Malware analysis https://shaderblox.com/ Malicious activity

Add for printing

URL:	https://shaderblox.com/
Full analysis:	https://app.any.run/tasks/992fe55f-97d2-4df1-872e-d78573f7435b
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	April 20, 2025, 16:31:55
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	arch-doc stealer evasion duvetstealer
Indicators:
MD5:	06D07C8118D24CE5AB2E783479203305
SHA1:	DD6E7A422C0A19C613B06791FB95A465F7E5255E
SHA256:	79D9A64A1C25D3E4D5FDA2212CF16DC2CE7AA2A127142C48A06473A611549925
SSDEEP:	3:N8AtJ6IK:2AXK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Actions looks like stealing of personal data
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Bypass execution policy to execute commands
  - powershell.exe (PID: 6980)
  - powershell.exe (PID: 7444)
- Changes powershell execution policy (Bypass)
  - cmd.exe (PID: 3176)
  - cmd.exe (PID: 12144)
- Uses TASKKILL.EXE to kill security tools
  - cmd.exe (PID: 2896)
  - cmd.exe (PID: 4932)
  - cmd.exe (PID: 9640)
  - cmd.exe (PID: 3800)
  - cmd.exe (PID: 9840)
  - cmd.exe (PID: 9948)
  - cmd.exe (PID: 5984)
  - cmd.exe (PID: 3016)
  - cmd.exe (PID: 9036)
  - cmd.exe (PID: 3028)
  - cmd.exe (PID: 4224)
  - cmd.exe (PID: 2852)
  - cmd.exe (PID: 11260)
  - cmd.exe (PID: 10384)
  - cmd.exe (PID: 10296)
  - cmd.exe (PID: 10268)
  - cmd.exe (PID: 5232)
  - cmd.exe (PID: 10528)
  - cmd.exe (PID: 10788)
  - cmd.exe (PID: 10352)
  - cmd.exe (PID: 10412)
  - cmd.exe (PID: 10464)
  - cmd.exe (PID: 11216)
  - cmd.exe (PID: 11192)
  - cmd.exe (PID: 10512)
  - cmd.exe (PID: 11132)
  - cmd.exe (PID: 3012)
  - cmd.exe (PID: 10492)
  - cmd.exe (PID: 11788)
  - cmd.exe (PID: 11284)
  - cmd.exe (PID: 11700)
  - cmd.exe (PID: 11684)
  - cmd.exe (PID: 10828)
  - cmd.exe (PID: 11240)
  - cmd.exe (PID: 10808)
  - cmd.exe (PID: 10552)
  - cmd.exe (PID: 11116)
  - cmd.exe (PID: 10592)
  - cmd.exe (PID: 10768)
  - cmd.exe (PID: 11540)
  - cmd.exe (PID: 11664)
  - cmd.exe (PID: 11596)
  - cmd.exe (PID: 11760)
  - cmd.exe (PID: 10328)
  - cmd.exe (PID: 11628)
  - cmd.exe (PID: 5756)
  - cmd.exe (PID: 13252)
  - cmd.exe (PID: 12912)
  - cmd.exe (PID: 12936)
  - cmd.exe (PID: 11580)
  - cmd.exe (PID: 3300)
  - cmd.exe (PID: 10736)
  - cmd.exe (PID: 3896)
  - cmd.exe (PID: 2320)
  - cmd.exe (PID: 1616)
  - cmd.exe (PID: 5072)
  - cmd.exe (PID: 1812)
  - cmd.exe (PID: 6272)
  - cmd.exe (PID: 1300)
  - cmd.exe (PID: 9044)
  - cmd.exe (PID: 13196)
  - cmd.exe (PID: 7780)
  - cmd.exe (PID: 11656)
  - cmd.exe (PID: 8056)
  - cmd.exe (PID: 4376)
  - cmd.exe (PID: 9436)
  - cmd.exe (PID: 12368)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 10924)
  - cmd.exe (PID: 14536)
  - cmd.exe (PID: 10324)
  - cmd.exe (PID: 16080)
  - cmd.exe (PID: 16236)
  - cmd.exe (PID: 12992)
  - cmd.exe (PID: 9912)
  - cmd.exe (PID: 9568)
  - cmd.exe (PID: 11364)
  - cmd.exe (PID: 3176)
  - cmd.exe (PID: 13476)
  - cmd.exe (PID: 14180)
  - cmd.exe (PID: 7904)
  - cmd.exe (PID: 14864)
  - cmd.exe (PID: 14600)
  - cmd.exe (PID: 14872)
  - cmd.exe (PID: 14264)
  - cmd.exe (PID: 3956)
  - cmd.exe (PID: 8044)
  - cmd.exe (PID: 13748)
  - cmd.exe (PID: 2664)
  - cmd.exe (PID: 7316)
- Changes powershell execution policy (Unrestricted)
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- DUVETSTEALER has been detected
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 6944)
- Steals credentials from Web Browsers
  - shaderblox.exe (PID: 6944)
- Connects to the CnC server
  - shaderblox.exe (PID: 6944)
- Changes the autorun value in the registry
  - reg.exe (PID: 15124)
SUSPICIOUS
- Executes as Windows Service
  - VSSVC.exe (PID: 9572)
- Process drops legitimate windows executable
  - msiexec.exe (PID: 9292)
- Starts application with an unusual extension
  - cmd.exe (PID: 8144)
  - cmd.exe (PID: 2908)
- Starts CMD.EXE for commands execution
  - shaderblox.exe (PID: 6944)
  - NETSTAT.EXE (PID: 7104)
  - shaderblox.exe (PID: 11852)
- Uses TASKKILL.EXE to kill process
  - cmd.exe (PID: 8800)
  - cmd.exe (PID: 7896)
  - cmd.exe (PID: 5216)
  - cmd.exe (PID: 2644)
  - cmd.exe (PID: 9564)
  - cmd.exe (PID: 7852)
  - cmd.exe (PID: 3020)
  - cmd.exe (PID: 9692)
  - cmd.exe (PID: 3304)
  - cmd.exe (PID: 7876)
  - cmd.exe (PID: 8432)
  - cmd.exe (PID: 6820)
  - cmd.exe (PID: 7812)
  - cmd.exe (PID: 8932)
  - cmd.exe (PID: 4976)
  - cmd.exe (PID: 3032)
  - cmd.exe (PID: 5020)
  - cmd.exe (PID: 9864)
  - cmd.exe (PID: 9972)
  - cmd.exe (PID: 6244)
  - cmd.exe (PID: 9788)
  - cmd.exe (PID: 2384)
  - cmd.exe (PID: 7176)
  - cmd.exe (PID: 3956)
  - cmd.exe (PID: 8144)
  - cmd.exe (PID: 6980)
  - cmd.exe (PID: 516)
  - cmd.exe (PID: 9304)
  - cmd.exe (PID: 7808)
  - cmd.exe (PID: 6668)
  - cmd.exe (PID: 10668)
  - cmd.exe (PID: 6620)
  - cmd.exe (PID: 7188)
  - cmd.exe (PID: 3192)
  - cmd.exe (PID: 8252)
  - cmd.exe (PID: 11516)
  - cmd.exe (PID: 10872)
  - cmd.exe (PID: 9108)
  - cmd.exe (PID: 2084)
  - cmd.exe (PID: 9280)
  - cmd.exe (PID: 10744)
  - cmd.exe (PID: 4300)
  - cmd.exe (PID: 672)
  - cmd.exe (PID: 4268)
  - cmd.exe (PID: 5380)
  - cmd.exe (PID: 10712)
  - cmd.exe (PID: 10940)
  - cmd.exe (PID: 9580)
  - cmd.exe (PID: 11040)
  - cmd.exe (PID: 10908)
  - cmd.exe (PID: 10696)
  - cmd.exe (PID: 11724)
  - cmd.exe (PID: 11108)
  - cmd.exe (PID: 10608)
  - cmd.exe (PID: 11740)
  - cmd.exe (PID: 10548)
  - cmd.exe (PID: 132)
  - cmd.exe (PID: 8260)
  - cmd.exe (PID: 10972)
  - cmd.exe (PID: 10992)
  - cmd.exe (PID: 9428)
  - cmd.exe (PID: 11008)
  - cmd.exe (PID: 11440)
  - cmd.exe (PID: 11068)
  - cmd.exe (PID: 10636)
  - cmd.exe (PID: 11420)
  - cmd.exe (PID: 11388)
  - cmd.exe (PID: 11308)
  - cmd.exe (PID: 10324)
  - cmd.exe (PID: 11400)
  - cmd.exe (PID: 11708)
  - cmd.exe (PID: 9620)
  - cmd.exe (PID: 11456)
  - cmd.exe (PID: 11380)
  - cmd.exe (PID: 14520)
  - cmd.exe (PID: 16220)
  - cmd.exe (PID: 8280)
  - cmd.exe (PID: 15268)
  - cmd.exe (PID: 14116)
  - cmd.exe (PID: 9304)
  - cmd.exe (PID: 11484)
  - cmd.exe (PID: 12660)
  - cmd.exe (PID: 14804)
  - cmd.exe (PID: 11288)
  - cmd.exe (PID: 5256)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 10312)
  - cmd.exe (PID: 7516)
  - cmd.exe (PID: 7668)
  - cmd.exe (PID: 7560)
  - cmd.exe (PID: 7772)
  - cmd.exe (PID: 7720)
  - cmd.exe (PID: 9344)
  - cmd.exe (PID: 7788)
  - cmd.exe (PID: 9844)
  - cmd.exe (PID: 11780)
  - cmd.exe (PID: 7504)
  - cmd.exe (PID: 7696)
  - cmd.exe (PID: 13060)
  - cmd.exe (PID: 12236)
  - cmd.exe (PID: 4068)
  - cmd.exe (PID: 10288)
  - cmd.exe (PID: 1764)
  - cmd.exe (PID: 5344)
  - cmd.exe (PID: 4724)
  - cmd.exe (PID: 3768)
  - cmd.exe (PID: 11856)
