File name:

builder.exe.exe

Full analysis: https://app.any.run/tasks/09933cb4-295c-4728-bd7b-f2bbc57a3890
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: May 16, 2023, 15:47:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
ransomware
stop
loader
stealer
vidar
trojan
arkei
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

669A891FE610E110917FAD79B6876F55

SHA1:

A762FAA446F6A8DA5770ECCA619FC2CFFDF33AB1

SHA256:

733D197665D90EBCBE41ED14D872DB66604706D8435E694985AD2C459CE59B70

SSDEEP:

12288:HYhoWg3wNMP0/JtiTYdmJDJtnee32UEMWOktn3dR/v2FvMI33knQCk/:HSdNMPoJEYKJweGdSKNR/vQvb30w/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stop is detected

      • builder.exe.exe (PID: 2264)

    • Application was dropped or rewritten from another process

      • build2.exe (PID: 2284)
      • build2.exe (PID: 2448)
      • build3.exe (PID: 2776)
      • mstsca.exe (PID: 3060)

    • VIDAR was detected

      • build2.exe (PID: 2448)

    • Connects to the CnC server

      • build2.exe (PID: 2448)

    • Steals credentials from Web Browsers

      • build2.exe (PID: 2448)

    • Steals credentials

      • build2.exe (PID: 2448)

    • ARKEI was detected

      • build2.exe (PID: 2448)

    • Uses Task Scheduler to run other applications

      • mstsca.exe (PID: 3060)
      • build3.exe (PID: 2776)

    • Actions looks like stealing of personal data

      • build2.exe (PID: 2448)

  • SUSPICIOUS

    • Application launched itself

      • builder.exe.exe (PID: 2608)
      • builder.exe.exe (PID: 1756)
      • builder.exe.exe (PID: 2756)
      • build2.exe (PID: 2284)

    • Reads the Internet Settings

      • builder.exe.exe (PID: 2756)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2448)

    • Checks Windows Trust Settings

      • builder.exe.exe (PID: 2756)
      • build2.exe (PID: 2448)

    • Reads security settings of Internet Explorer

      • builder.exe.exe (PID: 2756)
      • build2.exe (PID: 2448)

    • Uses ICACLS.EXE to modify access control lists

      • builder.exe.exe (PID: 2756)

    • Reads settings of System Certificates

      • builder.exe.exe (PID: 2756)
      • build2.exe (PID: 2448)

    • Executable content was dropped or overwritten

      • builder.exe.exe (PID: 2756)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2448)
      • build3.exe (PID: 2776)

    • Process requests binary or script from the Internet

      • builder.exe.exe (PID: 2264)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • build2.exe (PID: 2448)

    • Connects to unusual port

      • build2.exe (PID: 2448)

    • Reads browser cookies

      • build2.exe (PID: 2448)

    • Searches for installed software

      • build2.exe (PID: 2448)

    • Adds/modifies Windows certificates

      • build2.exe (PID: 2284)

    • The process executes via Task Scheduler

      • mstsca.exe (PID: 3060)

  • INFO

    • Checks supported languages

      • builder.exe.exe (PID: 2608)
      • builder.exe.exe (PID: 2756)
      • builder.exe.exe (PID: 1756)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2284)
      • build2.exe (PID: 2448)
      • mstsca.exe (PID: 3060)
      • build3.exe (PID: 2776)

    • Reads the computer name

      • builder.exe.exe (PID: 2756)
      • build2.exe (PID: 2448)
      • builder.exe.exe (PID: 2264)

    • The process checks LSA protection

      • builder.exe.exe (PID: 2756)
      • icacls.exe (PID: 2408)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2448)

    • Checks proxy server information

      • builder.exe.exe (PID: 2756)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2448)

    • Reads the machine GUID from the registry

      • builder.exe.exe (PID: 2756)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2448)

    • Creates files or folders in the user directory

      • builder.exe.exe (PID: 2756)
      • builder.exe.exe (PID: 2264)
      • build2.exe (PID: 2448)
      • build3.exe (PID: 2776)

    • Create files in a temporary directory

      • builder.exe.exe (PID: 2756)

    • Creates files in the program directory

      • build2.exe (PID: 2448)

    • Reads CPU info

      • build2.exe (PID: 2448)

    • Reads Environment values

      • build2.exe (PID: 2448)

    • Reads product name

      • build2.exe (PID: 2448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductionVersion: 1.24.57.52
ProductName: SolarOmir
ProductsVersion: 36.47.26.15
OriginalFileName: bigthing.exe
LegalCopyright: Copyright (C) 2023, parking
CharacterSet: Unknown (31F6)
LanguageCode: Faeroese
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0x20461)
FileFlags: (none)
FileFlagsMask: 0x183a
ProductVersionNumber: 8.0.0.0
FileVersionNumber: 18.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x759f
UninitializedDataSize: -
InitializedDataSize: 5105152
CodeSize: 672256
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2022:03:22 04:43:53+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 22-Mar-2022 04:43:53
Detected languages:
  • Faroese - Faroe Islands
Debug artifacts:
  • C:\dazipa37\sutemos_yaraceri54_yinacovemu\neme.pdb
LegalCopyright: Copyright (C) 2023, parking
OriginalFilename: bigthing.exe
ProductsVersion: 36.47.26.15
ProductName: SolarOmir
ProductionVersion: 1.24.57.52

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 22-Mar-2022 04:43:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000A406A
0x000A4200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.95623
.data
0x000A6000
0x004C3DBC
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.25934
.rsrc
0x0056A000
0x00015678
0x00015800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.50532
.reloc
0x00580000
0x00004FB2
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
1.69216

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.41767
564
UNKNOWN
UNKNOWN
RT_VERSION
2
4.19382
2216
UNKNOWN
UNKNOWN
RT_ICON
3
3.71658
9640
UNKNOWN
UNKNOWN
RT_ICON
4
3.75604
4264
UNKNOWN
UNKNOWN
RT_ICON
5
3.90755
1128
UNKNOWN
UNKNOWN
RT_ICON
6
4.89956
3752
UNKNOWN
UNKNOWN
RT_ICON
7
4.11299
2216
UNKNOWN
UNKNOWN
RT_ICON
8
3.48764
1384
UNKNOWN
UNKNOWN
RT_ICON
9
2.33778
9640
UNKNOWN
UNKNOWN
RT_ICON
10
2.33069
4264
UNKNOWN
UNKNOWN
RT_ICON

Imports

GDI32.dll
KERNEL32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
11
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start builder.exe.exe no specs builder.exe.exe icacls.exe no specs builder.exe.exe #STOP builder.exe.exe build2.exe no specs #VIDAR build2.exe build3.exe schtasks.exe no specs mstsca.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1756"C:\Users\admin\AppData\Local\Temp\builder.exe.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\builder.exe.exe
builder.exe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\builder.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2180/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Network\mstsca.exe"C:\Windows\SysWOW64\schtasks.exe—mstsca.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2264"C:\Users\admin\AppData\Local\Temp\builder.exe.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\builder.exe.exe
builder.exe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\builder.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2284"C:\Users\admin\AppData\Local\2061dc7e-6981-419e-835e-f497cb78c859\build2.exe" C:\Users\admin\AppData\Local\2061dc7e-6981-419e-835e-f497cb78c859\build2.exe—builder.exe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\2061dc7e-6981-419e-835e-f497cb78c859\build2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2408icacls "C:\Users\admin\AppData\Local\d32b6c53-efe7-4465-8cbe-6023ff52edb4" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\SysWOW64\icacls.exe—builder.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2448"C:\Users\admin\AppData\Local\2061dc7e-6981-419e-835e-f497cb78c859\build2.exe" C:\Users\admin\AppData\Local\2061dc7e-6981-419e-835e-f497cb78c859\build2.exe
build2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\2061dc7e-6981-419e-835e-f497cb78c859\build2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2608"C:\Users\admin\AppData\Local\Temp\builder.exe.exe" C:\Users\admin\AppData\Local\Temp\builder.exe.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\builder.exe.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\system32\user32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\gdi32.dll
2712/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Network\mstsca.exe"C:\Windows\SysWOW64\schtasks.exe—build3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2756"C:\Users\admin\AppData\Local\Temp\builder.exe.exe" C:\Users\admin\AppData\Local\Temp\builder.exe.exe
builder.exe.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\builder.exe.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2776"C:\Users\admin\AppData\Local\2061dc7e-6981-419e-835e-f497cb78c859\build3.exe" C:\Users\admin\AppData\Local\2061dc7e-6981-419e-835e-f497cb78c859\build3.exe
builder.exe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\2061dc7e-6981-419e-835e-f497cb78c859\build3.exe
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
3 358
Read events
3 310
Write events
48
Delete events
0

Modification events

(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2756) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2756) builder.exe.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2264) builder.exe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
12
Suspicious files
16
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2264builder.exe.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\build2[1].exeexecutable
MD5:37B6AAB56A0F770CE58A670322361A1C
SHA256:3D9CF227EF3C29B9CA22C66359FDD61D9B3D3F2BB197EC3DF42D49FF22B989A4
2448build2.exeC:\ProgramData\49514201382288045301943415 —
MD5:—
SHA256:—
2448build2.exeC:\ProgramData\mozglue.dllexecutable
MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
2756builder.exe.exeC:\Users\admin\AppData\Local\Temp\Tar44E1.tmpbinary
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
2756builder.exe.exeC:\Users\admin\AppData\Local\d32b6c53-efe7-4465-8cbe-6023ff52edb4\builder.exe.exeexecutable
MD5:669A891FE610E110917FAD79B6876F55
SHA256:733D197665D90EBCBE41ED14D872DB66604706D8435E694985AD2C459CE59B70
2264builder.exe.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\get[1].htmbinary
MD5:67AAA5591B515F777C60AFBA425A9CEE
SHA256:FEC46F586994F181CA548D986CB047CEF452E33AF313B28F6A9DC24E4F74ED2A
2448build2.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PYPJ678O.txttext
MD5:11BB41BE7A3A75057B46C5790DFF5C9D
SHA256:8E844D353C2017919EB4ABB37DBBC8A68D9FBE2FEDF60D44814997893CC2671F
2264builder.exe.exeC:\SystemID\PersonalID.txttext
MD5:F2750B1FC3E95B1B406AE31BC94B96A1
SHA256:E06C9B06A1A06DC5422A1A54FE8C185D08733FD8B96900C4DABDE3F97157611A
2448build2.exeC:\ProgramData\vcruntime140.dllexecutable
MD5:A37EE36B536409056A86F50E67777DD7
SHA256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
2448build2.exeC:\ProgramData\softokn3.dllexecutable
MD5:4E52D739C324DB8225BD9AB2695F262F
SHA256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
14
DNS requests
5
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2756
builder.exe.exe
GET
200
8.241.121.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5815ae41b77e7315
US
compressed
62.3 Kb
whitelisted
2264
builder.exe.exe
GET
200
211.104.254.139:80
http://colisumy.com/dl/build2.exe
KR
executable
379 Kb
malicious
2448
build2.exe
POST
200
167.235.199.208:8333
http://167.235.199.208:8333/
DE
text
2 b
malicious
2264
builder.exe.exe
GET
200
187.156.23.248:80
http://zexeq.com/files/1/build3.exe
MX
executable
9.50 Kb
malicious
2264
builder.exe.exe
GET
200
123.140.161.243:80
http://zexeq.com/test1/get.php?pid=D2A34488191DA742578166D02E2C8607&first=true
KR
binary
560 b
malicious
2448
build2.exe
GET
200
167.235.199.208:8333
http://167.235.199.208:8333/9dfa7ee730fa2f1efb5ed51dbbec22f5
DE
text
213 b
malicious
2448
build2.exe
GET
200
167.235.199.208:8333
http://167.235.199.208:8333/config.zip
DE
compressed
2.56 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2756
builder.exe.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
2756
builder.exe.exe
8.241.121.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2264
builder.exe.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
2264
builder.exe.exe
211.104.254.139:80
colisumy.com
Korea Telecom
KR
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
2264
builder.exe.exe
123.140.161.243:80
zexeq.com
LG DACOM Corporation
KR
malicious
2448
build2.exe
167.235.199.208:8333
—
Hetzner Online GmbH
DE
malicious
2448
build2.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 162.0.217.254
shared
ctldl.windowsupdate.com
  • 8.241.121.126
  • 8.241.9.254
  • 8.238.34.254
  • 8.238.30.126
  • 8.248.145.254
whitelisted
colisumy.com
  • 211.104.254.139
  • 210.182.29.70
  • 37.34.248.24
  • 175.119.10.231
  • 211.171.233.126
  • 211.119.84.112
  • 84.224.34.240
  • 187.233.24.141
  • 95.107.163.44
  • 222.236.49.124
malicious
zexeq.com
  • 123.140.161.243
  • 187.156.23.248
  • 211.171.233.126
  • 211.59.14.90
  • 222.236.49.123
  • 175.120.254.9
  • 187.212.183.201
  • 211.40.39.251
  • 95.107.163.44
  • 37.34.248.24
malicious
t.me
  • 149.154.167.99
whitelisted

Threats

PID
Process
Class
Message
328
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2756
builder.exe.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
2264
builder.exe.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
2264
builder.exe.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
2264
builder.exe.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
2264
builder.exe.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
2264
builder.exe.exe
A Network Trojan was detected
ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
2264
builder.exe.exe
A Network Trojan was detected
ET MALWARE Win32/Vodkagats Loader Requesting Payload
2264
builder.exe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2448
build2.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
builder.exe.exe