File name:

file

Full analysis: https://app.any.run/tasks/cfca8f91-3238-4d81-9514-20d8b61ae3e7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 05, 2024, 11:58:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
stealc
loader
raccoonclipper
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A79FA370FDEECBB187F96558A76534B5

SHA1:

5EF78B7D2C21882CEC551528C697F12ABB1F8B23

SHA256:

8ED135AFF12B760792F13BE121120DCBEDAD95C2F927289BCB8AE73BC338BDA1

SSDEEP:

98304:E99tOCcOCOsZoZ0vnbLAG4z6m3xmXXU2Uv+lsH6e0+YWNEpPkCfdMm6ch306kNhj:4B46cuME

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • STEALC has been detected (SURICATA)

      • file.exe (PID: 5128)

    • Connects to the CnC server

      • file.exe (PID: 5128)

    • Stealers network behavior

      • file.exe (PID: 5128)

    • STEALC has been detected (YARA)

      • file.exe (PID: 5128)

    • Steals credentials from Web Browsers

      • file.exe (PID: 5128)

    • Uses Task Scheduler to run other applications

      • KJEHJKJEBG.exe (PID: 1184)
      • oobeldr.exe (PID: 6912)

    • RACCOONCLIPPER has been detected (YARA)

      • oobeldr.exe (PID: 6912)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • file.exe (PID: 5128)

    • Searches for installed software

      • file.exe (PID: 5128)

    • Potential Corporate Privacy Violation

      • file.exe (PID: 5128)

    • Contacting a server suspected of hosting an CnC

      • file.exe (PID: 5128)

    • The process drops Mozilla's DLL files

      • file.exe (PID: 5128)

    • Connects to the server without a host name

      • file.exe (PID: 5128)

    • Executable content was dropped or overwritten

      • file.exe (PID: 5128)
      • KJEHJKJEBG.exe (PID: 1184)

    • Checks Windows Trust Settings

      • file.exe (PID: 5128)

    • The process drops C-runtime libraries

      • file.exe (PID: 5128)

    • Process requests binary or script from the Internet

      • file.exe (PID: 5128)

    • Process drops legitimate windows executable

      • file.exe (PID: 5128)

    • Starts CMD.EXE for commands execution

      • file.exe (PID: 5128)

    • The process executes via Task Scheduler

      • oobeldr.exe (PID: 6912)

    • Windows Defender mutex has been found

      • file.exe (PID: 5128)

  • INFO

    • Reads the computer name

      • file.exe (PID: 5128)

    • Checks supported languages

      • file.exe (PID: 5128)
      • KJEHJKJEBG.exe (PID: 1184)
      • oobeldr.exe (PID: 6912)

    • Creates files or folders in the user directory

      • file.exe (PID: 5128)
      • KJEHJKJEBG.exe (PID: 1184)

    • Reads Environment values

      • file.exe (PID: 5128)

    • Reads product name

      • file.exe (PID: 5128)

    • Creates files in the program directory

      • file.exe (PID: 5128)

    • Reads the machine GUID from the registry

      • file.exe (PID: 5128)

    • Process checks computer location settings

      • file.exe (PID: 5128)

    • The process uses the downloaded file

      • file.exe (PID: 5128)

    • Reads the software policy settings

      • file.exe (PID: 5128)

    • Checks proxy server information

      • file.exe (PID: 5128)

    • Reads CPU info

      • file.exe (PID: 5128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:03 17:53:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 116736
InitializedDataSize: 2245120
UninitializedDataSize: -
EntryPoint: 0x5856f1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #STEALC file.exe cmd.exe no specs conhost.exe no specs kjehjkjebg.exe schtasks.exe no specs conhost.exe no specs #RACCOONCLIPPER oobeldr.exe no specs schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
936/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\SysWOW64\schtasks.exe—oobeldr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1184"C:\ProgramData\KJEHJKJEBG.exe" C:\ProgramData\KJEHJKJEBG.exe
cmd.exe
User:
admin
Company:
Nullsoft, Inc.
Integrity Level:
MEDIUM
Description:
winamp
Exit code:
4294967295
Version:
5.6.9.2
Modules
Images
c:\programdata\kjehjkjebg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5128"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6312\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6644/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\SysWOW64\schtasks.exe—KJEHJKJEBG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6912"C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
svchost.exe
User:
admin
Company:
Nullsoft, Inc.
Integrity Level:
MEDIUM
Description:
winamp
Version:
5.6.9.2
Modules
Images
c:\users\admin\appdata\roaming\microsoft\protect\oobeldr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6948"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\KJEHJKJEBG.exe"C:\Windows\SysWOW64\cmd.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
939
Read events
936
Write events
3
Delete events
0

Modification events

(PID) Process:(5128) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5128) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5128) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
15
Suspicious files
13
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
5128file.exeC:\ProgramData\CGDGCFBAEGDHJKEBGCBAEHCAEHsqlite
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5128file.exeC:\ProgramData\freebl3.dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
5128file.exeC:\ProgramData\GDGHIDBKJEGIECBGIEHCGIDBAA —
MD5:—
SHA256:—
5128file.exeC:\ProgramData\msvcp140.dllexecutable
MD5:5FF1FCA37C466D6723EC67BE93B51442
SHA256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
5128file.exeC:\ProgramData\EGDAEBGIDBGHIECBGHJDsqlite
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
5128file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\mozglue[1].dllexecutable
MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
5128file.exeC:\ProgramData\JKEHIIJJECFHJKECFHDGsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5128file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\freebl3[1].dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
5128file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\nss3[1].dllexecutable
MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
SHA256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
5128file.exeC:\ProgramData\AKFCFBAAsqlite
MD5:95FFD778940E6DF4846B0B12C8DD5821
SHA256:21A2DEBD389DB456465DFEFFDB15F0AF3FBC46F007CBA67513A13EB10D14E94F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
29
DNS requests
16
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5128
file.exe
GET
200
45.152.113.10:80
http://45.152.113.10/
unknown
—
—
unknown
5128
file.exe
POST
200
45.152.113.10:80
http://45.152.113.10/92335b4816f77e90.php
unknown
—
—
unknown
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5128
file.exe
POST
200
45.152.113.10:80
http://45.152.113.10/92335b4816f77e90.php
unknown
—
—
unknown
5128
file.exe
POST
200
45.152.113.10:80
http://45.152.113.10/92335b4816f77e90.php
unknown
—
—
unknown
5128
file.exe
GET
200
45.152.113.10:80
http://45.152.113.10/15a25e53742510fe/sqlite3.dll
unknown
—
—
unknown
5128
file.exe
POST
200
45.152.113.10:80
http://45.152.113.10/92335b4816f77e90.php
unknown
—
—
unknown
5128
file.exe
POST
200
45.152.113.10:80
http://45.152.113.10/92335b4816f77e90.php
unknown
—
—
unknown
5128
file.exe
GET
200
45.152.113.10:80
http://45.152.113.10/15a25e53742510fe/mozglue.dll
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2400
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5128
file.exe
45.152.113.10:80
—
FDCSERVERS
JP
malicious
1492
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1492
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.32.185.131
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.0
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
evokeedgellc.com
  • 198.54.120.231
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

PID
Process
Class
Message
5128
file.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc HTTP POST Request
5128
file.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting browsers Config from C2
5128
file.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
5128
file.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity
5128
file.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
5128
file.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting plugins Config from C2
5128
file.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Submitting System Information to C2
5128
file.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5128
file.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5128
file.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2 ETPRO signatures available at the full report
No debug info