  - cmd.exe (PID: 8216)
  - cmd.exe (PID: 7280)
  - cmd.exe (PID: 5280)
  - cmd.exe (PID: 12928)
  - cmd.exe (PID: 4944)
  - cmd.exe (PID: 7840)
  - cmd.exe (PID: 8000)
  - cmd.exe (PID: 9536)
  - cmd.exe (PID: 12180)
  - cmd.exe (PID: 11784)
  - cmd.exe (PID: 12956)
  - cmd.exe (PID: 11548)
  - cmd.exe (PID: 10420)
  - cmd.exe (PID: 496)
  - cmd.exe (PID: 5868)
  - cmd.exe (PID: 7172)
  - cmd.exe (PID: 11328)
  - cmd.exe (PID: 14100)
  - cmd.exe (PID: 14572)
  - cmd.exe (PID: 7844)
  - cmd.exe (PID: 13800)
  - cmd.exe (PID: 11272)
  - cmd.exe (PID: 13824)
  - cmd.exe (PID: 13164)
  - cmd.exe (PID: 12080)
  - cmd.exe (PID: 10616)
  - cmd.exe (PID: 11124)
  - cmd.exe (PID: 7876)
  - cmd.exe (PID: 11140)
  - cmd.exe (PID: 15548)
  - cmd.exe (PID: 15856)
  - cmd.exe (PID: 8016)
  - cmd.exe (PID: 10428)
  - cmd.exe (PID: 10056)
  - cmd.exe (PID: 15800)
  - cmd.exe (PID: 13908)
  - cmd.exe (PID: 14312)
  - cmd.exe (PID: 10884)
  - cmd.exe (PID: 11776)
  - cmd.exe (PID: 11412)
  - cmd.exe (PID: 10536)
  - cmd.exe (PID: 5232)
  - cmd.exe (PID: 16308)
  - cmd.exe (PID: 1136)
  - cmd.exe (PID: 11048)
  - cmd.exe (PID: 15688)
  - cmd.exe (PID: 672)
  - cmd.exe (PID: 15040)
  - cmd.exe (PID: 13444)
  - cmd.exe (PID: 12848)
  - cmd.exe (PID: 14408)
- The process executes Powershell scripts
  - cmd.exe (PID: 3176)
  - cmd.exe (PID: 12144)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 9292)
- CSC.EXE is used to compile C# code
  - csc.exe (PID: 9428)
  - csc.exe (PID: 7684)
- Executable content was dropped or overwritten
  - csc.exe (PID: 9428)
  - csc.exe (PID: 7684)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 3176)
  - shaderblox.exe (PID: 6944)
  - cmd.exe (PID: 812)
  - cmd.exe (PID: 14012)
  - cmd.exe (PID: 16092)
  - cmd.exe (PID: 15832)
  - cmd.exe (PID: 12144)
  - shaderblox.exe (PID: 11852)
- Application launched itself
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- The process hides Powershell's copyright startup banner
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- The process bypasses the loading of PowerShell profile settings
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Potential Corporate Privacy Violation
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Checks for external IP
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Uses ROUTE.EXE to obtain the routing table information
  - cmd.exe (PID: 15092)
- Using 'findstr.exe' to search for text patterns in files and output
  - cmd.exe (PID: 13388)
- Process uses IPCONFIG to discover network configuration
  - cmd.exe (PID: 15588)
- Uses QUSER.EXE to read information about current user sessions
  - query.exe (PID: 11128)
- Get information on the list of running processes
  - shaderblox.exe (PID: 6944)
  - cmd.exe (PID: 9580)
  - cmd.exe (PID: 14024)
  - cmd.exe (PID: 11880)
  - cmd.exe (PID: 15432)
  - cmd.exe (PID: 14272)
  - cmd.exe (PID: 6156)
- Uses TASKKILL.EXE to kill Browsers
  - cmd.exe (PID: 11468)
  - cmd.exe (PID: 12904)
  - cmd.exe (PID: 10352)
  - cmd.exe (PID: 5964)
  - cmd.exe (PID: 13164)
  - cmd.exe (PID: 13976)
  - cmd.exe (PID: 15144)
  - cmd.exe (PID: 14876)
- Cryptography encrypted command line is found
  - cmd.exe (PID: 15832)
  - cmd.exe (PID: 812)
  - powershell.exe (PID: 8116)
  - cmd.exe (PID: 14012)
  - cmd.exe (PID: 16092)
