File name:

Seliware.exe

Full analysis: https://app.any.run/tasks/f854d323-62c6-4cbe-b878-87befc0cea76
Verdict: Malicious activity
Analysis date: January 30, 2025, 07:00:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

2790AF19BEA9B6602D4D1B23C88B0463

SHA1:

77EF3E0A96F1DF2373B3B71363A596666508782F

SHA256:

7F833702251B3DC148C41FA505B7464183B5451DBFBB736405170A5DAEDA6045

SSDEEP:

49152:0MECrOQhbmLlYYyIlAmLlYYyIlveUw11lfcAA7b+3wUPcfXOKbkjy7gK3HpjexWS:0MRrqLlaUBLlaUveUu3wHnmeRyyrXpS5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Seliware.exe (PID: 6248)
      • WinRAR.exe (PID: 4556)
      • Seliware.exe (PID: 2072)

    • Executable content was dropped or overwritten

      • Seliware.exe (PID: 6248)
      • Seliware.exe (PID: 2072)

    • Reads the date of Windows installation

      • Seliware.exe (PID: 6248)
      • Seliware.exe (PID: 2072)

    • Reads security settings of Internet Explorer

      • Seliware.exe (PID: 6248)
      • x64dbg.exe (PID: 848)
      • Seliware.exe (PID: 2072)

    • Checks Windows Trust Settings

      • x64dbg.exe (PID: 848)

    • There is functionality for taking screenshot (YARA)

      • x64dbg.exe (PID: 848)

  • INFO

    • Reads the computer name

      • Seliware.exe (PID: 6248)
      • SeliwareLoaderRewrite.exe (PID: 6572)
      • x64dbg.exe (PID: 848)
      • Seliware.exe (PID: 2072)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Checks supported languages

      • Seliware.exe (PID: 6248)
      • SeliwareLoaderRewrite.exe (PID: 6572)
      • x64dbg.exe (PID: 848)
      • Seliware.exe (PID: 2072)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Create files in a temporary directory

      • Seliware.exe (PID: 6248)
      • Seliware.exe (PID: 2072)

    • Process checks computer location settings

      • Seliware.exe (PID: 6248)
      • Seliware.exe (PID: 2072)

    • Reads the machine GUID from the registry

      • SeliwareLoaderRewrite.exe (PID: 6572)
      • x64dbg.exe (PID: 848)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Reads Environment values

      • SeliwareLoaderRewrite.exe (PID: 6572)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Disables trace logs

      • SeliwareLoaderRewrite.exe (PID: 6572)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Checks proxy server information

      • SeliwareLoaderRewrite.exe (PID: 6572)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Reads the software policy settings

      • SeliwareLoaderRewrite.exe (PID: 6572)
      • x64dbg.exe (PID: 848)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • .NET Reactor protector has been detected

      • SeliwareLoaderRewrite.exe (PID: 6572)
      • SeliwareLoaderRewrite.exe (PID: 648)

    • Manual execution by a user

      • WinRAR.exe (PID: 4556)
      • x64dbg.exe (PID: 848)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4556)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:12 10:17:15+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 236032
InitializedDataSize: 482304
UninitializedDataSize: -
EntryPoint: 0x266b0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start seliware.exe seliwareloaderrewrite.exe no specs seliwareloaderrewrite.exe winrar.exe rundll32.exe no specs x64dbg.exe no specs seliware.exe seliwareloaderrewrite.exe no specs seliwareloaderrewrite.exe

Process information

PID
CMD
Path
Indicators
Parent process
648"C:\Users\admin\AppData\Local\Temp\RarSFX1\SeliwareLoaderRewrite.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\SeliwareLoaderRewrite.exe
Seliware.exe
User:
admin
Integrity Level:
HIGH
Description:
SeliwareLoaderRewrite
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\seliwareloaderrewrite.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
848"C:\Users\admin\Desktop\snapshot_2025-01-17_12-45\release\x64\x64dbg.exe" C:\Users\admin\Desktop\snapshot_2025-01-17_12-45\release\x64\x64dbg.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
x64dbg
Version:
0.0.2.5
Modules
Images
c:\users\admin\desktop\snapshot_2025-01-17_12-45\release\x64\x64dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
2072"C:\Users\admin\Desktop\Seliware.exe"C:\Users\admin\Desktop\Seliware.exe
x64dbg.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\seliware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4244C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4556"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\snapshot_2025-01-17_12-45.zip" "?\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6164"C:\Users\admin\AppData\Local\Temp\RarSFX1\SeliwareLoaderRewrite.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\SeliwareLoaderRewrite.exe—Seliware.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SeliwareLoaderRewrite
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\seliwareloaderrewrite.exe
c:\windows\system32\ntdll.dll
6248"C:\Users\admin\AppData\Local\Temp\Seliware.exe" C:\Users\admin\AppData\Local\Temp\Seliware.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\seliware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6416"C:\Users\admin\AppData\Local\Temp\RarSFX0\SeliwareLoaderRewrite.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\SeliwareLoaderRewrite.exe—Seliware.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SeliwareLoaderRewrite
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\seliwareloaderrewrite.exe
c:\windows\system32\ntdll.dll
6572"C:\Users\admin\AppData\Local\Temp\RarSFX0\SeliwareLoaderRewrite.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\SeliwareLoaderRewrite.exe
Seliware.exe
User:
admin
Integrity Level:
HIGH
Description:
SeliwareLoaderRewrite
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\seliwareloaderrewrite.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
21 709
Read events
20 905
Write events
756
Delete events
48

Modification events

(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6572) SeliwareLoaderRewrite.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeliwareLoaderRewrite_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
103
Suspicious files
69
Text files
85
Unknown types
0

Dropped files

PID
Process
Filename
Type
6248Seliware.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\System.Runtime.CompilerServices.Unsafe.dllexecutable
MD5:DA04A75DDC22118ED24E0B53E474805A
SHA256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
6248Seliware.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\SeliwareLoaderRewrite.exeexecutable
MD5:C08AE983171F995E60FD8C89CCB3A7E1
SHA256:D2911F61A56D4F9CF97D5F4D76E7AD03032E63BD38553EEFBC2A4B026B201B04
6248Seliware.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\System.Threading.Tasks.Extensions.dllexecutable
MD5:0F384AFCF671483188B9019D3B7457A7
SHA256:2C9CAD6410E37E44FA73CCCB576F418184F1AE5A0A257E165A136BDAA941A0C6
6248Seliware.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\System.Numerics.Vectors.dllexecutable
MD5:AAA2CBF14E06E9D3586D8A4ED455DB33
SHA256:1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
4556WinRAR.exeC:\Users\admin\Desktop\snapshot_2025-01-17_12-45\pluginsdk\bridgelist.htext
MD5:76B286ABCE8611B5D03721CA4FB893DF
SHA256:6D8BC206E406FC6981A1D7D92E1BB5EA6E2DF09A3F060A42330093745DEA4571
4556WinRAR.exeC:\Users\admin\Desktop\snapshot_2025-01-17_12-45\pluginsdk\bridgegraph.htext
MD5:95E63959AE4DC547059310D0907C167B
SHA256:1366A84F21DCBCACDF3E767E889E1F875F03713F4374CDE7D8CFE6C25DA10A69
4556WinRAR.exeC:\Users\admin\Desktop\snapshot_2025-01-17_12-45\commithash.txttext
MD5:43EF77C2E9B15A9BC2386C5ECCAEE73E
SHA256:63F22567DCCC2AA1EEAE43C9DCD1B3180B7BDD2F31161E114BF683AC68D0D977
4556WinRAR.exeC:\Users\admin\Desktop\snapshot_2025-01-17_12-45\pluginsdk\dbghelp\dbghelp.htext
MD5:0B507925699ECCED4ADA1EF8061D7DB7
SHA256:4E556135CC506E2A30D78C24FD2934A832A7C663F6D2BA5A76F16DA9E86E0B85
6248Seliware.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\System.Buffers.dllexecutable
MD5:ECDFE8EDE869D2CCC6BF99981EA96400
SHA256:ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
4556WinRAR.exeC:\Users\admin\Desktop\snapshot_2025-01-17_12-45\pluginsdk\dbghelp\dbghelp_x64.abinary
MD5:9160B8815D608B3F516FF17969B34EED
SHA256:6ADCE5F9FB3F63BF4398F308F9B256B0DEF1B5805DDA8121C849A3C41DD8F542
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
36
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6352
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
104.126.37.170:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1596
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6572
SeliwareLoaderRewrite.exe
188.114.97.3:443
seliware.com
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.171
  • 104.126.37.176
  • 104.126.37.178
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.179
  • 104.126.37.177
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
seliware.com
  • 188.114.97.3
  • 188.114.96.3
unknown
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.2
  • 40.126.31.3
  • 40.126.31.69
  • 20.190.159.130
  • 20.190.159.23
  • 40.126.31.128
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 51.124.78.146
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Seliware.exe