File name:

SharkHack.exe

Full analysis: https://app.any.run/tasks/02d382bc-b5d9-4eb9-894a-71b5b5970b22
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: October 23, 2024, 20:53:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
botnet
rat
stealer
diablonet
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

ADDC37EF44B74205A75EDF882B91F87A

SHA1:

5818795D54863B85050CAD0A4F978FF266BA8A04

SHA256:

94D7EA2F2E449BBAA4DB94F4E2857C36F28F1FC970A3CA67035243C17E53A803

SSDEEP:

98304:OqRXLgfIXx2dNXlDGg6UW4FJfH4f9kxoX5A1bktWHlJvUfyFkjIIKg5N7IyjIa+R:sJs0p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DIABLONET has been detected (YARA)

      • javaw.exe (PID: 1372)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7776)

    • DIABLONET has been detected (SURICATA)

      • javaw.exe (PID: 1372)
      • javaw.exe (PID: 6660)
      • javaw.exe (PID: 540)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • SharkHack.exe (PID: 5592)

    • Executable content was dropped or overwritten

      • SharkHack.exe (PID: 5592)

    • Reads security settings of Internet Explorer

      • SharkHack.exe (PID: 5592)

    • Checks for Java to be installed

      • explorer.exe (PID: 4316)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 7564)
      • javaw.exe (PID: 1372)
      • javaw.exe (PID: 6660)
      • javaw.exe (PID: 540)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7696)

    • The process executes via Task Scheduler

      • javaw.exe (PID: 7184)
      • javaw.exe (PID: 6660)
      • javaw.exe (PID: 540)

    • Connects to unusual port

      • javaw.exe (PID: 1372)
      • javaw.exe (PID: 6660)
      • javaw.exe (PID: 540)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 6664)
      • cmd.exe (PID: 7908)
      • cmd.exe (PID: 7432)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 4676)
      • cmd.exe (PID: 7396)
      • cmd.exe (PID: 5048)

    • Contacting a server suspected of hosting an CnC

      • javaw.exe (PID: 6660)
      • javaw.exe (PID: 1372)
      • javaw.exe (PID: 540)

  • INFO

    • Checks supported languages

      • SharkHack.exe (PID: 5592)
      • explorer.exe (PID: 4316)
      • javaw.exe (PID: 5444)

    • Reads the computer name

      • SharkHack.exe (PID: 5592)

    • Process checks computer location settings

      • SharkHack.exe (PID: 5592)

    • Create files in a temporary directory

      • javaw.exe (PID: 5444)
      • SharkHack.exe (PID: 5592)

    • Creates files in the program directory

      • javaw.exe (PID: 5444)

    • The process uses the downloaded file

      • SharkHack.exe (PID: 5592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (26.2)
.exe | Win32 Executable MS Visual C++ (generic) (11.1)
.exe | Win64 Executable (generic) (9.9)
.scr | Windows screen saver (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:22 18:12:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 4058112
InitializedDataSize: 74240
UninitializedDataSize: -
EntryPoint: 0x3e0bae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: payload.exe
LegalCopyright:
OriginalFileName: payload.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
38
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start sharkhack.exe svchost.exe no specs explorer.exe no specs explorer.exe javaw.exe icacls.exe no specs conhost.exe no specs java.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs openwith.exe no specs #DIABLONET javaw.exe javaw.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs #DIABLONET javaw.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs #DIABLONET javaw.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar" C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
svchost.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1372"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar" C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
OpenWith.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3912wmic cpu get nameC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
4316"C:\Users\admin\AppData\Local\Temp\explorer.exe" C:\Users\admin\AppData\Local\Temp\explorer.exe
SharkHack.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4676cmd /c wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4816"C:\Users\admin\AppData\Local\Temp\explorer.exe" C:\Users\admin\AppData\Local\Temp\explorer.exe—SharkHack.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5048cmd /c wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5444"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\explorer.exe"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
6 968
Read events
6 963
Write events
5
Delete events
0

