File name:

HH

Full analysis: https://app.any.run/tasks/4ce2cba5-fb58-4db2-b2c2-4e539b008668
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 13:24:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
emotet
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections
MD5:

F7EC14F39648ACC2FA464F9FBD68DDE0

SHA1:

CAD59653783A69F26D5B7319806FE61F7BCFC415

SHA256:

5954439D1D04FA98D77F222EBE59E1192B178FE9758B6840CD590928E2D92EF4

SSDEEP:

12288:lWm7Vz8KVS2arb++M7Z930dp1kvJ8woqBhaLqhChSbNjGwMEPlh+FrBSYVbgzUzU:lHVxDr7jkdp1oDVGhajEezUzU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMOTET has been detected (YARA)

      • regsvr32.exe (PID: 7296)

  • SUSPICIOUS

    • Connects to unusual port

      • regsvr32.exe (PID: 7296)

  • INFO

    • The sample compiled with english language support

      • regsvr32.exe (PID: 7296)

    • Reads the software policy settings

      • slui.exe (PID: 7452)
      • slui.exe (PID: 8188)

    • Checks proxy server information

      • slui.exe (PID: 8188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Emotet

(PID) Process(7296) regsvr32.exe
C2 (55)51.161.73.194:443
149.56.131.28:8080
1.234.2.232:8080
103.43.75.120:443
153.126.146.25:7080
164.90.222.65:443
94.23.45.86:4143
139.59.56.73:8080
188.44.20.25:443
172.105.226.75:8080
104.168.155.143:8080
45.118.115.99:8080
139.59.126.41:443
147.139.166.154:8080
160.16.142.56:8080
169.60.181.70:8080
201.94.166.162:443
159.89.202.34:443
72.15.201.15:8080
103.132.242.26:8080
185.4.135.165:8080
213.239.212.5:443
187.63.160.88:80
186.194.240.217:443
115.68.227.76:8080
167.172.253.162:8080
206.189.28.199:8080
149.28.143.92:443
164.68.99.3:8080
173.212.193.249:8080
197.242.150.244:8080
212.24.98.99:8080
167.172.199.165:8080
91.207.28.33:8080
119.59.103.152:8080
110.232.117.186:8080
45.235.8.30:8080
159.65.140.115:443
79.137.35.198:8080
91.187.140.35:8080
209.97.163.214:443
5.135.159.50:443
163.44.196.120:8080
95.217.221.146:8080
169.57.156.166:8080
182.162.143.56:443
172.104.251.154:8080
103.75.201.2:443
107.170.39.149:8080
183.111.227.137:8080
129.232.188.93:443
82.223.21.224:8080
101.50.0.91:8080
45.176.232.124:443
159.65.88.10:8080
Keys
ECS1-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q== -----END PUBLIC KEY-----
ECK1-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg== -----END PUBLIC KEY-----
Strings (36)SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ECDH_P256
%s\regsvr32.exe "%s"
Cookie: %s=%s
advapi32.dll
POST
userenv.dll
%s:Zone.Identifier
KeyDataBlob
regsvr32.exe "%s"
rundll32.exe "%s",PluginInit
GET
RNG
shell32.dll
%s%s.dll
%u.%u.%u.%u
shlwapi.dll
wtsapi32.dll
winhttp.dll
ECCPUBLICBLOB
%s_%08X
AES
SHA256
%s\%s
Content-Type: multipart/form-data; boundary=%s
Microsoft Primitive Provider
HASH
urlmon.dll
--%S--
%s%s.exe
--%S Content-Disposition: form-data; name="%S"; filename="%S" Content-Type: application/octet-stream
crypt32.dll
ECDSA_P256
ObjectLength
bcrypt.dll
%s\*
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2022:11:04 23:56:43+00:00
ImageFileCharacteristics: Executable, Large address aware, DLL
PEType: PE32+
LinkerVersion: 8
CodeSize: 357376
InitializedDataSize: 445952
UninitializedDataSize: -
EntryPoint: 0x33b10
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: OlivierLanglois.net
FileDescription: clover MFC Application
FileVersion: 1, 0, 0, 1
InternalName: clover
LegalCopyright: Copyright (C) 2005 OlivierLanglois.net. All rights reserved.
LegalTrademarks: -
OriginalFileName: clover.EXE
ProductName: clover Application
ProductVersion: 1, 0, 0, 1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EMOTET regsvr32.exe sppextcomobj.exe no specs slui.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7296"C:\WINDOWS\System32\regsvr32.exe" C:\Users\admin\AppData\Local\Temp\HH.dllC:\Windows\System32\regsvr32.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Emotet
(PID) Process(7296) regsvr32.exe
C2 (55)51.161.73.194:443
149.56.131.28:8080
1.234.2.232:8080
103.43.75.120:443
153.126.146.25:7080
164.90.222.65:443
94.23.45.86:4143
139.59.56.73:8080
188.44.20.25:443
172.105.226.75:8080
104.168.155.143:8080
45.118.115.99:8080
139.59.126.41:443
147.139.166.154:8080
160.16.142.56:8080
169.60.181.70:8080
201.94.166.162:443
159.89.202.34:443
72.15.201.15:8080
103.132.242.26:8080
185.4.135.165:8080
213.239.212.5:443
187.63.160.88:80
186.194.240.217:443
115.68.227.76:8080
167.172.253.162:8080
206.189.28.199:8080
149.28.143.92:443
164.68.99.3:8080
173.212.193.249:8080
197.242.150.244:8080
212.24.98.99:8080
167.172.199.165:8080
91.207.28.33:8080
119.59.103.152:8080
110.232.117.186:8080
45.235.8.30:8080
159.65.140.115:443
79.137.35.198:8080
91.187.140.35:8080
209.97.163.214:443
5.135.159.50:443
163.44.196.120:8080
95.217.221.146:8080
169.57.156.166:8080
182.162.143.56:443
172.104.251.154:8080
103.75.201.2:443
107.170.39.149:8080
183.111.227.137:8080
129.232.188.93:443
82.223.21.224:8080
101.50.0.91:8080
45.176.232.124:443
159.65.88.10:8080
Keys
ECS1-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q== -----END PUBLIC KEY-----
ECK1-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg== -----END PUBLIC KEY-----
Strings (36)SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ECDH_P256
%s\regsvr32.exe "%s"
Cookie: %s=%s
advapi32.dll
POST
userenv.dll
%s:Zone.Identifier
KeyDataBlob
regsvr32.exe "%s"
rundll32.exe "%s",PluginInit
GET
RNG
shell32.dll
%s%s.dll
%u.%u.%u.%u
shlwapi.dll
wtsapi32.dll
winhttp.dll
ECCPUBLICBLOB
%s_%08X
AES
SHA256
%s\%s
Content-Type: multipart/form-data; boundary=%s
Microsoft Primitive Provider
HASH
urlmon.dll
--%S--
%s%s.exe
--%S Content-Disposition: form-data; name="%S"; filename="%S" Content-Type: application/octet-stream
crypt32.dll
ECDSA_P256
ObjectLength
bcrypt.dll
%s\*
7420C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7452"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 152
Read events
1 152
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
42
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8004
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8004
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8004
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.147
  • 23.48.23.141
  • 23.48.23.143
  • 23.48.23.176
  • 23.48.23.164
  • 23.48.23.173
  • 23.48.23.158
  • 23.48.23.162
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.67
  • 20.190.160.130
  • 20.190.160.132
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info