File name:

Exela.exe

Full analysis: https://app.any.run/tasks/350b79f2-9205-41f4-a78c-928c2f3afe56
Verdict: Malicious activity
Threats:

Exela Stealer is an infostealer malware written in Python. It is capable of collecting a wide range of sensitive information from compromised systems and exfiltrating it to attackers over Discord. It is frequently used to steal browser data, and obtain session files from various applications, including gaming platforms, social media platforms, and messaging apps.

Malware Trends Tracker     >>>
Analysis date: August 18, 2024, 13:34:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
exela
stealer
pyinstaller
susp-powershell
discordgrabber
generic
growtopia
discord
upx
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

05346CC4EC002EC688ED440EB9981EC4

SHA1:

79AECD7F2A4ACFB93FF0CF1BF3B70E74F6204372

SHA256:

5C1784F0CA004F2B40D52748CBE73600F1DAA99C0DF5B989CD21CA0EFC89B62D

SSDEEP:

98304:76CoXjBpLBKv4sofOLs+MpHFBotxK56cuOeXCqLJPJqQKHH7bmY90GpJNSDaf87B:Ygum4anf7bHo6YWh6EWmzT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Exela.exe (PID: 6924)

    • Actions looks like stealing of personal data

      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 6384)

    • Starts NET.EXE to view/add/change user profiles

      • net.exe (PID: 6260)
      • cmd.exe (PID: 7060)
      • net.exe (PID: 6308)
      • net.exe (PID: 4540)
      • cmd.exe (PID: 6780)
      • net.exe (PID: 5600)
      • net.exe (PID: 1132)
      • net.exe (PID: 6916)

    • ExelaStealer has been detected

      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 6384)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 6384)
      • cmd.exe (PID: 7060)
      • net.exe (PID: 7128)
      • cmd.exe (PID: 6780)
      • net.exe (PID: 1860)
      • net.exe (PID: 6936)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6164)
      • powershell.exe (PID: 1984)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 6300)

    • GROWTOPIA has been detected (YARA)

      • Exela.exe (PID: 6924)

    • DISCORDGRABBER has been detected (YARA)

      • Exela.exe (PID: 6924)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 5248)
      • Exela.exe (PID: 6384)

    • Drops the executable file immediately after the start

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • csc.exe (PID: 1104)
      • Exela.exe (PID: 5248)
      • csc.exe (PID: 6848)

    • Process drops legitimate windows executable

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 5248)

    • The process drops C-runtime libraries

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 5248)

    • Executable content was dropped or overwritten

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • csc.exe (PID: 1104)
      • Exela.exe (PID: 5248)
      • csc.exe (PID: 6848)

    • Process drops python dynamic module

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 5248)

    • Application launched itself

      • Exela.exe (PID: 6904)
      • cmd.exe (PID: 6256)
      • cmd.exe (PID: 4772)
      • Exela.exe (PID: 5248)
      • cmd.exe (PID: 1716)
      • cmd.exe (PID: 7136)

    • Loads Python modules

      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 6384)

    • Starts CMD.EXE for commands execution

      • Exela.exe (PID: 6924)
      • cmd.exe (PID: 6256)
      • cmd.exe (PID: 4772)
      • Exela.exe (PID: 6384)
      • cmd.exe (PID: 7136)
      • cmd.exe (PID: 1716)

    • Get information on the list of running processes

      • Exela.exe (PID: 6924)
      • cmd.exe (PID: 7032)
      • cmd.exe (PID: 6696)
      • cmd.exe (PID: 6260)
      • cmd.exe (PID: 7060)
      • Exela.exe (PID: 6384)
      • cmd.exe (PID: 6996)
      • cmd.exe (PID: 1680)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 6780)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 3812)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 6308)
      • cmd.exe (PID: 6080)
      • cmd.exe (PID: 4008)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7148)
      • WMIC.exe (PID: 5240)
      • WMIC.exe (PID: 6680)
      • WMIC.exe (PID: 4292)
      • WMIC.exe (PID: 6776)
      • WMIC.exe (PID: 6292)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 6688)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2272)
      • cmd.exe (PID: 5916)
      • cmd.exe (PID: 6304)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4192)
      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 2228)
      • cmd.exe (PID: 6300)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6188)
      • cmd.exe (PID: 6356)
      • cmd.exe (PID: 7160)
      • cmd.exe (PID: 3988)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 6224)

    • Uses QUSER.EXE to read information about current user sessions

      • query.exe (PID: 6256)
      • query.exe (PID: 7072)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 6300)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 6300)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 6300)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 7060)
      • cmd.exe (PID: 6780)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 6384)

  • INFO

    • Checks supported languages

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • chcp.com (PID: 6400)
      • chcp.com (PID: 6164)
      • csc.exe (PID: 1104)
      • cvtres.exe (PID: 6980)
      • Exela.exe (PID: 5248)
      • Exela.exe (PID: 6384)
      • chcp.com (PID: 7080)
      • chcp.com (PID: 1356)
      • csc.exe (PID: 6848)
      • cvtres.exe (PID: 4644)

    • Reads the computer name

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 5248)
      • Exela.exe (PID: 6384)

    • Create files in a temporary directory

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • csc.exe (PID: 1104)
      • cvtres.exe (PID: 6980)
      • Exela.exe (PID: 5248)
      • Exela.exe (PID: 6384)
      • cvtres.exe (PID: 4644)
      • csc.exe (PID: 6848)

    • Checks operating system version

      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 6384)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7148)
      • WMIC.exe (PID: 6284)
      • WMIC.exe (PID: 4780)
      • WMIC.exe (PID: 5240)
      • WMIC.exe (PID: 6680)
      • Taskmgr.exe (PID: 7152)
      • WMIC.exe (PID: 4292)
      • WMIC.exe (PID: 6284)
      • WMIC.exe (PID: 5180)
      • WMIC.exe (PID: 6776)
      • WMIC.exe (PID: 6292)

    • Creates files or folders in the user directory

      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 6384)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 6388)
      • powershell.exe (PID: 7052)

    • Changes the display of characters in the console

      • chcp.com (PID: 6400)
      • chcp.com (PID: 6164)
      • chcp.com (PID: 7080)
      • chcp.com (PID: 1356)

    • Reads the time zone

      • net1.exe (PID: 6960)
      • net1.exe (PID: 1420)
      • net1.exe (PID: 6528)
      • net1.exe (PID: 4844)

    • PyInstaller has been detected (YARA)

      • Exela.exe (PID: 6904)
      • Exela.exe (PID: 6924)
      • Exela.exe (PID: 5248)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • Exela.exe (PID: 6924)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 1104)
      • csc.exe (PID: 6848)

    • UPX packer has been detected

      • Exela.exe (PID: 6924)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6968)
      • Taskmgr.exe (PID: 7152)
      • Exela.exe (PID: 5248)

    • Attempting to use instant messaging service

      • Exela.exe (PID: 6924)
      • svchost.exe (PID: 2256)
      • Exela.exe (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:12 09:46:55+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 172032
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.746
ProductVersionNumber: 10.0.19041.746
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Exela Services
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
InternalName: Exela.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: Exela.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.746
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
277
Monitored processes
151
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start THREAT exela.exe #EXELASTEALER exela.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs powershell.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs systeminfo.exe no specs netsh.exe no specs svchost.exe tiworker.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs taskmgr.exe no specs taskmgr.exe rundll32.exe no specs THREAT exela.exe #EXELASTEALER exela.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wmic.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs powershell.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs systeminfo.exe no specs netsh.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
872tasklist /svc C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1104"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\m5ws0hfj.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1128ipconfig /all C:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
1132net user administrator C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
1356chcpC:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1420C:\WINDOWS\system32\net1 user administrator C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
Total events
57 446
Read events
57 438
Write events
7
Delete events
1