  - powershell.exe (PID: 6700)
  - powershell.exe (PID: 16056)
  - powershell.exe (PID: 3028)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 11600)
- Uses NETSH.EXE to obtain data on the network
  - cmd.exe (PID: 8904)
INFO
- Application launched itself
  - firefox.exe (PID: 1568)
  - firefox.exe (PID: 7980)
  - msedge.exe (PID: 6036)
  - chrome.exe (PID: 7324)
  - msedge.exe (PID: 872)
  - chrome.exe (PID: 16024)
- Manual execution by a user
  - msedge.exe (PID: 6036)
  - WinRAR.exe (PID: 4736)
  - firefox.exe (PID: 1568)
  - msiexec.exe (PID: 4976)
  - shaderblox.exe (PID: 11852)
- Checks supported languages
  - msiexec.exe (PID: 9292)
  - identity_helper.exe (PID: 7844)
  - chcp.com (PID: 5776)
  - csc.exe (PID: 9428)
  - cvtres.exe (PID: 9988)
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 15056)
  - shaderblox.exe (PID: 15048)
  - shaderblox.exe (PID: 14588)
  - chcp.com (PID: 12308)
  - shaderblox.exe (PID: 11852)
  - csc.exe (PID: 7684)
  - cvtres.exe (PID: 7652)
  - shaderblox.exe (PID: 11568)
  - shaderblox.exe (PID: 15308)
- Manages system restore points
  - SrTasks.exe (PID: 10168)
- Reads the computer name
  - msiexec.exe (PID: 9292)
  - identity_helper.exe (PID: 7844)
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 15048)
  - shaderblox.exe (PID: 15056)
  - shaderblox.exe (PID: 14588)
  - shaderblox.exe (PID: 11852)
  - shaderblox.exe (PID: 11568)
  - shaderblox.exe (PID: 15308)
- Reads the software policy settings
  - slui.exe (PID: 8084)
  - slui.exe (PID: 9736)
- Reads Environment values
  - identity_helper.exe (PID: 7844)
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 9292)
  - chrome.exe (PID: 10224)
  - msedge.exe (PID: 16304)
- Creates files or folders in the user directory
  - msiexec.exe (PID: 9292)
  - shaderblox.exe (PID: 14588)
  - shaderblox.exe (PID: 6944)
- The sample compiled with english language support
  - msiexec.exe (PID: 9292)
  - chrome.exe (PID: 10224)
  - msedge.exe (PID: 16304)
- Creates a software uninstall entry
  - msiexec.exe (PID: 9292)
- Create files in a temporary directory
  - shaderblox.exe (PID: 6944)
  - cvtres.exe (PID: 9988)
  - csc.exe (PID: 9428)
  - shaderblox.exe (PID: 11852)
  - csc.exe (PID: 7684)
  - cvtres.exe (PID: 7652)
- Reads product name
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Changes the display of characters in the console
  - cmd.exe (PID: 8144)
  - cmd.exe (PID: 2908)
- Reads the machine GUID from the registry
  - csc.exe (PID: 9428)
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 14588)
  - csc.exe (PID: 7684)
  - shaderblox.exe (PID: 11852)
- Checks proxy server information
  - shaderblox.exe (PID: 6944)
  - slui.exe (PID: 9736)
  - shaderblox.exe (PID: 11852)
- Reads CPU info
  - shaderblox.exe (PID: 6944)
  - shaderblox.exe (PID: 11852)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - powershell.exe (PID: 12560)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 7144)
  - powershell.exe (PID: 13148)
  - powershell.exe (PID: 10996)
  - powershell.exe (PID: 11456)
- Creates files in the program directory
  - shaderblox.exe (PID: 6944)
- Prints a route via ROUTE.EXE
  - ROUTE.EXE (PID: 13472)
- Process checks computer location settings
  - shaderblox.exe (PID: 6944)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

1 269

Monitored processes

1 123

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

132

C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /im Cheat Engine 7.2.exe /f"

C:\Windows\System32\cmd.exe

—

shaderblox.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

300

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2528 --field-trial-handle=2352,i,8372846764204309793,1621587992458243211,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

444

netstat -ano

C:\Windows\System32\NETSTAT.EXE

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

TCP/IP Netstat Command

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\iphlpapi.dll

456

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

496

C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /im Ida.exe /f"

C:\Windows\System32\cmd.exe

—

shaderblox.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

128

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

516

C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /im KsDumperClient.exe /f"

C:\Windows\System32\cmd.exe

—

shaderblox.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

128

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

516

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

660

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

672

C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /im Cheat Engine 6.8.exe /f"

C:\Windows\System32\cmd.exe

—

shaderblox.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

672

C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /im Ida64.exe /f"

C:\Windows\System32\cmd.exe

—

shaderblox.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

128

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

Add for printing

Total events

275 330

Read events

274 904

Write events

402

Delete events

Modification events


(PID) Process:	(7324) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(7324) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(7324) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(7324) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(7324) chrome.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(6036) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(6036) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(6036) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(6036) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: 3732C893CE912F00
(PID) Process:	(6036) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0

Add for printing

Executable files

Suspicious files

1 300

Text files

313

Unknown types

Dropped files

PID	Process	Filename		Type
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c14e.TMP		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c14e.TMP		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c14e.TMP		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c14e.TMP		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c14e.TMP		—
		MD5:—	SHA256:—
7324	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c14e.TMP		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

242

DNS requests

311

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	23.48.23.166:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7980	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt?ipv4	unknown	—	—	whitelisted
7980	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/canonical.html	unknown	—	—	whitelisted
7980	firefox.exe	POST	200	184.24.77.71:80	http://r11.o.lencr.org/	unknown	—	—	whitelisted
7980	firefox.exe	POST	200	184.24.77.71:80	http://r11.o.lencr.org/	unknown	—	—	whitelisted
7980	firefox.exe	POST	200	184.24.77.61:80	http://r10.o.lencr.org/	unknown	—	—	whitelisted
7980	firefox.exe	POST	200	184.24.77.61:80	http://r10.o.lencr.org/	unknown	—	—	whitelisted
7980	firefox.exe	POST	200	142.250.185.163:80	http://o.pki.goog/s/wr3/UTA	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
2104	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	23.48.23.166:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7548	chrome.exe	31.186.11.5:443	shaderblox.com	TURKTICARET.NET YAZILIM HIZMETLERI SAN. ve TIC. A.S.	TR	unknown
7324	chrome.exe	239.255.255.250:1900	—	—	—	whitelisted
7548	chrome.exe	74.125.133.84:443	accounts.google.com	GOOGLE	US	whitelisted
7548	chrome.exe	95.0.97.184:443	kvkk.gov.tr	Turk Telekom	TR	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146 20.73.194.208	whitelisted
crl.microsoft.com	23.48.23.166 23.48.23.156 23.48.23.143	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
google.com	142.250.185.174	whitelisted
shaderblox.com	31.186.11.5	unknown
accounts.google.com	74.125.133.84	whitelisted
kvkk.gov.tr	95.0.97.184	unknown
shader-blox.org	104.21.32.1 104.21.16.1 104.21.96.1 104.21.80.1 104.21.48.1 104.21.64.1 104.21.112.1	unknown
client.wns.windows.com	172.211.123.250 172.211.123.249	whitelisted
login.live.com	20.190.160.67 20.190.160.20 40.126.32.140 20.190.160.4 20.190.160.131 20.190.160.132 20.190.160.66 20.190.160.128	whitelisted

Threats

PID	Process	Class	Message
6944	shaderblox.exe	Potential Corporate Privacy Violation	ET INFO IP Check Domain (myexternalip .com in TLS SNI)
6944	shaderblox.exe	Potential Corporate Privacy Violation	ET INFO IP Check Domain (myexternalip .com in TLS SNI)
2196	svchost.exe	A Network Trojan was detected	ET MALWARE DuvetStealer Related Domain (duvetstealer .com) in DNS Lookup
6944	shaderblox.exe	A Network Trojan was detected	ET MALWARE DuvetStealer C2 (send-token) Traffic Outbound
6944	shaderblox.exe	Potential Corporate Privacy Violation	ET INFO IP Check Domain (myexternalip .com in TLS SNI)
2196	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] hCaptcha Enterprise Challenge
2196	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] hCaptcha Enterprise Challenge
6944	shaderblox.exe	Potential Corporate Privacy Violation	ET INFO IP Check Domain (myexternalip .com in TLS SNI)

Add for printing

No debug info

General Info

https://shaderblox.com/

06D07C8118D24CE5AB2E783479203305

DD6E7A422C0A19C613B06791FB95A465F7E5255E

79D9A64A1C25D3E4D5FDA2212CF16DC2CE7AA2A127142C48A06473A611549925

3:N8AtJ6IK:2AXK

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

Bypass execution policy to execute commands

Changes powershell execution policy (Bypass)

Uses TASKKILL.EXE to kill security tools

Changes powershell execution policy (Unrestricted)

DUVETSTEALER has been detected

Steals credentials from Web Browsers

Connects to the CnC server

Changes the autorun value in the registry

SUSPICIOUS

Executes as Windows Service

Process drops legitimate windows executable

Starts application with an unusual extension

Starts CMD.EXE for commands execution

Uses TASKKILL.EXE to kill process

The process executes Powershell scripts

Reads the Windows owner or organization settings

CSC.EXE is used to compile C# code

Executable content was dropped or overwritten

Starts POWERSHELL.EXE for commands execution

Application launched itself

The process hides Powershell's copyright startup banner

The process bypasses the loading of PowerShell profile settings

Potential Corporate Privacy Violation

Checks for external IP

Uses ROUTE.EXE to obtain the routing table information

Using 'findstr.exe' to search for text patterns in files and output

Process uses IPCONFIG to discover network configuration

Uses QUSER.EXE to read information about current user sessions

Get information on the list of running processes

Uses TASKKILL.EXE to kill Browsers

Cryptography encrypted command line is found

Uses REG/REGEDIT.EXE to modify registry

Uses NETSH.EXE to obtain data on the network

INFO

Application launched itself

Manual execution by a user

Checks supported languages

Manages system restore points

Reads the computer name

Reads the software policy settings

Reads Environment values

Executable content was dropped or overwritten

Creates files or folders in the user directory

The sample compiled with english language support

Creates a software uninstall entry

Create files in a temporary directory

Reads product name

Changes the display of characters in the console

Reads the machine GUID from the registry

Checks proxy server information

Reads CPU info

Checks if a key exists in the options dictionary (POWERSHELL)

Script raised an exception (POWERSHELL)

Creates files in the program directory

Prints a route via ROUTE.EXE

Process checks computer location settings

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules