File name:

610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a

Full analysis: https://app.any.run/tasks/3d29575e-b7f1-4cbb-9076-29acf00013bb
Verdict: Malicious activity
Analysis date: November 12, 2024, 14:16:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

58DC09F0B28331DDB7A937E9566C068D

SHA1:

911FA002CC7BC6A272EA82E5BA1E0FE96CC445D9

SHA256:

610DF50D54BB77ECAE53A64B202A3E01E9B9146D9EB4E4B33BCCFEAE94F1901A

SSDEEP:

6144:vo23zzqWHJszBDB9CNIvGuVn9pYVexGzlSGC4jp831SOThF3b:vvzzXWRBUoGuvWgxaSEjpiHhF3b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • Connects to the CnC server

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • Reads security settings of Internet Explorer

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • The process checks if it is being run in the virtual environment

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • There is functionality for taking screenshot (YARA)

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • Potential Corporate Privacy Violation

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

  • INFO

    • Checks supported languages

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • Reads the computer name

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • Checks proxy server information

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)

    • Create files in a temporary directory

      • 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe (PID: 6800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1995:10:28 03:46:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 7.8
CodeSize: 10240
InitializedDataSize: 231936
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.9.2.0
ProductVersionNumber: 2.3.6.6
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 4.9.2.0
ProductVersion: 2.3.6.6
FileDescription: Outskirts
CompanyName: ArcaBit
LegalCopyright: Forerecited
ProductName: ureterolithiasis
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe

Process information

PID
CMD
Path
Indicators
Parent process
6800"C:\Users\admin\Desktop\610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe" C:\Users\admin\Desktop\610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
explorer.exe
User:
admin
Company:
ArcaBit
Integrity Level:
MEDIUM
Description:
Outskirts
Version:
4.9.2.0
Modules
Images
c:\users\admin\desktop\610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
3 526
Read events
3 520
Write events
6
Delete events
0

Modification events

(PID) Process:(6800) 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:26b799fa
Value:
C:\Users\admin\Desktop\610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
(PID) Process:(6800) 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:userinit
Value:
C:\Windows\system32\userinit.exe,,
(PID) Process:(6800) 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6800) 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6800) 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6800) 610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft
Operation:writeName:d9486693a
Value:
591796
Executable files
0
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6800610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeC:\Users\admin\AppData\Local\Temp\C0D3.tmphtml
MD5:8132448BAE7AE5C79C9779397C0CD048
SHA256:1E9EF9274D2009B5F7692023913041A48DD0E388C6FC96C25824570A8FDC9008
6800610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeC:\Users\admin\AppData\Local\Temp\8859.tmphtml
MD5:66CFE7B01FC7F71D210D846AAAB0AC6C
SHA256:C75D2E2B94C524187614E6F369D1D3672295A7707816D5CD9FB41EEAC4DD968A
6800610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeC:\Users\admin\AppData\Local\Temp\FFF4.tmphtml
MD5:05B3A77D594D548B9B88C0121FCA6E1A
SHA256:5999483D9D7347C3DF192E85944F0839A24C843458B82F7D9E279B1EB01CF10C
6800610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exeC:\Users\admin\AppData\Local\Temp\FC79.tmphtml
MD5:B0672358A653436F0E86646B2C009F99
SHA256:31226EBA6136F36CCC4397A947E3FC306BBE41E2C119145F632613DBCB5C9BE3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
32
DNS requests
10
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
692
RUXIMICS.exe
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
692
RUXIMICS.exe
GET
200
184.30.25.170:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.25.170:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
POST
200
15.197.130.221:80
http://bloodguiltiness.com/news.php
unknown
—
—
malicious
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
POST
200
15.197.130.221:80
http://bloodguiltiness.com/home.php
unknown
—
—
malicious
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
POST
200
15.197.130.221:80
http://bloodguiltiness.com/news.php
unknown
—
—
malicious
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
POST
200
15.197.130.221:80
http://bloodguiltiness.com/news.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
692
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.126.37.136:443
—
Akamai International B.V.
DE
unknown
692
RUXIMICS.exe
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
692
RUXIMICS.exe
184.30.25.170:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
184.30.25.170:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.190
  • 23.48.23.147
  • 23.48.23.162
  • 23.48.23.158
  • 23.48.23.141
  • 23.48.23.159
  • 23.48.23.143
  • 23.48.23.166
  • 23.48.23.194
whitelisted
www.microsoft.com
  • 184.30.25.170
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
bloodguiltiness.com
  • 15.197.130.221
malicious
www.bing.com
  • 104.126.37.130
  • 104.126.37.184
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.128
  • 104.126.37.179
whitelisted
self.events.data.microsoft.com
  • 13.69.239.73
whitelisted

Threats

PID
Process
Class
Message
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Misc Attack
ET Threatview.io High Confidence Cobalt Strike C2 IP group 5
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Misc Attack
ET Threatview.io High Confidence Cobalt Strike C2 IP group 4
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
6800
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
610df50d54bb77ecae53a64b202a3e01e9b9146d9eb4e4b33bccfeae94f1901a