File name:

doser.exe

Full analysis: https://app.any.run/tasks/d43f01e0-0815-4cae-bc43-3c883852be91
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: October 05, 2023, 12:07:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5:

4B30467BB8A0C1F50D0705FEBB02C35D

SHA1:

F214BCC748A57055E11E72D2323A8E3606335978

SHA256:

72EB45DEB97510F2A2F7E136DDE62B85900866B9CBB9C64D844DF213DCE20AF4

SSDEEP:

98304:mmSUYaOhaIqORkAZFZSCV2kIPryY9ypAcpBK2PBwt4JDMJ/Zu32WYzmfO4eV6D3I:6w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • doser.exe (PID: 2444)
      • runonce.exe (PID: 1644)

    • Reads settings of System Certificates

      • doser.exe (PID: 2444)

    • Application launched itself

      • WerFault.exe (PID: 1856)

  • INFO

    • Checks supported languages

      • doser.exe (PID: 2444)
      • IMEKLMG.EXE (PID: 1228)
      • IMEKLMG.EXE (PID: 2012)
      • IMEKLMG.EXE (PID: 2028)
      • IMEKLMG.EXE (PID: 2136)

    • Reads the time zone

      • runonce.exe (PID: 1644)

    • Reads the computer name

      • doser.exe (PID: 2444)
      • IMEKLMG.EXE (PID: 2136)
      • IMEKLMG.EXE (PID: 1228)
      • IMEKLMG.EXE (PID: 2012)
      • IMEKLMG.EXE (PID: 2028)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1228)
      • IMEKLMG.EXE (PID: 2012)

    • Create files in a temporary directory

      • doser.exe (PID: 2444)
      • WerFault.exe (PID: 1472)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 1228)
      • runonce.exe (PID: 1644)
      • IMEKLMG.EXE (PID: 2012)
      • IMEKLMG.EXE (PID: 2028)
      • IMEKLMG.EXE (PID: 2136)

    • Reads the machine GUID from the registry

      • doser.exe (PID: 2444)

    • Creates files or folders in the user directory

      • doser.exe (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 2393600
InitializedDataSize: 752640
UninitializedDataSize: -
EntryPoint: 0x63d20
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start doser.exe runonce.exe werfault.exe no specs werfault.exe no specs imeklmg.exe no specs imeklmg.exe no specs imeklmg.exe no specs imeklmg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1228"C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\usp10.dll
1472C:\Windows\System32\WerFault.exe -k -qC:\Windows\System32\WerFault.exe—WerFault.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\werfault.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1644runonce.exe /ExplorerC:\Windows\System32\runonce.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1856"C:\Windows\System32\WerFault.exe" -k -rqC:\Windows\System32\WerFault.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
2012"C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\psapi.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
2028"C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
0
Version:
14.0.4734.1000
Modules
Images
c:\program files (x86)\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\kernelbase.dll
2136"C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
0
Version:
14.0.4734.1000
Modules
Images
c:\program files (x86)\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\user32.dll
2444"C:\Users\admin\AppData\Local\Temp\doser.exe" C:\Users\admin\AppData\Local\Temp\doser.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\doser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\gdi32.dll
Total events
6 784
Read events
6 757
Write events
24
Delete events
3

Modification events

(PID) Process:(2444) doser.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1644) runonce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:*WerKernelReporting
Value:
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
(PID) Process:(1644) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1644) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1644) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1644) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1472) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
Operation:delete valueName:C:\Windows\Minidump\100523-10203-01.dmp
Value:
6C53BFDD84F7D901
(PID) Process:(1472) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
Operation:delete keyName:(default)
Value:
(PID) Process:(1228) IMEKLMG.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\IMEJP\14.0
Operation:writeName:SetPreload
Value:
1
(PID) Process:(2012) IMEKLMG.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\IMEKR\14.0
Operation:writeName:SetPreload
Value:
1
Executable files
0
Suspicious files
7
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2444doser.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1binary
MD5:3434FFB46110BE68616D5CBDFB5F205E
SHA256:C5E78A55088A93C848A539742B068B7E9B298C3539289F85D5AF59EFDCB26E25
2444doser.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2444doser.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1binary
MD5:C5DFB849CA051355EE2DBA1AC33EB028
SHA256:CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B
2444doser.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:CE77916BB4A3ABD5828D06AA1BD67728
SHA256:7B026129C221472B70242A793F673A69BC2D2502B912D87C5DCD516B735810E7
2444doser.exeC:\Users\admin\AppData\Local\Temp\Tar44C4.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
2444doser.exeC:\Users\admin\AppData\Local\Temp\Cab44C3.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1644runonce.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etlbinary
MD5:054699D3CC2FCF4B9D0921C53D4A1CAB
SHA256:5D95335F8A7964894717EE768AD754C70E714E736AB312CF4683FD246E6391B9
1472WerFault.exeC:\Users\admin\AppData\Local\Temp\WER-19531-0.sysdata.xmlxml
MD5:1A7222171599A33DFAA73E69565042B5
SHA256:94383CE23CA33D8EDB92B4529006309D739E3CFFAFAE84B8D472C29455EF6DBC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
745
TCP/UDP connections
49 699
DNS requests
83
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7b1c94b2b8afe3ca
unknown
—
—
unknown
2444
doser.exe
GET
—
91.142.135.116:80
http://rosneft.ru/
unknown
—
—
unknown
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a498b112130d9f69
unknown
—
—
unknown
2444
doser.exe
GET
—
91.142.135.116:80
http://rosneft.ru/
unknown
—
—
unknown
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ed859ba23f86c911
unknown
—
—
unknown
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e92e1a0538c1757d
unknown
—
—
unknown
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b63f9a61eecc366d
unknown
—
—
unknown
2444
doser.exe
GET
—
91.142.135.116:80
http://rosneft.ru/
unknown
—
—
unknown
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cd1acfd59d3832f7
unknown
—
—
unknown
2444
doser.exe
GET
—
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e4c7ed0420e2adbb
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2444
doser.exe
178.248.234.228:443
ria.ru
HLL LLC
RU
unknown
2444
doser.exe
178.248.232.136:443
er.ru
HLL LLC
RU
unknown
2444
doser.exe
81.19.72.34:443
lenta.ru
Rambler Internet Holding LLC
RU
unknown
2444
doser.exe
178.248.238.72:443
magnit.ru
HLL LLC
RU
unknown
2444
doser.exe
185.71.67.7:443
rusal.ru
Storm Systems LLC
RU
unknown
2444
doser.exe
212.164.138.127:443
www.rzd.ru
Rostelecom
RU
unknown
2444
doser.exe
194.54.14.168:443
sberbank.ru
Sberbank of Russia PJSC
RU
unknown

DNS requests

Domain
IP
Reputation
ria.ru
  • 178.248.234.228
whitelisted
lenta.ru
  • 81.19.72.33
  • 81.19.72.34
  • 81.19.72.32
whitelisted
www.rt.com
  • 89.191.237.192
  • 95.181.181.73
unknown
rusal.ru
  • 185.71.67.7
unknown
www.rbc.ru
  • 178.248.234.119
whitelisted
sberbank.ru
  • 194.54.14.168
unknown
zakupki.gov.ru
  • 95.167.245.92
whitelisted
en.kremlin.ru
  • 95.173.136.72
  • 95.173.136.71
  • 95.173.136.70
unknown
tass.ru
  • 185.71.67.4
whitelisted
smotrim.ru
  • 178.248.232.222
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
doser.exe