File name:

523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe

Full analysis: https://app.any.run/tasks/fc4968df-495a-4e6c-b5c5-fb04cf8dc0fa
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:01:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trox
stealer
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections
MD5:

C786FCD79742EA09472FE571B4F0CC3E

SHA1:

E4324DE7DC10A8F230044CE7FAD3FAE8EA6636EC

SHA256:

523D6973C4E72D8D97089788D415A19F235BBE84A6D85AE1AFFBA0AE03E51F3B

SSDEEP:

98304:DgKBngw0eicgcGV7Tee2wQPwmG4HDiwjJ8fVnCyX+kyPi0Z0O/RXKzmQFVbVLkNM:XNjXluICRKI9z2dufV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TROX has been detected

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

  • SUSPICIOUS

    • Process drops python dynamic module

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Executable content was dropped or overwritten

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • The process drops C-runtime libraries

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Process drops legitimate windows executable

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Loads Python modules

      • main.exe (PID: 1532)

  • INFO

    • The sample compiled with english language support

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Create files in a temporary directory

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)

    • Checks supported languages

      • 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe (PID: 4756)
      • main.exe (PID: 1532)

    • Reads the machine GUID from the registry

      • main.exe (PID: 1532)

    • Reads the computer name

      • main.exe (PID: 1532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:14 05:29:34+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.43
CodeSize: 86016
InitializedDataSize: 7505920
UninitializedDataSize: 150528
EntryPoint: 0x10ba
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.2.1.0
ProductVersionNumber: 0.2.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductName: mablo
ProductVersion: 0.2.1.0
FileVersion: 0.2.1.0
OriginalFileName: main.exe
InternalName: main
FileDescription: main.exe
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #TROX 523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe sppextcomobj.exe no specs slui.exe no specs main.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1532C:\Users\admin\AppData\Local\Temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\main.exe—523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe
User:
admin
Integrity Level:
MEDIUM
Description:
main.exe
Version:
0.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\onefile_4756_133917949045326862\main.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3884"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4756"C:\Users\admin\AppData\Local\Temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe" C:\Users\admin\AppData\Local\Temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
main.exe
Version:
0.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
321
Read events
321
Write events
0
Delete events
0

Modification events

No data
Executable files
22
Suspicious files
2
Text files
916
Unknown types
0

Dropped files

PID
Process
Filename
Type
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_ctypes.pydexecutable
MD5:9DB2D9962CBD754E91B40F91CBC49542
SHA256:6A6DF7D77B7A5552D8443BD1B98F681AD2E6B5A8ACF7ADE542DD369BEAB7E439
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_queue.pydexecutable
MD5:8807DC228BB761439DC6525A2966E27E
SHA256:B7ED6DFB6882E8EC4267D9F80CD5B1DC0A43519382FCB72AB5E74C47875C209D
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\main.exeexecutable
MD5:AB59F778E4E7510FF6096073F3D2A343
SHA256:112411BDA52E24D04F50869DBCFECD1C73B6831090AAD54FD2918E2AC79D6B41
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_socket.pydexecutable
MD5:A4BD8E0C0597A22C3F0601FE798668AA
SHA256:96B0A3CFC16E215F0EF5D1E206F0137B4255005052720E91A58BC98CDE8C898E
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_hashlib.pydexecutable
MD5:E84E1BA269371E439C2D52024ACA6535
SHA256:2FCB297733E6080480AC24CF073FF5E239FB02A1CE9694313C5047F9C58D781B
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_ssl.pydexecutable
MD5:CC5C8EB32ACB2261C42A7285D436CCA9
SHA256:07EA50E536886F68473635FFEFCFCAA7266E63C478EF039BA100DDF02F88CE61
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_lzma.pydexecutable
MD5:65880A33015AF2030A08987924CA737B
SHA256:A71366B95D89D1539A6EE751D48A969C1BCA1AA75116424CC5F905F32A625EEA
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\libssl-1_1.dllexecutable
MD5:5ADB49CC84ABD6D3C8F959CA5A146AD7
SHA256:F4D5DF50BDF3E7304C67C81ACE83263C8D0F0E28087C6104C21150BFEDA86B8D
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_tkinter.pydexecutable
MD5:E46970E8EB0061DF01347A3723140E77
SHA256:71C4545CEE713F26CF2F910A08340DD519C4713B8416479F74B0B9E2683C85D5
4756523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exeC:\Users\admin\AppData\Local\Temp\onefile_4756_133917949045326862\_bz2.pydexecutable
MD5:FF5AC8FB724EDB1635E2AD985F98EE5B
SHA256:B94F64FCB49F40682ED794FA1940A1DC0C8A28F24A1768D3BFE774CF75F59B62
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
19
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6584
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6584
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.179
  • 23.48.23.190
  • 23.48.23.192
  • 23.48.23.191
  • 23.48.23.188
  • 23.48.23.181
  • 23.48.23.176
  • 23.48.23.185
  • 23.48.23.177
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.136
  • 20.190.160.4
  • 20.190.160.5
  • 40.126.32.140
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
523d6973c4e72d8d97089788d415a19f235bbe84a6d85ae1affba0ae03e51f3b.exe