Modification events

(PID) Process:(7104) systeminfo.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\system32\mlang.dll,-4386
Value:
English (United States)
(PID) Process:(6240) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide
Operation:writeName:LastScavengingStarvationReport
Value:
DAC4B15673F1DA01
(PID) Process:(6240) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31125875
(PID) Process:(6240) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
(PID) Process:(7152) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:delete valueName:Preferences
Value:
(PID) Process:(7152) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:writeName:Preferences
Value:
0D00000060000000600000006800000068000000E3010000DC010000000001000000008000000080D8010080DF010080000100016B00000034000000130300008C020000E80300000000000000000000000000000F000000010000000000000058AAC14FF77F00000000000000000000000000002E0100001E0000008990000000000000FF00000001015002000000000D0000000000000098AAC14FF77F00000000000000000000FFFFFFFF960000001E0000008B900000010000000000000000101001000000000300000000000000B0AAC14FF77F00000000000000000000FFFFFFFF780000001E0000008C900000020000000000000001021200000000000400000000000000C8AAC14FF77F00000000000000000000FFFFFFFF960000001E0000008D900000030000000000000000011001000000000200000000000000E8AAC14FF77F00000000000000000000FFFFFFFF320000001E0000008A90000004000000000000000008200100000000050000000000000000ABC14FF77F00000000000000000000FFFFFFFFC80000001E0000008E90000005000000000000000001100100000000060000000000000028ABC14FF77F00000000000000000000FFFFFFFF040100001E0000008F90000006000000000000000001100100000000070000000000000050ABC14FF77F00000000000000000000FFFFFFFF49000000490000009090000007000000000000000004250000000000080000000000000080AAC14FF77F00000000000000000000FFFFFFFF49000000490000009190000008000000000000000004250000000000090000000000000070ABC14FF77F00000000000000000000FFFFFFFF490000004900000092900000090000000000000000042508000000000A0000000000000088ABC14FF77F00000000000000000000FFFFFFFF4900000049000000939000000A0000000000000000042508000000000B00000000000000A8ABC14FF77F00000000000000000000FFFFFFFF490000004900000039A000000B0000000000000000042509000000001C00000000000000C8ABC14FF77F00000000000000000000FFFFFFFFC8000000490000003AA000000C0000000000000000011009000000001D00000000000000F0ABC14FF77F00000000000000000000FFFFFFFF64000000490000004CA000000D0000000000000000021508000000001E0000000000000010ACC14FF77F00000000000000000000FFFFFFFF64000000490000004DA000000E000000000000000002150800000000030000000A000000010000000000000058AAC14FF77F0000000000000000000000000000D70000001E0000008990000000000000FF00000001015002000000000400000000000000C8AAC14FF77F0000000000000000000001000000960000001E0000008D900000010000000000000001011000000000000300000000000000B0AAC14FF77F00000000000000000000FFFFFFFF640000001E0000008C900000020000000000000000021000000000000C0000000000000040ACC14FF77F0000000000000000000003000000640000001E00000094900000030000000000000001021000000000000D0000000000000068ACC14FF77F00000000000000000000FFFFFFFF640000001E00000095900000040000000000000000011001000000000E0000000000000090ACC14FF77F0000000000000000000005000000320000001E00000096900000050000000000000001042001000000000F00000000000000B8ACC14FF77F0000000000000000000006000000320000001E00000097900000060000000000000001042001000000001000000000000000D8ACC14FF77F0000000000000000000007000000460000001E00000098900000070000000000000001011001000000001100000000000000F8ACC14FF77F00000000000000000000FFFFFFFF640000001E0000009990000008000000000000000001100100000000060000000000000028ABC14FF77F0000000000000000000009000000040100001E0000008F9000000900000000000000010110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000B000000010000000000000058AAC14FF77F0000000000000000000000000000D70000001E0000009E90000000000000FF0000000101500200000000120000000000000020ADC14FF77F00000000000000000000FFFFFFFF2D0000001E0000009B90000001000000000000000004200100000000140000000000000040ADC14FF77F00000000000000000000FFFFFFFF640000001E0000009D90000002000000000000000001100100000000130000000000000068ADC14FF77F00000000000000000000FFFFFFFF640000001E0000009C900000030000000000000000011001000000000300000000000000B0AAC14FF77F00000000000000000000FFFFFFFF640000001E0000008C90000004000000000000000102100000000000070000000000000050ABC14FF77F000000000000000000000500000049000000490000009090000005000000000000000104210000000000080000000000000080AAC14FF77F000000000000000000000600000049000000490000009190000006000000000000000104210000000000090000000000000070ABC14FF77F0000000000000000000007000000490000004900000092900000070000000000000001042108000000000A0000000000000088ABC14FF77F0000000000000000000008000000490000004900000093900000080000000000000001042108000000000B00000000000000A8ABC14FF77F0000000000000000000009000000490000004900000039A00000090000000000000001042109000000001C00000000000000C8ABC14FF77F000000000000000000000A00000064000000490000003AA000000A00000000000000000110090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000008000000010000000000000058AAC14FF77F0000000000000000000000000000C60000001E000000B090000000000000FF0000000101500200000000150000000000000088ADC14FF77F00000000000000000000FFFFFFFF6B0000001E000000B1900000010000000000000000042500000000001600000000000000B8ADC14FF77F00000000000000000000FFFFFFFF6B0000001E000000B2900000020000000000000000042500000000001800000000000000E0ADC14FF77F00000000000000000000FFFFFFFF6B0000001E000000B490000003000000000000000004250000000000170000000000000008AEC14FF77F00000000000000000000FFFFFFFF6B0000001E000000B390000004000000000000000004250000000000190000000000000040AEC14FF77F00000000000000000000FFFFFFFFA00000001E000000B5900000050000000000000000042001000000001A0000000000000070AEC14FF77F00000000000000000000FFFFFFFF7D0000001E000000B6900000060000000000000000042001000000001B00000000000000A0AEC14FF77F00000000000000000000FFFFFFFF7D0000001E000000B790000007000000000000000004200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA00000000000000000000000000000000000000000000009D200000200000009100000064000000320000006400000050000000320000003200000028000000500000003C0000005000000050000000320000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C00000050000000500000009700000032000000780000003200000050000000500000005000000050000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA000000000000000000000000000000000000009D200000200000009100000064000000320000009700000050000000320000003200000028000000500000003C000000500000005000000032000000500000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C0000005000000064000000780000003200000078000000780000003200000050000000500000005000000050000000C8000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C0000002D0000002E0000002F00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000
Executable files
68
Suspicious files
25
Text files
80
Unknown types
14

