File name:

Zenith Hub.exe

Full analysis: https://app.any.run/tasks/34726872-3b6a-4ee3-a5dc-05803c84740c
Verdict: Malicious activity
Analysis date: February 19, 2025, 17:35:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
themida
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

A6FBCAA120E94E0016C23CC8AFFB6E9D

SHA1:

702B267961F689D42280F4B5CBDD62F9A95CFA56

SHA256:

743E476E4539CC3AAD2B57576692B817164DCD978D9D5313985FE6FBCA656DCC

SSDEEP:

98304:YLn1yIfVeISBTcXj350TT2LJ6JiyBG8G7KRSaj9bc56PjE6yanPnF6i+iCrcGuuT:dEuRlzMMXEyj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Zenith Hub.exe (PID: 5096)

  • SUSPICIOUS

    • Reads the BIOS version

      • Zenith Hub.exe (PID: 5096)

    • Checks for external IP

      • Zenith Hub.exe (PID: 5096)
      • svchost.exe (PID: 2192)

    • Executes application which crashes

      • Zenith Hub.exe (PID: 5096)

  • INFO

    • Checks proxy server information

      • Zenith Hub.exe (PID: 5096)
      • WerFault.exe (PID: 2788)

    • Disables trace logs

      • Zenith Hub.exe (PID: 5096)

    • Checks supported languages

      • Zenith Hub.exe (PID: 5096)

    • .NET Reactor protector has been detected

      • Zenith Hub.exe (PID: 5096)

    • Reads the machine GUID from the registry

      • Zenith Hub.exe (PID: 5096)

    • Themida protector has been detected

      • Zenith Hub.exe (PID: 5096)

    • Reads the computer name

      • Zenith Hub.exe (PID: 5096)

    • Reads the software policy settings

      • WerFault.exe (PID: 2788)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 2788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2086:06:13 22:13:57+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 508416
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xb7c000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: csrss
FileVersion: 1.0.0.0
InternalName: Steal1.exe
LegalCopyright: Copyright © 1907
LegalTrademarks: -
OriginalFileName: Steal1.exe
ProductName: csrss
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zenith hub.exe svchost.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2788C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5096 -s 1580C:\Windows\SysWOW64\WerFault.exe
Zenith Hub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5096"C:\Users\admin\AppData\Local\Temp\Zenith Hub.exe" C:\Users\admin\AppData\Local\Temp\Zenith Hub.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
csrss
Exit code:
3221225477
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\zenith hub.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mscoree.dll
Total events
4 091
Read events
4 077
Write events
14
Delete events
0

Modification events

(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5096) Zenith Hub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Zenith Hub_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2788WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Zenith Hub.exe_e8b1cafe9cad71c71bc3d851be1295f2b8816e7_081e6d30_1ddfa39e-f991-44a2-81be-1a7047d5e926\Report.wer —
MD5:—
SHA256:—
2788WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Zenith Hub.exe.5096.dmp —
MD5:—
SHA256:—
2788WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
2788WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7CF5.tmp.xmlxml
MD5:E9E3CD247DEE54DC32128F3563F12ACC
SHA256:7C4359F8BB1498E8691288FC57346A38CE25669F9C9542798D480947236C5801
2788WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER795A.tmp.dmpbinary
MD5:958CD35B9619FDB36EF63703F41AB2D2
SHA256:9CAC0F22485402CB79E71ED41A11187F4B8D5D9E6AD86B785AF7C2832295C1C1
2788WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:D5C2C0305CA5977B2628699069173B19
SHA256:EA9054E6BBEB402CD60007DA1DF82E5D84CCFBB7B700D454E3D49BD4B8C465D5
2788WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:C234735E7757621D7B81C9D65C5D8F6C
SHA256:5A807C9A154EFC7A9AF24BB0DE01B084C5A8305D4D8C971C15D25569B8E4179F
2788WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:680B0331A3CC8FCCE16367586EC7A721
SHA256:19F1B5D2C7F62663C14D97578411DC610E5F33E6CE4165977314442435F15305
2788WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7CA6.tmp.WERInternalMetadata.xmlbinary
MD5:77D0C00B145F89F08B931D5C81DCC6A5
SHA256:62A72C2D47E2C94ABCB9AA4438BEC8CE97786A53AC85508E6ECF02DDFD23C41B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
36
DNS requests
22
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5096
Zenith Hub.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
4328
svchost.exe
GET
200
23.48.23.150:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4328
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2788
WerFault.exe
GET
200
23.48.23.150:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2788
WerFault.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
396
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
396
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4548
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1412
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4328
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5096
Zenith Hub.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
4328
svchost.exe
23.48.23.150:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4328
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2788
WerFault.exe
52.168.117.173:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2788
WerFault.exe
23.48.23.150:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
crl.microsoft.com
  • 23.48.23.150
  • 23.48.23.159
  • 23.48.23.145
  • 23.48.23.164
  • 23.48.23.158
  • 23.48.23.147
  • 23.48.23.141
  • 23.48.23.143
  • 23.48.23.161
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
watson.events.data.microsoft.com
  • 52.168.117.173
whitelisted
www.bing.com
  • 92.123.104.28
  • 92.123.104.62
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.33
  • 92.123.104.38
  • 92.123.104.31
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.132
  • 20.190.160.128
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.66
  • 20.190.160.14
  • 20.190.160.2
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5096
Zenith Hub.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zenith Hub.exe