File name:

5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe

Full analysis: https://app.any.run/tasks/274819ba-f3ef-48c1-8bd3-930e37128185
Verdict: Malicious activity
Analysis date: June 21, 2025, 07:22:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
urelas
bootkit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

C02C7AF290541F1ED6A6DF1CC388D903

SHA1:

8ACE262C992CCE50897B6E3D2D94EFEEC115DA70

SHA256:

5860650869B367315654FFC6D2123DB852E652ECE60193D043E4863E232811A4

SSDEEP:

1536:KG86VBjEaZr7NigaDt2t2B4rEf7AfCE+O9s:tn+o7QgaDtO22Ef7A6ERs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URELAS has been detected

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)
      • huter.exe (PID: 4160)

    • URELAS mutex has been found

      • huter.exe (PID: 4160)

    • Connects to the CnC server

      • huter.exe (PID: 4160)

  • SUSPICIOUS

    • Starts itself from another location

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Executable content was dropped or overwritten

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Reads security settings of Internet Explorer

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Starts CMD.EXE for commands execution

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Executing commands from a ".bat" file

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Connects to unusual port

      • huter.exe (PID: 4160)

    • Contacting a server suspected of hosting an CnC

      • huter.exe (PID: 4160)

  • INFO

    • The sample compiled with korean language support

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Checks supported languages

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)
      • huter.exe (PID: 4160)

    • Reads the computer name

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)
      • huter.exe (PID: 4160)

    • Create files in a temporary directory

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)

    • Process checks computer location settings

      • 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe (PID: 1520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:10:09 22:29:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 45056
InitializedDataSize: 28672
UninitializedDataSize: 122880
EntryPoint: 0x29c50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.4.228
ProductVersionNumber: 1.0.4.228
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Korean
CharacterSet: Unicode
CompanyName: Updater
FileDescription: Updater
FileVersion: 1.0.4.228
InternalName: Updater.exe
LegalCopyright: Copyright (C) 2015
OriginalFileName: Updater.exe
ProductName: Updater
ProductVersion: 1.0.4.228
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #URELAS 5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe #URELAS huter.exe cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1520"C:\Users\admin\Desktop\5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe" C:\Users\admin\Desktop\5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe
explorer.exe
User:
admin
Company:
Updater
Integrity Level:
MEDIUM
Description:
Updater
Exit code:
0
Version:
1.0.4.228
Modules
Images
c:\users\admin\desktop\5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4160"C:\Users\admin\AppData\Local\Temp\huter.exe" C:\Users\admin\AppData\Local\Temp\huter.exe
5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe
User:
admin
Company:
Updater
Integrity Level:
MEDIUM
Description:
Updater
Version:
1.0.4.228
Modules
Images
c:\users\admin\appdata\local\temp\huter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6104C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\sanfdr.bat" "C:\Windows\SysWOW64\cmd.exe—5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
585
Read events
585
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
15205860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exeC:\Users\admin\AppData\Local\Temp\huter.exeexecutable
MD5:96533B49EBFE01A23E9ACBEAD9EE5E9C
SHA256:1A4F3A93E864FDE463507B76AFB9ACB5D7E08BD488CA13611DCA9F2C2FE4A08E
15205860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exeC:\Users\admin\AppData\Local\Temp\sanfdr.battext
MD5:41D2D7E361AD322F59544B9C3DB6B843
SHA256:145B451699347F307AEB7AC6E28C65D019342023396B89EFF4D1EBB6113B2EB4
15205860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exeC:\Users\admin\AppData\Local\Temp\golfinfo.inibinary
MD5:55D2FDD1432483E3BA86EBECCFE130B6
SHA256:5CFD1668EC0E5F3B5F8D04E54091D6F173BEDE6E6F9BB418819FD550095139FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.21.189.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4160
huter.exe
211.57.201.131:11120
—
Korea Telecom
KR
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 2.21.189.233
whitelisted
google.com
  • 142.250.74.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted

Threats

PID
Process
Class
Message
4160
huter.exe
Malware Command and Control Activity Detected
MALWARE [ANY.RUN] Bootkor Rootkit CnC Communication
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5860650869b367315654ffc6d2123db852e652ece60193d043e4863e232811a4.exe