Dropped files

PID
Process
Filename
Type
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_hashlib.pydexecutable
MD5:0629BDB5FF24CE5E88A2DDCEDE608AEE
SHA256:F404BB8371618BBD782201F092A3BCD7A96D3C143787EBEA1D8D86DED1F4B3B8
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_asyncio.pydexecutable
MD5:1B8CE772A230A5DA8CBDCCD8914080A5
SHA256:FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_bz2.pydexecutable
MD5:80C69A1D87F0C82D6C4268E5A8213B78
SHA256:307359F1B2552B60839385EB63D74CBFE75CD5EFDB4E7CD0BB7D296FA67D8A87
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_ctypes.pydexecutable
MD5:B4C41A4A46E1D08206C109CE547480C7
SHA256:9925AB71A4D74CE0CCC036034D422782395DD496472BD2D7B6D617F4D6DDC1F9
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_cffi_backend.cp311-win_amd64.pydexecutable
MD5:3EE19E638459380934A44073C184B5C0
SHA256:D26943222B0645C4D00F29FB4E0FB234AB2B963D8D48F616F204D8AE644C7322
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_lzma.pydexecutable
MD5:BFCA96ED7647B31DD2919BEDEBB856B8
SHA256:032B1A139ADCFF84426B6E156F9987B501AD42ECFB18170B10FB54DA0157392E
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_queue.pydexecutable
MD5:0614691624F99748EF1D971419BDB80D
SHA256:AC7972502144E9E01E53001E8EEC3FC9AB063564678B784D024DA2036BA7384D
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_decimal.pydexecutable
MD5:E9501519A447B13DCCA19E09140C9E84
SHA256:6B5FE2DEA13B84E40B0278D1702AA29E9E2091F9DC09B64BBFF5FD419A604C3C
6904Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI69042\_overlapped.pydexecutable
MD5:97A40F53A81C39469CC7C8DD00F51B5D
SHA256:11879A429C996FEE8BE891AF2BEC7D00F966593F1E01CA0A60BD2005FEB4176F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
56
DNS requests
21
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6924
Exela.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
shared
6788
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6624
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6384
Exela.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
shared
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4276
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6924
Exela.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
692
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6788
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.2
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.64
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ip-api.com
  • 208.95.112.1
shared
arc.msn.com
  • 20.103.156.88
whitelisted
discord.com
  • 162.159.137.232
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.136.232
  • 162.159.138.232
whitelisted
api.gofile.io
  • 51.38.43.18
  • 45.112.123.126
whitelisted
store1.gofile.io
  • 45.112.123.227
whitelisted

Threats

PID
Process
Class
Message
6924
Exela.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2256
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6924
Exela.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6924
Exela.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2256
svchost.exe
Potentially Bad Traffic
ET INFO Online File Storage Domain in DNS Lookup (gofile .io)
6924
Exela.exe
Misc activity
ET INFO File Sharing Related Domain in TLS SNI (gofile .io)
2256
svchost.exe
Potentially Bad Traffic
ET INFO Online File Storage Domain in DNS Lookup (gofile .io)
6924
Exela.exe
Misc activity
ET INFO File Sharing Related Domain in TLS SNI (gofile .io)
6924
Exela.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Exela.exe