File name:

23s.exe

Full analysis: https://app.any.run/tasks/19c9e9ed-ca97-465e-a4d4-2f0e41bd85cb
Verdict: Malicious activity
Analysis date: February 14, 2025, 18:36:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

D39434C1AEC5F6EE59D40BDEA642CF32

SHA1:

01D7DA2EC2F27D29426FA6FEF55A8E1F7D820D2C

SHA256:

5654139565228C2F712F7AD79A04BC875577915AE58FB2984EBB20DD0D59E36E

SSDEEP:

49152:7qEcsT90z2NkvSCmRf7uY1+DVlYZ+hHjGmt/3Dgb8Ecv+h+ltmqHx1JdReCzjF6c:62NkKCmRf7uY1+DVlYZ+hHaIDgaRe5c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 23s.exe (PID: 116)
      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 23s.exe (PID: 116)

    • Starts itself from another location

      • 23s.exe (PID: 116)

    • Reads security settings of Internet Explorer

      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)

    • Reads the Internet Settings

      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)

    • Starts CMD.EXE for commands execution

      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)

    • Executing commands from a ".bat" file

      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2296)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 2648)
      • cmd.exe (PID: 1400)
      • cmd.exe (PID: 3408)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2296)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 2648)
      • cmd.exe (PID: 1400)
      • cmd.exe (PID: 3408)

    • The executable file from the user directory is run by the CMD process

      • Client.exe (PID: 2604)
      • Client.exe (PID: 952)
      • Client.exe (PID: 396)
      • Client.exe (PID: 3024)
      • Client.exe (PID: 3064)

  • INFO

    • Checks supported languages

      • 23s.exe (PID: 116)
      • Client.exe (PID: 1792)
      • chcp.com (PID: 2276)
      • Client.exe (PID: 2604)
      • chcp.com (PID: 3204)
      • chcp.com (PID: 3120)
      • Client.exe (PID: 952)
      • Client.exe (PID: 396)
      • chcp.com (PID: 820)
      • Client.exe (PID: 3024)
      • Client.exe (PID: 3064)
      • chcp.com (PID: 3088)

    • Reads Environment values

      • 23s.exe (PID: 116)
      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)
      • Client.exe (PID: 3064)

    • Reads the computer name

      • 23s.exe (PID: 116)
      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 952)
      • Client.exe (PID: 396)
      • Client.exe (PID: 3024)
      • Client.exe (PID: 3064)

    • Reads the machine GUID from the registry

      • 23s.exe (PID: 116)
      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)
      • Client.exe (PID: 3064)

    • Creates files or folders in the user directory

      • 23s.exe (PID: 116)

    • Create files in a temporary directory

      • Client.exe (PID: 1792)
      • Client.exe (PID: 2604)
      • Client.exe (PID: 396)
      • Client.exe (PID: 952)
      • Client.exe (PID: 3024)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2296)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 2648)
      • cmd.exe (PID: 1400)
      • cmd.exe (PID: 3408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:12 16:16:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3261952
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x31e3fe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.0
ProductVersionNumber: 1.4.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Quasar Client
FileVersion: 1.4.1
InternalName: Client.exe
LegalCopyright: Copyright © MaxXor 2023
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: Quasar
ProductVersion: 1.4.1
AssemblyVersion: 1.4.1.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
24
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 23s.exe client.exe cmd.exe no specs chcp.com no specs ping.exe no specs client.exe cmd.exe no specs chcp.com no specs ping.exe no specs client.exe cmd.exe no specs chcp.com no specs ping.exe no specs client.exe cmd.exe no specs chcp.com no specs ping.exe no specs client.exe cmd.exe no specs ping.exe no specs chcp.com no specs client.exe no specs svchost.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\23s.exe" C:\Users\admin\AppData\Local\Temp\23s.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
3
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\23s.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
396"C:\Users\admin\AppData\Roaming\SubDir\Client.exe" C:\Users\admin\AppData\Roaming\SubDir\Client.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\roaming\subdir\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
820chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
952"C:\Users\admin\AppData\Roaming\SubDir\Client.exe" C:\Users\admin\AppData\Roaming\SubDir\Client.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1252"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
1400C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\mUZ4fiTRlhqD.bat" "C:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1792"C:\Users\admin\AppData\Roaming\SubDir\Client.exe"C:\Users\admin\AppData\Roaming\SubDir\Client.exe
23s.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\roaming\subdir\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1924ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2108C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\oejtzXKoYQEi.bat" "C:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 399
Read events
4 269
Write events
130
Delete events
0

Modification events

(PID) Process:(116) 23s.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) 23s.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:smart
Value:
"C:\Users\admin\AppData\Roaming\SubDir\Client.exe"
(PID) Process:(1792) Client.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1792) Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:smart
Value:
"C:\Users\admin\AppData\Roaming\SubDir\Client.exe"
(PID) Process:(1792) Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1792) Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1792) Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1792) Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2604) Client.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2604) Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:smart
Value:
"C:\Users\admin\AppData\Roaming\SubDir\Client.exe"
Executable files
1
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1792Client.exeC:\Users\admin\AppData\Local\Temp\ULBGuPVtQqkO.battext
MD5:0B8F67BEC3D1E127466B480E0F2E8789
SHA256:6A4DB9EA96AEBCF9673058438ACD50BC4B467573FA6D4792AB11E633D5B02AE8
2604Client.exeC:\Users\admin\AppData\Local\Temp\oejtzXKoYQEi.battext
MD5:E0D91F0C5906576270D64FAEC6DBBB59
SHA256:44A32923DEF848CEA3B139E1D50AFA0470E586172F7A7BD58710B5FB74D85EFD
952Client.exeC:\Users\admin\AppData\Local\Temp\mUZ4fiTRlhqD.battext
MD5:BA76779CF4A9CEF727895FDC12E90F0A
SHA256:D762BA1B0EB0D842083C03A5CBAEC792B3AEB5D32E48D9D49BF0FE4E0EFAF9E1
3024Client.exeC:\Users\admin\AppData\Local\Temp\tyiu4gBM0s9v.battext
MD5:98AC37605FF8E4075922A1F8AB7B8AD6
SHA256:92CE0CE041EECB2877334D398FB93965D248DE9336D59643084C02C1A991F189
396Client.exeC:\Users\admin\AppData\Local\Temp\YQsObkbroewm.battext
MD5:28A5744F508771B5AF34F08A26B63334
SHA256:F4BD19871CFD4CA7568871C3B10F3D026B9879F1B973B3B5B753043CF126047C
11623s.exeC:\Users\admin\AppData\Roaming\SubDir\Client.exeexecutable
MD5:D39434C1AEC5F6EE59D40BDEA642CF32
SHA256:5654139565228C2F712F7AD79A04BC875577915AE58FB2984EBB20DD0D59E36E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
rnnlc-176-18-48-249.a.free.pinggy.link
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
23s.exe