File name: | Annexure_1_BOQ_and_Supporting_Documents.cmd |
Full analysis: | https://app.any.run/tasks/f88cb768-164c-46e8-83b9-35f91b70d8ce |
Verdict: | Malicious activity |
Threats: | DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment. |
Analysis date: | April 15, 2025, 18:27:33 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | Unicode text, UTF-8 text, with very long lines (1581), with CRLF line terminators |
MD5: | E177070CD5EC02B435A0D9BFF45F7596 |
SHA1: | DD6FE3DBC8A4A7F5581D460B30C4045D6F16079F |
SHA256: | 7CF06902620427A2ECF5D05A473CBB4E9E734251CB00CA82F0AF726BD9F66EA6 |
SSDEEP: | 49152:AI12zx8PTa0ToNlyLiz9kBj5zm9xMqfo4gFdGNMk0FjgudvK7:0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
472 | C:\WINDOWS\system32\rundll32.exe "C:\WINDOWS\system32\ieframe.dll",OpenURL C:\\ProgramData\\Blqlsjlk.url | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
632 | C:\WINDOWS\system32\cmd.exe /c C:\\ProgramData\\9874.cmd | C:\Windows\SysWOW64\cmd.exe | — | chrome.PIF | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
664 | C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\\Windows\\System32\\cmd.exe" "C:\\Users\\Public\\Libraries\\alpha.pif" | C:\Users\Public\Libraries\expha.pif | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® CAB File Extract Utility Exit code: 0 Version: 5.00 (WinBuild.160101.0800) Modules
| |||||||||||||||
720 | C:\\Users\\Public\\Libraries\\alpha.pif /C C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\admin\Desktop\Annexure_1_BOQ_and_Supporting_Documents.cmd" "C:\Users\Public\\Libraries\donex.avi" 9 | C:\Users\Public\Libraries\alpha.pif | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
856 | C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o | C:\Windows\SysWOW64\esentutl.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Extensible Storage Engine Utilities for Microsoft(R) Windows(R) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
864 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
1272 | cmd /c exit /b 0 | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
1324 | C:\\Users\\Public\\Libraries\\alpha.pif /c PING -n 4 127.0.0.1 | C:\Users\Public\Libraries\alpha.pif | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
1388 | C:\WINDOWS\system32\cmd.exe /c C:\\ProgramData\\15311.cmd | C:\Windows\SysWOW64\cmd.exe | — | chrome.PIF | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
1812 | PowerShell -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command " @echo off | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (5204) rdha.pif | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
(PID) Process: | (5892) chrome.PIF | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-RHFRKK |
Operation: | write | Name: | exepath |
Value: 61187676E8D1450E21A3EEBE38AD1E282F5658AE33CBDB104FF45BC7CC868992C7406A279B308F42C6A152DD62EE2146EB3062311599F458EED53A2B3CF7421CC6407D823E1AC9036D84 | |||
(PID) Process: | (5892) chrome.PIF | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-RHFRKK |
Operation: | write | Name: | licence |
Value: B8012A48FDBB5186182A5C8EB20DFC5A | |||
(PID) Process: | (5892) chrome.PIF | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-RHFRKK |
Operation: | write | Name: | time |
Value: | |||
(PID) Process: | (5892) chrome.PIF | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-RHFRKK |
Operation: | write | Name: | UID |
Value: | |||
(PID) Process: | (472) rundll32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1812 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sqlwbekh.o0a.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
1812 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pnaccydr.tau.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
1812 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:3422D8902388F4A1409F4B1447001885 | SHA256:8559800558100F78A6FDE97B188E27AE89DD03DCEDB8361261EA91B04639219D | |||
5892 | chrome.PIF | C:\ProgramData\neo.cmd | text | |
MD5:5BAF253744AD26F35BA17DB6B80763E9 | SHA256:9CBB41E6C4F8565A6D121B770FCF3F15A6891C8DF8BFBA6D0414B3AD3298BDBA | |||
5548 | ghf.pif | C:\Users\Public\Libraries\donex.avi | text | |
MD5:0779631D37B08A8FE0F87CD9B7998DAE | SHA256:19F50D05B08C1993FF62E58BB29B07E6543F6853E79E2E862C7BEC2E765DAA76 | |||
5892 | chrome.PIF | C:\ProgramData\15311.cmd | text | |
MD5:9A020804EBA1FFAC2928D7C795144BBF | SHA256:A86C6C7A2BF9E12C45275A5E7EBEBD5E6D2BA302FE0A12600B7C9FDF283D9E63 | |||
5892 | chrome.PIF | C:\Users\admin\Links\Blqlsjlk.PIF | executable | |
MD5:71A4B65DE7AD524F18D9D6598EC8C8BC | SHA256:9EA7C6AC8BB20575CA7A51A8B1F74EEAEAFAC75171015A20B17E1E5AE64CF263 | |||
5892 | chrome.PIF | C:\ProgramData\Blqlsjlk.url | binary | |
MD5:8E1CDF67C210BA6AF8F2873192B66F54 | SHA256:98A037BD9ACEB52DA84952739771F21BDEED5F24F29E08F466D0471499CF277E | |||
5892 | chrome.PIF | C:\ProgramData\236.cmd | text | |
MD5:BAF6D3E2EFD77928B67724F9438BB249 | SHA256:E506618B00E20BFCD4EFC8D8F0AD31C7750CA31EA86A37EE081ACB1031C6C789 | |||
856 | esentutl.exe | C:\Users\Public\alpha.pif | executable | |
MD5:D3348AC2130C7E754754A6E9CB053B09 | SHA256:E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 304 | 4.175.87.197:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
5776 | SIHClient.exe | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5776 | SIHClient.exe | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
5776 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5776 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 52.165.164.15:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | unknown | — | — | — |
5776 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
5776 | SIHClient.exe | GET | 200 | 23.48.23.176:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 4.175.87.197:443 | https://slscr.update.microsoft.com/sls/ping | unknown | — | — | — |
5776 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.159.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5776 | SIHClient.exe | 20.109.210.53:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5776 | SIHClient.exe | 23.48.23.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
mailhost.mysynology.net |
| unknown |
activation-v2.sls.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.mysynology .net Domain |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.dynuddns .net Domain |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
— | — | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |