analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dosia.exe

Full analysis: https://app.any.run/tasks/df4119ce-5cd3-41f3-b883-24cc518d63a7
Verdict: Malicious activity
Analysis date: December 06, 2022, 06:20:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

21BE396619D3AB2EFA6A70387180E58F

SHA1:

09A3B689A5077BD89331ACD157EBE621C8714A89

SHA256:

77CC16BE9E6F910BE9B154981DF07EE9E426863E1543E0D84FBDFB7DC6C9D09F

SSDEEP:

98304:I68cgXwWux4ffGqIVkwAZgEkoA/M9wMVuA7r5jF/vKqdD5g+:ZYe2fGNhAJkb/YwM82rhJf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Dosia.exe (PID: 2732)
      • Dosia.exe (PID: 2436)

    • Drops the executable file immediately after the start

      • Dosia.exe (PID: 2436)

  • SUSPICIOUS

    • Application launched itself

      • Dosia.exe (PID: 2436)

    • Executable content was dropped or overwritten

      • Dosia.exe (PID: 2436)

  • INFO

    • Drops a file that was compiled in debug mode

      • Dosia.exe (PID: 2436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 2022-Jul-01 09:53:45

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 248

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2022-Jul-01 09:53:45
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
151122
151552
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.65753
.rdata
155648
55268
55296
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.15306
.data
212992
63700
3072
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.88335
.rsrc
278528
61444
61952
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.35622
.reloc
344064
7560
7680
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.66216

Resources

Title
Entropy
Size
Codepage
Language
Type
0
2.71858
104
Latin 1 / Western European
UNKNOWN
RT_GROUP_ICON
1
5.58652
3752
Latin 1 / Western European
UNKNOWN
RT_ICON
2
6.05629
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
3
5.5741
1384
Latin 1 / Western European
UNKNOWN
RT_ICON
4
7.95079
37019
Latin 1 / Western European
UNKNOWN
RT_ICON
5
5.29119
9640
Latin 1 / Western European
UNKNOWN
RT_ICON
6
5.43869
4264
Latin 1 / Western European
UNKNOWN
RT_ICON
7
5.89356
1128
Latin 1 / Western European
UNKNOWN
RT_ICON
1 (#2)
5.29093
1416
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dosia.exe dosia.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2436"C:\Users\admin\AppData\Local\Temp\Dosia.exe" C:\Users\admin\AppData\Local\Temp\Dosia.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\dosia.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\apphelp.dll
2732"C:\Users\admin\AppData\Local\Temp\Dosia.exe" C:\Users\admin\AppData\Local\Temp\Dosia.exe—Dosia.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\dosia.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\users\admin\appdata\local\temp\_mei24362\ucrtbase.dll
Total events
151
Read events
151
Write events
0
Delete events
0

Modification events

No data
Executable files
50
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:CE61A5D4134DE9112F87D67CA0869CF5
SHA256:EE461EDA292F793D049F67153FA784B56EF2386E49A3B2BCF5EC1B3253E3ED72
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\_socket.pydexecutable
MD5:A7A2A5A17BFD12376E6AEDB5F531C21B
SHA256:F869311C8D4EB3B0CDEF30486EB37C679A35CF11AFA803CD5D9FD61265344810
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\_lzma.pydexecutable
MD5:C573346309D8E967A7ADEBF047F5A693
SHA256:8F8B3CF6CE8A798398139B91B55A5F2CFCA6D997622C7E04DC99455C3AD6997F
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:DED0A05ECD081921F854C718401839A9
SHA256:CD49E371C79A0D242293E764CB9CBA1C6B071BBEDA18E7D2AF28804E7721BA3E
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\_hashlib.pydexecutable
MD5:4F3BF6E8EFAA31A5812F10963182EC96
SHA256:F3A4E21F451667415F88C17D2F58AFCF110A922487228CEFA6D4F8D4261A067C
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:9383F2D137B9A23B858AF26979973F90
SHA256:316CDC6B0993217DE0FBDF2D481E907955A7F7D552171D4ECE7469C7281F6781
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\api-ms-win-core-memory-l1-1-0.dllexecutable
MD5:DBFC2D434F864455F4F1C2257D050940
SHA256:2A76304FBFA3869F152CA955CA76864897409289C0B60EA8FD3C314F4C56ABA6
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\api-ms-win-core-libraryloader-l1-1-0.dllexecutable
MD5:F84DD01E37844165EF8CD0DF2D0B45A4
SHA256:2C3F5F8E9861B05F734DE06A6AC27696DA2DB6193EE003FB62561B6859AFDE11
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\api-ms-win-core-heap-l1-1-0.dllexecutable
MD5:483FF5DFE47A187010B9247799EEB174
SHA256:2AD76AE13FA4BD279F1779312BC2E62D048C9CBB6A528E65B968DFE7431DFEAE
2436Dosia.exeC:\Users\admin\AppData\Local\Temp\_MEI24362\_ssl.pydexecutable
MD5:411AE4B3C3ACDD207570576ABE296E01
SHA256:4766EC375DAD3E2106EEEECC6E2069B7D99E1D7691241735B0EBB39564FE339F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dosia.exe