download:

Service32.exe

Full analysis: https://app.any.run/tasks/40b2e71a-9a16-4923-89db-b53ce260c9b0
Verdict: Malicious activity
Threats:

PrivateLoader is a malware family that is specifically created to infect computer systems and drop additional malicious programs. It operates using a pay-per-install business model, which means that the individuals behind it are paid for each instance of successful deployment of different types of harmful programs, including trojans, stealers, and other ransomware.

Malware Trends Tracker     >>>
Analysis date: June 19, 2023, 08:37:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
privateloader
g0njxa
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

831F2A5B64F7C7193B2D54777DCF3C14

SHA1:

51C75C5597C7775C6186F7CD9C8F94A79492CC32

SHA256:

7A650B7AF16721E46686633A253C967184414183A7D2BE0CB64978E4D8880BA6

SSDEEP:

98304:yB2DbYegUN3PAXm9MPFJhYH33fKgXh2L++7xNYIR5lO3YzDxHLU61QhL/:Aez3PAXOMPFDs3fKgo7BFRHQii

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PRIVATELOADER detected by memory dumps

      • Service32.exe (PID: 3024)

  • SUSPICIOUS

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)_update

      • Service32.exe (PID: 3024)

    • Reads settings of System Certificates

      • Service32.exe (PID: 3024)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Service32.exe (PID: 3024)

  • INFO

    • Checks supported languages

      • Service32.exe (PID: 3024)

    • The process checks LSA protection

      • Service32.exe (PID: 3024)

    • Reads the computer name

      • Service32.exe (PID: 3024)

    • Reads the machine GUID from the registry

      • Service32.exe (PID: 3024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

PrivateLoader

(PID) Process(3024) Service32.exe
C2 (4)85.208.136.10
94.142.138.131
94.142.138.113
208.67.104.60
Attributes
Payload (0)
Strings (62)Unknown
SOFTWARE\Microsoft\Cryptography
MachineGuid
telegram.org
twitter.com
yandex.ru
google.com
/api/tracemap.php
http://
15.5pnp.10.lock
data=
/api/firecom.php
ipinfo.io/widget
country
db-ip.com
data-api-key="
/self
countryCode
www.maxmind.com/geoip/v2.1/city/me
iso_code
GetIP
api.ipgeolocation.io/ipgeo?include=hostname&ip=
country_code2
PowerControl
\PowerControl
\PowerControl_Svc.exe
Power monitoring service for your device.
WININET.dll
WINHTTP.dll
85.208.136.10
94.142.138.131
94.142.138.113
208.67.104.60
GetVersion|
GetUpdateLink
https://
Later
" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
schtasks /create /f /RU "
" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpSetTimeouts
CharNextA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductVersion: 7.0.45.1145
ProductName: TCDirectChat
ProgramID: com.embarcadero.TCDirectChat
InternalName: N-able Take Control
FileVersion: 7.0.45.1145
FileDescription: TCDirectChat
CompanyName: N-able Take Control
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 7.0.45.1145
FileVersionNumber: 7.0.45.1145
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x70ff23
UninitializedDataSize: -
InitializedDataSize: 852480
CodeSize: 333312
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:06:12 18:13:47+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 12-Jun-2023 18:13:47
Detected languages:
  • English - United States
CompanyName: N-able Take Control
FileDescription: TCDirectChat
FileVersion: 7.0.45.1145
InternalName: N-able Take Control
ProgramID: com.embarcadero.TCDirectChat
ProductName: TCDirectChat
ProductVersion: 7.0.45.1145

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 12-Jun-2023 18:13:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000514EF
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.rdata
0x00053000
0x0000AB90
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
.data
0x0005E000
0x000017FC
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.vmp;""@&w1
0x00060000
0x00317726
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.vmp;""@\x08\x05
0x00378000
0x00000508
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.05759
.vmp;""@ \xb1O
0x00379000
0x004FB120
0x004FB200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.94393
.reloc
0x00875000
0x000005F8
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.34129
.rsrc
0x00876000
0x0001DD42
0x0001DE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.56715

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.27544
1838
UNKNOWN
English - United States
RT_MANIFEST
2
7.97696
51629
UNKNOWN
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
SETUPAPI.dll
SHELL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #PRIVATELOADER service32.exe service32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2436"C:\Users\admin\AppData\Local\Temp\Service32.exe" C:\Users\admin\AppData\Local\Temp\Service32.exe—explorer.exe
User:
admin
Company:
N-able Take Control
Integrity Level:
MEDIUM
Description:
TCDirectChat
Exit code:
3221226540
Version:
7.0.45.1145
Modules
Images
c:\users\admin\appdata\local\temp\service32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3024"C:\Users\admin\AppData\Local\Temp\Service32.exe" C:\Users\admin\AppData\Local\Temp\Service32.exe
explorer.exe
User:
admin
Company:
N-able Take Control
Integrity Level:
HIGH
Description:
TCDirectChat
Exit code:
0
Version:
7.0.45.1145
Modules
Images
c:\users\admin\appdata\local\temp\service32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
PrivateLoader
(PID) Process(3024) Service32.exe
C2 (4)85.208.136.10
94.142.138.131
94.142.138.113
208.67.104.60
Attributes
Payload (0)
Strings (62)Unknown
SOFTWARE\Microsoft\Cryptography
MachineGuid
telegram.org
twitter.com
yandex.ru
google.com
/api/tracemap.php
http://
15.5pnp.10.lock
data=
/api/firecom.php
ipinfo.io/widget
country
db-ip.com
data-api-key="
/self
countryCode
www.maxmind.com/geoip/v2.1/city/me
iso_code
GetIP
api.ipgeolocation.io/ipgeo?include=hostname&ip=
country_code2
PowerControl
\PowerControl
\PowerControl_Svc.exe
Power monitoring service for your device.
WININET.dll
WINHTTP.dll
85.208.136.10
94.142.138.131
94.142.138.113
208.67.104.60
GetVersion|
GetUpdateLink
https://
Later
" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
schtasks /create /f /RU "
" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpSetTimeouts
CharNextA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
Total events
572
Read events
567
Write events
5
Delete events
0

Modification events

(PID) Process:(3024) Service32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
25
DNS requests
10
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3024
Service32.exe
5.255.255.77:443
yandex.ru
YANDEX LLC
RU
whitelisted
3024
Service32.exe
5.255.255.70:443
yandex.ru
YANDEX LLC
RU
whitelisted
3024
Service32.exe
77.88.55.60:443
yandex.ru
YANDEX LLC
RU
whitelisted
3024
Service32.exe
62.217.160.2:443
dzen.ru
LLC VK
RU
unknown
3024
Service32.exe
142.250.185.174:443
google.com
GOOGLE
US
whitelisted
3024
Service32.exe
77.88.55.88:443
yandex.ru
YANDEX LLC
RU
whitelisted
3024
Service32.exe
104.244.42.65:443
twitter.com
TWITTER
US
malicious
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3024
Service32.exe
149.154.167.99:443
telegram.org
Telegram Messenger Inc
GB
malicious

DNS requests

Domain
IP
Reputation
telegram.org
  • 149.154.167.99
whitelisted
twitter.com
  • 104.244.42.65
whitelisted
yandex.ru
  • 5.255.255.77
  • 77.88.55.60
  • 5.255.255.70
  • 77.88.55.88
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
google.com
  • 142.250.185.174
malicious
dzen.ru
  • 62.217.160.2
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Service32.exe