584
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6584
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.179
  • 23.48.23.190
  • 23.48.23.192
  • 23.48.23.191
  • 23.48.23.188
  • 23.48.23.181
  • 23.48.23.176
  • 23.48.23.185
  • 23.48.23.177
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.136
  • 20.190.160.4
  • 20.190.160.5
  • 40.126.32.140
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe