File name:

6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe

Full analysis: https://app.any.run/tasks/888e6f3b-d06f-478e-bb0c-01747e32348d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 00:33:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
telegram
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2A3E1126A556EAF2838E6E04103E2E7F

SHA1:

E5057F7997412B941168BF060011505E3597E460

SHA256:

6D27C1B457A34CE9EDFB4060D9E04EB44D021A7B03223EE72CA569C8C4215438

SSDEEP:

393216:WJLAzqfu2GBzRVDwrrnjUp5BlKnXgPGNd:W6zCu2aRirrA3KnXpf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)

    • Changes the autorun value in the registry

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • 1.exe (PID: 6388)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • 1.exe (PID: 4488)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 632)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 736)
      • 1.exe (PID: 644)
      • 1.exe (PID: 6476)
      • BXIuSsB.exe (PID: 5772)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 1012)

    • RANSOMWARE has been detected

      • BXIuSsB.exe (PID: 5772)

    • Deletes shadow copies

      • cmd.exe (PID: 2516)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 2516)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • teleratserver.exe (PID: 5164)
      • BXIuSsB.exe (PID: 5772)

    • Reads the date of Windows installation

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • 1.exe (PID: 6388)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • 1.exe (PID: 4488)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 632)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 644)
      • 1.exe (PID: 736)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 3676)

    • Reads security settings of Internet Explorer

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • 1.exe (PID: 6388)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • 1.exe (PID: 4488)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 632)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 736)
      • 1.exe (PID: 644)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 3676)

    • Application launched itself

      • 1.exe (PID: 6388)
      • 1.exe (PID: 4488)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 632)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 736)
      • 1.exe (PID: 644)
      • 1.exe (PID: 960)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 3676)
      • teleratserver.exe (PID: 5164)
      • 1.exe (PID: 1012)
      • 1.exe (PID: 5744)
      • 1.exe (PID: 5756)
      • 1.exe (PID: 6132)
      • 1.exe (PID: 6736)
      • 1.exe (PID: 4892)
      • 1.exe (PID: 3132)
      • 1.exe (PID: 1272)
      • 1.exe (PID: 4212)
      • 1.exe (PID: 6592)
      • 1.exe (PID: 6768)
      • 1.exe (PID: 2980)
      • 1.exe (PID: 7156)
      • 1.exe (PID: 920)
      • 1.exe (PID: 812)
      • 1.exe (PID: 1852)
      • 1.exe (PID: 2284)
      • 1.exe (PID: 7020)
      • 1.exe (PID: 1072)
      • 1.exe (PID: 1324)
      • 1.exe (PID: 6824)
      • 1.exe (PID: 4620)

    • Process drops python dynamic module

      • teleratserver.exe (PID: 5164)

    • Process drops legitimate windows executable

      • teleratserver.exe (PID: 5164)

    • The process drops C-runtime libraries

      • teleratserver.exe (PID: 5164)

    • Creates file in the systems drive root

      • BXIuSsB.exe (PID: 5772)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • teleratserver.exe (PID: 5344)

    • Starts CMD.EXE for commands execution

      • BXIuSsB.exe (PID: 5772)

    • Executing commands from a ".bat" file

      • BXIuSsB.exe (PID: 5772)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6668)

  • INFO

    • Reads the machine GUID from the registry

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • 1.exe (PID: 6388)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • BXIuSsB.exe (PID: 5772)
      • 1.exe (PID: 4488)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 632)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 736)
      • 1.exe (PID: 644)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 1012)

    • Process checks computer location settings

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • 1.exe (PID: 6388)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • 1.exe (PID: 4488)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 632)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 736)
      • 1.exe (PID: 644)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 3676)

    • Reads the computer name

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • 1.exe (PID: 6388)
      • Xarch.exe (PID: 6148)
      • archive.exe (PID: 6372)
      • 1.exe (PID: 4488)
      • BXIuSsB.exe (PID: 5772)
      • 1.exe (PID: 6656)
      • teleratserver.exe (PID: 5164)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 632)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 644)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 736)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 1012)

    • Creates files or folders in the user directory

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • archive.exe (PID: 6372)
      • Xarch.exe (PID: 6148)
      • BXIuSsB.exe (PID: 5772)

    • Checks supported languages

      • 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe (PID: 4408)
      • archive.exe (PID: 6372)
      • Xarch.exe (PID: 6148)
      • 1.exe (PID: 6388)
      • 1.exe (PID: 4488)
      • BXIuSsB.exe (PID: 5772)
      • teleratserver.exe (PID: 5164)
      • 1.exe (PID: 6656)
      • 1.exe (PID: 5892)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 1452)
      • 1.exe (PID: 1660)
      • 1.exe (PID: 4920)
      • 1.exe (PID: 632)
      • 1.exe (PID: 3304)
      • 1.exe (PID: 4188)
      • 1.exe (PID: 4112)
      • 1.exe (PID: 2108)
      • 1.exe (PID: 2088)
      • 1.exe (PID: 6148)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 960)
      • 1.exe (PID: 736)
      • 1.exe (PID: 644)
      • 1.exe (PID: 6476)
      • 1.exe (PID: 5864)
      • 1.exe (PID: 1168)
      • 1.exe (PID: 1020)
      • 1.exe (PID: 3676)
      • 1.exe (PID: 1012)

    • Create files in a temporary directory

      • teleratserver.exe (PID: 5164)
      • BXIuSsB.exe (PID: 5772)

    • The sample compiled with english language support

      • teleratserver.exe (PID: 5164)

    • Creates files in the program directory

      • BXIuSsB.exe (PID: 5772)

    • Reads product name

      • BXIuSsB.exe (PID: 5772)

    • PyInstaller has been detected (YARA)

      • teleratserver.exe (PID: 5164)

    • Reads Environment values

      • BXIuSsB.exe (PID: 5772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:12 22:40:08+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 13151232
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc8cbee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: 1.exe
LegalCopyright:
OriginalFileName: 1.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
64
Malicious processes
27
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe 1.exe archive.exe xarch.exe 1.exe THREAT bxiussb.exe teleratserver.exe no specs teleratserver.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe 1.exe no specs teleratserver.exe 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs ping.exe no specs 1.exe no specs bcdedit.exe no specs bcdedit.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs slui.exe no specs 1.exe no specs 1.exe no specs 1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
644"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
736"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
812"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe—1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
872bcdedit.exe /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
920"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe—1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
960"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\update.bat" "C:\Windows\System32\cmd.exe—BXIuSsB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
Total events
26 091
Read events
25 981
Write events
91
Delete events
19

Modification events

(PID) Process:(4408) 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
(PID) Process:(4408) 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4408) 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:archive
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\archive.exe
(PID) Process:(4408) 6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Xarch
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xarch.exe
(PID) Process:(6148) Xarch.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:BXIuSsB
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BXIuSsB.exe
(PID) Process:(6372) archive.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:teleratserver
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teleratserver.exe
(PID) Process:(6372) archive.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4488) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
(PID) Process:(6388) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
(PID) Process:(6388) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
34
Suspicious files
257
Text files
988
Unknown types
0

Dropped files

PID
Process
Filename
Type
6148Xarch.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BXIuSsB.exeexecutable
MD5:BCDD035281ADC7F7F01BAE71763AE58B
SHA256:64246B9455D76A094376B04A2584D16771CD6164DB72287492078719A0C749AB
44086d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xarch.exeexecutable
MD5:68974E2FCE3960049F8398FE11B08619
SHA256:BCF8464D042171D7ECAADA848B5403B6A810A91F7FD8F298B611E94FA7250463
44086d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\archive.exeexecutable
MD5:635610F9312FA71DEE9C5B5812E42FB0
SHA256:CF9410565F8A06AF92D65E118BD2DBAEB146D7E51DE2C35BA84B47CFA8E4F53B
5164teleratserver.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_bz2.pydexecutable
MD5:3DC8AF67E6EE06AF9EEC52FE985A7633
SHA256:C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
5164teleratserver.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_decimal.pydexecutable
MD5:17CA59B401EEFD4AB19991F1863FB556
SHA256:7B3FAB77197E0A4ED13642F462343AE34C0688156F0665D18F514C61A327B033
6372archive.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teleratserver.exeexecutable
MD5:00F86C7D0723797F6D8AB079A24DFC3E
SHA256:603FCC53FD7848CD300DAD85BEF9A6B80ACAA7984AA9CB9217CDD012FF1CE5F0
5164teleratserver.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\VCRUNTIME140.dllexecutable
MD5:0E675D4A7A5B7CCD69013386793F68EB
SHA256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
5164teleratserver.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_multiprocessing.pydexecutable
MD5:9B1C3FDF64E5E642CEC1A82AC76F8184
SHA256:4AFF330CAFB4B497CB45A91A2E9E8A64B44F998F582DD795B3DF58963D5F76F2
5164teleratserver.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\PIL\_imagingft.cp38-win_amd64.pydexecutable
MD5:EF4D632D318CE7252D87619B1A3F5462
SHA256:9490F6E5C0AC1041337E773D1871284CB29CE8E6B7889F203CB83D1FAE1205AC
5164teleratserver.exeC:\Users\admin\AppData\Local\Temp\_MEI51642\_ctypes.pydexecutable
MD5:F1E33A8F6F91C2ED93DC5049DD50D7B8
SHA256:9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6512
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.5
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.67
  • 40.126.32.138
  • 40.126.32.136
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
5344
teleratserver.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
5344
teleratserver.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6d27c1b457a34ce9edfb4060d9e04eb44d021a7b03223ee72ca569c8c4215438.exe