analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

53dbbfdec1c497f44e02aed8a942da91.exe

Full analysis: https://app.any.run/tasks/319b9256-86b6-4d92-a5d1-334c44dac3f1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 01, 2023, 11:26:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

53DBBFDEC1C497F44E02AED8A942DA91

SHA1:

50480FB7DD8362F9AC63ACD7B1E26F55340BE8EA

SHA256:

5FD5F9EF69A4A82BA2632AF26A2D8A548AC785F55CB00B38CAB251CF0D61A26A

SSDEEP:

393216:0pAe9q1ZVtfw/kHmi/wK4FFGt1FWwCj4wz7V9FEM:0pAL1PtocHmi/wNYQ/77V9FZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Connects to the CnC server

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Actions looks like stealing of personal data

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Searches for installed software

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Reads browser cookies

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Executable content was dropped or overwritten

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Connects to the server without a host name

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Process requests binary or script from the Internet

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

  • INFO

    • The process checks LSA protection

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Checks supported languages

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Reads the machine GUID from the registry

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Reads the computer name

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Checks proxy server information

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Reads product name

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Reads Environment values

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Reads CPU info

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Creates files in the program directory

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)

    • Creates files or folders in the user directory

      • 53dbbfdec1c497f44e02aed8a942da91.exe (PID: 2012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:31 13:06:26+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 56832
InitializedDataSize: 2222080
UninitializedDataSize: -
EntryPoint: 0x1378fa1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-Mar-2023 13:06:26
Detected languages:
  • English - United States
  • Turkish - Turkey
CompanyName: Macrovision Corporation
FileDescription: Setup.exe
FileVersion: 11.50.42618
InternalName: Setup
OriginalFilename: Setup.exe
LegalCopyright: Copyright (C) 2005 Macrovision Corporation
ProductName: InstallShield
ProductVersion: 11.50
OLESelfRegister: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 31-Mar-2023 13:06:26
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
)."yl,b%\xe2\xdc
0x00001000
0x0000DCE2
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
etieZcZW"3
0x0000F000
0x00003322
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
S*_FiF[1\xf7\x11!
0x00013000
0x002111F7
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
wVsIIq#F9\x9bl
0x00225000
0x006C9B39
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
b'NIP,Q(|\x03
0x008EF000
0x0000037C
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.376965
A\>4Q%6a \xce\xc5
0x008F0000
0x00C5CE20
0x00C5D000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.98787
-`\ttAmF\xd4\x19
0x0154D000
0x000019D4
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.06375

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.87927
668
UNKNOWN
Turkish - Turkey
RT_MANIFEST
2
6.39652
1384
UNKNOWN
UNKNOWN
RT_ICON
3
3.9625
744
UNKNOWN
UNKNOWN
RT_ICON
4
6.67739
2216
UNKNOWN
UNKNOWN
RT_ICON
100
2.64576
62
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
USER32.dll
msvcrt.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 53dbbfdec1c497f44e02aed8a942da91.exe no specs 53dbbfdec1c497f44e02aed8a942da91.exe

Process information

PID
CMD
Path
Indicators
Parent process
1216"C:\Users\admin\AppData\Local\Temp\53dbbfdec1c497f44e02aed8a942da91.exe" C:\Users\admin\AppData\Local\Temp\53dbbfdec1c497f44e02aed8a942da91.exe—explorer.exe
User:
admin
Company:
Macrovision Corporation
Integrity Level:
MEDIUM
Description:
Setup.exe
Exit code:
3221226540
Version:
11.50.42618
Modules
Images
c:\users\admin\appdata\local\temp\53dbbfdec1c497f44e02aed8a942da91.exe
c:\windows\system32\ntdll.dll
2012"C:\Users\admin\AppData\Local\Temp\53dbbfdec1c497f44e02aed8a942da91.exe" C:\Users\admin\AppData\Local\Temp\53dbbfdec1c497f44e02aed8a942da91.exe
explorer.exe
User:
admin
Company:
Macrovision Corporation
Integrity Level:
HIGH
Description:
Setup.exe
Exit code:
0
Version:
11.50.42618
Modules
Images
c:\users\admin\appdata\local\temp\53dbbfdec1c497f44e02aed8a942da91.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
744
Read events
720
Write events
24
Delete events
0

Modification events

(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2012) 53dbbfdec1c497f44e02aed8a942da91.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
24
Suspicious files
4
Text files
0
Unknown types
8

Dropped files

PID
Process
Filename
Type
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\HDHCFIJEGCAKJJKEHJJEHJJJEG —
MD5:—
SHA256:—
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\KKKJEBAAECBGDHIECAKJsqlite
MD5:C72DB02959D2F97D090B0051EE963AD7
SHA256:6D8285E102CD46A9379778B223651ECEE043321E436DD15C2354EC59F5EB22A5
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\freebl3.dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
201253dbbfdec1c497f44e02aed8a942da91.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\freebl3[1].dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\JJJEGHDAsqlite
MD5:B6AC860E0B054140F65635EE09CCBC18
SHA256:1A6F576BFEBB88FE0E466014032BBD070268D11EB431E9106EE9CA5795A2EF44
201253dbbfdec1c497f44e02aed8a942da91.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\mozglue[1].dllexecutable
MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\msvcp140.dllexecutable
MD5:5FF1FCA37C466D6723EC67BE93B51442
SHA256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\KFCAFIIDHIDGHIECGDGIDHCGCFsqlite
MD5:FF3819BA79CA33058AB110FEC5CD0955
SHA256:C5140A31EA483E1E6AFE2A2750B853FA46FA3C5B0A04C973094E23E6C8AD533E
201253dbbfdec1c497f44e02aed8a942da91.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\softokn3[1].dllexecutable
MD5:4E52D739C324DB8225BD9AB2695F262F
SHA256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
201253dbbfdec1c497f44e02aed8a942da91.exeC:\ProgramData\nss3.dllexecutable
MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
SHA256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2012
53dbbfdec1c497f44e02aed8a942da91.exe
POST
200
5.75.232.223:80
http://5.75.232.223/5065bfaf5315fdfb.php
DE
text
140 b
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
GET
200
5.75.232.223:80
http://5.75.232.223/f7a5529f1c222f09/nss3.dll
DE
executable
1.95 Mb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
POST
200
5.75.232.223:80
http://5.75.232.223/5065bfaf5315fdfb.php
DE
executable
78.9 Kb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
POST
200
5.75.232.223:80
http://5.75.232.223/5065bfaf5315fdfb.php
DE
executable
78.9 Kb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
POST
200
5.75.232.223:80
http://5.75.232.223/5065bfaf5315fdfb.php
DE
text
4.94 Kb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
GET
200
5.75.232.223:80
http://5.75.232.223/f7a5529f1c222f09/msvcp140.dll
DE
executable
439 Kb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
GET
200
5.75.232.223:80
http://5.75.232.223/f7a5529f1c222f09/sqlite3.dll
DE
executable
1.06 Mb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
POST
200
5.75.232.223:80
http://5.75.232.223/5065bfaf5315fdfb.php
DE
text
120 b
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
GET
200
5.75.232.223:80
http://5.75.232.223/f7a5529f1c222f09/mozglue.dll
DE
executable
593 Kb
suspicious
2012
53dbbfdec1c497f44e02aed8a942da91.exe
GET
200
5.75.232.223:80
http://5.75.232.223/f7a5529f1c222f09/softokn3.dll
DE
executable
251 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2012
53dbbfdec1c497f44e02aed8a942da91.exe
5.75.232.223:80
—
Hetzner Online GmbH
DE
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Unknown Classtype
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Unknown Classtype
ET MALWARE Win32/Stealc Requesting browsers Config from C2
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Unknown Classtype
ET MALWARE Win32/Stealc Active C2 Responding with browsers Config
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Unknown Classtype
ET MALWARE Win32/Stealc Requesting plugins Config from C2
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Unknown Classtype
ET MALWARE Win32/Stealc Active C2 Responding with plugins Config
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2012
53dbbfdec1c497f44e02aed8a942da91.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2012
53dbbfdec1c497f44e02aed8a942da91.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
53dbbfdec1c497f44e02aed8a942da91.exe