File name:

iBallexusBOOTSTRAPPER.exe

Full analysis: https://app.any.run/tasks/e8b3ada9-5a91-4247-afee-b02278d3ae55
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 07, 2025, 01:33:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
auto-startup
umbralstealer
discord
exfiltration
divulgestealer
umbral
discordgrabber
generic
arch-doc
ims-api
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

0D1CB86A51FEF21A391A751B1ED399E0

SHA1:

6973AE5FAF3C2324CA849A7A02E690D3334800AD

SHA256:

5D112E9F87DDD3F1C7C2BF25A8FDD85CC6B2EEB712727508A2C6068A42F59F19

SSDEEP:

3072:Z1zJQhGjtQmzAvpehGfSdcRCG28CAZoTXmEHrYFVx5qw24QxY8e11sKETE6cz:upSdcXeTXYFVx5n2a8e1m7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes Windows Defender settings

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Adds path to the Windows Defender exclusion list

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 8028)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 8028)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 8028)

    • Changes settings for real-time protection

      • powershell.exe (PID: 8028)

    • Actions looks like stealing of personal data

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 8028)

    • Create files in the Startup directory

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Steals credentials from Web Browsers

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • UMBRAL has been detected (YARA)

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 8028)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 8028)

    • DISCORDGRABBER has been detected (YARA)

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • UMBRALSTEALER has been detected (SURICATA)

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • UMBRALSTEALER has been detected (YARA)

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Stealers network behavior

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • DIVULGESTEALER has been detected (YARA)

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Starts CMD.EXE for self-deleting

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Attempting to use instant messaging service

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Uses WMIC.EXE to obtain Windows Installer data

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Application launched itself

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)

    • Reads security settings of Internet Explorer

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 2084)
      • WMIC.exe (PID: 5528)
      • WMIC.exe (PID: 7796)

    • Uses ATTRIB.EXE to modify file attributes

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Script adds exclusion path to Windows Defender

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Starts POWERSHELL.EXE for commands execution

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Executable content was dropped or overwritten

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Script disables Windows Defender's real-time protection

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Modifies hosts file to alter network resolution

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Script disables Windows Defender's IPS

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 6740)

    • Uses WMIC.EXE to obtain operating system information

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Uses WMIC.EXE to obtain computer system information

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Uses WMIC.EXE to obtain a list of video controllers

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 5344)

    • The process connected to a server suspected of theft

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Starts CMD.EXE for commands execution

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

  • INFO

    • Checks supported languages

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)
      • vrBN6.scr (PID: 4648)

    • Disables trace logs

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Reads the machine GUID from the registry

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Reads Environment values

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Checks proxy server information

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)
      • slui.exe (PID: 6132)

    • Reads the computer name

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)
      • vrBN6.scr (PID: 4648)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 2084)
      • WMIC.exe (PID: 5528)
      • WMIC.exe (PID: 6740)
      • WMIC.exe (PID: 7796)
      • WMIC.exe (PID: 6980)
      • WMIC.exe (PID: 5344)
      • rundll32.exe (PID: 5280)
      • notepad.exe (PID: 3996)

    • Process checks computer location settings

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)

    • Reads the software policy settings

      • iBallexusBOOTSTRAPPER.exe (PID: 7756)
      • iBallexusBOOTSTRAPPER.exe (PID: 5776)
      • slui.exe (PID: 6132)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6744)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6744)
      • powershell.exe (PID: 7616)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 7844)

    • Creates files in the program directory

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Launching a file from the Startup directory

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Manual execution by a user

      • vrBN6.scr (PID: 4648)
      • notepad.exe (PID: 3996)
      • rundll32.exe (PID: 5280)

    • Create files in a temporary directory

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)

    • Attempting to use instant messaging service

      • iBallexusBOOTSTRAPPER.exe (PID: 5776)
      • svchost.exe (PID: 2196)

    • Reads Microsoft Office registry keys

      • rundll32.exe (PID: 5280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2053:02:19 18:54:36+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 232448
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x3aa9e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Payload for Umbral Stealer
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
34
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iballexusbootstrapper.exe wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER iballexusbootstrapper.exe wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs vrbn6.scr no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs notepad.exe no specs rundll32.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—attrib.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2084"wmic.exe" csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—iBallexusBOOTSTRAPPER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIERC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—iBallexusBOOTSTRAPPER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3996"C:\WINDOWS\system32\NOTEPAD.EXE" "C:\Users\admin\Desktop\Edge Cookies.txt"C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4648"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vrBN6.scr"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vrBN6.scr—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\microsoft\windows\start menu\programs\startup\vrbn6.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
46 130
Read events
46 077
Write events
53
Delete events
0

Modification events

(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7756) iBallexusBOOTSTRAPPER.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iBallexusBOOTSTRAPPER_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
6
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
6744powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bncsvamw.bg1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5776iBallexusBOOTSTRAPPER.exeC:\Users\admin\AppData\Local\Temp\kNLrr9R5ORdZqMXbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5776iBallexusBOOTSTRAPPER.exeC:\Users\admin\AppData\Local\Temp\JACt4DVfDlGG9oRbinary
MD5:CE19E10E2FE1C5D5BC7FF3BBE7F6FA51
SHA256:60F17E6B00880E848F615FFC32FBE43595DF1D4E91AE3C66B8F5C2B1B5A065FD
5776iBallexusBOOTSTRAPPER.exeC:\Users\admin\AppData\Local\Temp\OgARdAH4QXq4q2Lbinary
MD5:B13FCB3223116F6EEC60BE9143CAE98B
SHA256:961FC9BF866C5B58401D3C91735F9A7B7B4FC93C94038C504C965491F622B52B
5776iBallexusBOOTSTRAPPER.exeC:\Users\admin\AppData\Local\Temp\8Zg5qKDC4IJyTcwbinary
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
7844powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_b31g1mya.hng.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8028powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3scfdjoi.epy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6744powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dawhbvy5.euj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6744powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:7E405A1D3FBAB15A307B83B680164961
SHA256:9B1DC6AD65CE5497B559E4B94B6BE01ECE106B24965C15D5F4D32D53E92F1BB0
5776iBallexusBOOTSTRAPPER.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vrBN6.screxecutable
MD5:0D1CB86A51FEF21A391A751B1ED399E0
SHA256:5D112E9F87DDD3F1C7C2BF25A8FDD85CC6B2EEB712727508A2C6068A42F59F19
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
53
DNS requests
19
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7600
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
204
142.250.185.227:443
https://gstatic.com/generate_204
unknown
—
—
—
7600
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.4:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
200
20.190.159.4:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
40.126.31.131:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
40.126.31.69:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
7756
iBallexusBOOTSTRAPPER.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7600
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.131:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7600
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
7600
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7756
iBallexusBOOTSTRAPPER.exe
142.250.184.195:443
gstatic.com
GOOGLE
US
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
gstatic.com
  • 142.250.184.195
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.136.232
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.135.232
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7756
iBallexusBOOTSTRAPPER.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7756
iBallexusBOOTSTRAPPER.exe
Misc activity
ET HUNTING GET Request to ip-api Without User-Agent (Common with Stealers)
7756
iBallexusBOOTSTRAPPER.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
5776
iBallexusBOOTSTRAPPER.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
5776
iBallexusBOOTSTRAPPER.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
5776
iBallexusBOOTSTRAPPER.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
5776
iBallexusBOOTSTRAPPER.exe
A Network Trojan was detected
STEALER [ANY.RUN] UmbralStealer Generic External IP Check
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
iBallexusBOOTSTRAPPER.exe