Modification events

(PID) Process:(7564) java.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jar\OpenWithProgids
Operation:writeName:jarfile
Value:
(PID) Process:(7928) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jar\OpenWithProgids
Operation:writeName:jarfile
Value:
Executable files
5
Suspicious files
18
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7928OpenWith.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete\icn4F0F.tmp —
MD5:—
SHA256:—
5592SharkHack.exeC:\Users\admin\AppData\Local\Temp\explorer.execompressed
MD5:9F814191469118CBA72A4C231C5C0728
SHA256:1333B60672AEEC8F53D3DFB4068593BDCCB42F80D549FB4253CD0E5E21B5CCEC
5444javaw.exeC:\Users\admin\AppData\Local\Temp\tmp6777485167403702933.txttext
MD5:F416CE743D070D6AFFDFED9463F1087E
SHA256:400CD5073FCD4C55E56B89BDB673AF4DDE0FEA27E12D5976F5D719AA9BEFE63F
5592SharkHack.exeC:\Users\admin\AppData\Local\Temp\svchost.exeexecutable
MD5:C5007A4BE4FF3AD83C3EF0A2DA757F37
SHA256:A5D53A3ABF21210DC69833F3C11C09CCE0802024E1B175FF98EBBD03FD5AF308
5444javaw.exeC:\Users\admin\download_libra.jarjava
MD5:37DD0337D105B41CB9BC7B2518D45EBC
SHA256:66985BF683BD9253C9C3CC2A35D75A8FB7948497D8F3939BAB992D83A2BEE385
7928OpenWith.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete\icn4EFE.tmpbinary
MD5:043862A46B02939411CC2F37833824C6
SHA256:FED63921A42386CF72851C82CB7A0DB1B644071BEFA621089634ABBA1AA36997
7564java.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\cache.jarjava
MD5:B9F086E989001AB50DCEC4897A06CA2D
SHA256:9424432D426DAF7BC9D8EA155638D247FF4D23E9C80D1B683E60AF52E0EB1EE7
5444javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\83aa4cc77f591dfc2374580bbd95f6ba_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
5444javaw.exeC:\Users\admin\AppData\Local\Temp\tmp5404268695139083643.jarjava
MD5:B9F086E989001AB50DCEC4897A06CA2D
SHA256:9424432D426DAF7BC9D8EA155638D247FF4D23E9C80D1B683E60AF52E0EB1EE7
7928OpenWith.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.dbbinary
MD5:AE6FBDED57F9F7D048B95468DDEE47CA
SHA256:D3C9D1FF7B54B653C6A1125CAC49F52070338A2DD271817BBA8853E99C0F33A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
59
DNS requests
19
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7424
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6660
javaw.exe
GET
200
185.114.73.121:8080
http://185.114.73.121:8080/initPySystem
unknown
—
—
unknown
5232
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7424
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1372
javaw.exe
GET
200
185.114.73.121:8080
http://185.114.73.121:8080/initPySystem
unknown
—
—
unknown
540
javaw.exe
GET
200
185.114.73.121:8080
http://185.114.73.121:8080/initPySystem
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1764
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4360
SearchApp.exe
92.123.104.11:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5232
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.bing.com
  • 92.123.104.11
  • 92.123.104.26
  • 92.123.104.25
  • 92.123.104.16
  • 92.123.104.18
  • 92.123.104.17
  • 92.123.104.13
  • 92.123.104.12
  • 92.123.104.6
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
s3.timeweb.cloud
  • 217.78.234.243
  • 217.78.234.244
unknown
th.bing.com
  • 92.123.104.54
  • 92.123.104.6
  • 92.123.104.7
  • 92.123.104.67
  • 92.123.104.62
  • 92.123.104.52
  • 92.123.104.63
  • 92.123.104.4
  • 92.123.104.58
whitelisted

Threats

PID
Process
Class
Message
1372
javaw.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] DiabloNet Initial Client Packet (TCP)
6660
javaw.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] DiabloNet Initial Client Packet (TCP)
540
javaw.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] DiabloNet Initial Client Packet (TCP)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SharkHack.exe