Malware analysis cubaris.exe Malicious activity | ANY.RUN

Add for printing

File name:	cubaris.exe
Full analysis:	https://app.any.run/tasks/282e2055-8193-42ce-bc02-8a37e95e07fd
Verdict:	Malicious activity
Analysis date:	November 25, 2024, 15:42:12
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	github pyinstaller
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:	D45DD5CD60E947FA271E25033A53663A
SHA1:	54D77D769BA1C118D3C794EC8F1FBD87EB4A1935
SHA256:	56956F38B92ED02809CE30CD800A43A2744C74B17FDBA2F67FBE513F6B4290B6
SSDEEP:	98304:xJ3u4ajdILbOZt9CyLVe1SWx23evqBQTugnt+J9WCETYhaRjg20VPDAAQm7SukZJ:uP/acG20k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- The process drops C-runtime libraries
  - cubaris.exe (PID: 4328)
- Process drops legitimate windows executable
  - cubaris.exe (PID: 4328)
- Application launched itself
  - cubaris.exe (PID: 4328)
- Process drops python dynamic module
  - cubaris.exe (PID: 4328)
- Executable content was dropped or overwritten
  - cubaris.exe (PID: 4328)
INFO
- Reads the computer name
  - cubaris.exe (PID: 4328)
- Checks supported languages
  - cubaris.exe (PID: 4328)
  - cubaris.exe (PID: 4804)
- Create files in a temporary directory
  - cubaris.exe (PID: 4328)
- Reads the machine GUID from the registry
  - cubaris.exe (PID: 4804)
- Checks proxy server information
  - cubaris.exe (PID: 4804)
- PyInstaller has been detected (YARA)
  - cubaris.exe (PID: 4328)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2024:11:25 15:41:48+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.41
CodeSize:	172032
InitializedDataSize:	154624
UninitializedDataSize:	-
EntryPoint:	0xce20
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

123

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

3092

"C:\Users\admin\AppData\Local\Temp\cubaris.exe"

C:\Users\admin\AppData\Local\Temp\cubaris.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Modules

Images
c:\users\admin\appdata\local\temp\cubaris.exe
c:\windows\system32\ntdll.dll

4328

"C:\Users\admin\AppData\Local\Temp\cubaris.exe"

C:\Users\admin\AppData\Local\Temp\cubaris.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\cubaris.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

4804

"C:\Users\admin\AppData\Local\Temp\cubaris.exe"

C:\Users\admin\AppData\Local\Temp\cubaris.exe

cubaris.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\cubaris.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

Add for printing

Total events

29 161

Read events

29 161

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\VCRUNTIME140.dll		executable
		MD5:F34EB034AA4A9735218686590CBA2E8B	SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\VCRUNTIME140_1.dll		executable
		MD5:135359D350F72AD4BF716B764D39E749	SHA256:34048ABAA070ECC13B318CEA31425F4CA3EDD133D350318AC65259E6058C8B32
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\_hashlib.pyd		executable
		MD5:69DC506CF2FA3DA9D0CABA05FCA6A35D	SHA256:C5B8C4582E201FEF2D8CB2C8672D07B86DEC31AFB4A17B758DBFB2CFF163B12F
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\_lzma.pyd		executable
		MD5:77B78B43D58FE7CE9EB2FBB1420889FA	SHA256:6E571D93CE55D09583EC91C607883A43C1DA3D4D36794D68C6ECD6BEA4AB466A
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\select.pyd		executable
		MD5:35BB285678B249770DDA3F8A15724593	SHA256:71ED480DA28968A7FD07934E222AE87D943677468936FD419803280D0CAD07F3
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\libssl-1_1.dll		executable
		MD5:DE72697933D7673279FB85FD48D1A4DD	SHA256:ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\_socket.pyd		executable
		MD5:CD56F508E7C305D4BFDEB820ECF3A323	SHA256:9E97B782B55400E5A914171817714BBBC713C0A396E30496C645FC82835E4B34
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\libcrypto-1_1.dll		executable
		MD5:AB01C808BED8164133E5279595437D3D	SHA256:9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\unicodedata.pyd		executable
		MD5:3BA2A20DDA6D1B4670767455BBE32870	SHA256:3A0987025F1CF2111DC6E4F59402073BA123D7436D809EE4198B4E7BFB8CB868
4328	cubaris.exe	C:\Users\admin\AppData\Local\Temp\_MEI43282\Pythonwin\mfc140u.dll		executable
		MD5:CD1D99DF975EE5395174DF834E82B256	SHA256:D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
204	svchost.exe	GET	200	2.16.241.19:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
204	svchost.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
1176	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5112	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
2144	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5112	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
4712	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
204	svchost.exe	2.16.241.19:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
204	svchost.exe	88.221.169.152:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
—	—	2.23.209.179:443	—	Akamai International B.V.	GB	unknown
4804	cubaris.exe	140.82.121.3:443	github.com	GITHUB	US	shared
4804	cubaris.exe	185.199.108.133:443	raw.githubusercontent.com	FASTLY	US	shared
4	System	192.168.100.255:137	—	—	—	whitelisted
5064	SearchApp.exe	2.23.209.177:443	—	Akamai International B.V.	GB	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208	whitelisted
crl.microsoft.com	2.16.241.19 2.16.241.12	whitelisted
www.microsoft.com	88.221.169.152	whitelisted
google.com	142.250.185.206	whitelisted
github.com	140.82.121.3	shared
raw.githubusercontent.com	185.199.108.133 185.199.109.133 185.199.110.133 185.199.111.133	shared
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.32.68 40.126.32.136 40.126.32.134 40.126.32.133 20.190.160.14 40.126.32.76 40.126.32.140 20.190.160.17	whitelisted
go.microsoft.com	23.52.181.141	whitelisted
slscr.update.microsoft.com	20.109.210.53	whitelisted

Threats

PID	Process	Class	Message
2192	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub

Add for printing

No debug info

General Info

cubaris.exe

D45DD5CD60E947FA271E25033A53663A

54D77D769BA1C118D3C794EC8F1FBD87EB4A1935

56956F38B92ED02809CE30CD800A43A2744C74B17FDBA2F67FBE513F6B4290B6

98304:xJ3u4ajdILbOZt9CyLVe1SWx23evqBQTugnt+J9WCETYhaRjg20VPDAAQm7SukZJ:uP/acG20k

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

The process drops C-runtime libraries

Process drops legitimate windows executable

Application launched itself

Process drops python dynamic module

Executable content was dropped or overwritten

INFO

Reads the computer name

Checks supported languages

Create files in a temporary directory

Reads the machine GUID from the registry

Checks proxy server information

PyInstaller has been detected (YARA)

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings