| File name: | bomb.exe |
| Full analysis: | https://app.any.run/tasks/d8840ba5-03ba-42e4-be63-9e5410b5b23f |
| Verdict: | Malicious activity |
| Threats: | A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. |
| Analysis date: | May 30, 2025, 20:31:17 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 0E2AD53C884E25F969B3A575F4BB90BB |
| SHA1: | 81E774FE109DDC9185AD3FB68995A069CE9045E0 |
| SHA256: | 990D1FF1AB883A9BACBBB6ABCF975139D9AB359B74FFBA16F1FA7A66A30E935D |
| SSDEEP: | 192:OJa0tZMoQszhl4AKd+QHzdPbwPz1OLU87glpp/bI6J4YlTtoIw:OLJQjd+qzZ0OLU870NJDoI |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2057:01:07 19:44:57+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 9216 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x43be |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | - |
| FileVersion: | 1.0.0.0 |
| InternalName: | bomb.exe |
| LegalCopyright: | - |
| LegalTrademarks: | - |
| OriginalFileName: | bomb.exe |
| ProductName: | - |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 132 | "C:\Users\admin\HelpPane.exe" | C:\Users\admin\HelpPane.exe | services.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 1 Modules
| |||||||||||||||
| 232 | "C:\Users\admin\Desktop\http104.194.140.36YT-MOxpfrhovopa.exe.exe" | C:\Users\admin\Desktop\http104.194.140.36YT-MOxpfrhovopa.exe.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Oxpfrhovopa Exit code: 4294967295 Version: 1.0.6987.13119 Modules
| |||||||||||||||
| 232 | "c:\program files (x86)\internet explorer\iexplore.exe" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | — | remcos.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 232 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\server.exe" "server.exe" ENABLE | C:\Windows\SysWOW64\netsh.exe | — | server.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Network Command Shell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 240 | C:\Windows\syswow64\MsiExec.exe -Embedding DEE40FC937949F30FAF47FDD8DA0F721 | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 304 | "C:\Users\admin\Desktop\httpgithub.comHerodiwjulusrawrefsheadsmainDiscord.exe.exe" | C:\Users\admin\Desktop\httpgithub.comHerodiwjulusrawrefsheadsmainDiscord.exe.exe | — | bomb.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Quasar Client Version: 1.4.1 Modules
| |||||||||||||||
| 512 | "C:\Users\admin\Desktop\http183.30.204.281AV.scr.exe" | C:\Users\admin\Desktop\http183.30.204.281AV.scr.exe | — | http183.30.204.281AV.scr.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 540 | "C:\Users\admin\Desktop\http104.194.140.36YT-RWxjghzv.exe.exe" | C:\Users\admin\Desktop\http104.194.140.36YT-RWxjghzv.exe.exe | — | bomb.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Wxjghzv Exit code: 1 Version: 1.0.5211.12664 Modules
| |||||||||||||||
| 540 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | HeimdallGuard.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 616 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (1348) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5776 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa5776.40671\Newtonsoft.Json.dll | executable | |
MD5:195FFB7167DB3219B217C4FD439EEDD6 | SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B | binary | |
MD5:988D1EB85065983219EF389F5230F012 | SHA256:214E80CD3519E274C113D9C988080D1FB7A00D43B83C86186AD52CE5034B8469 | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\ARLD18XV.6A4\J5Q0MG4O.C89\ScreenConnect.ClientService.exe | executable | |
MD5:AE94732DDA137A8DC6179F76C9BE4190 | SHA256:B1A2FA8BC1D4BAAE6E4F2599B26229E66829E026908A377E7C711FD32B44ED77 | |||
| 5776 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa5776.40671\HeimdallGuard.exe | executable | |
MD5:72EDFF31DFF1490EAA9D0D8BA02C97C9 | SHA256:7B63E00DF0FDF76552FF27FAAEB8F73FD70CD27758FD49561A74A531A3986D50 | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\ARLD18XV.6A4\J5Q0MG4O.C89\ScreenConnect.WindowsClient.exe.config | xml | |
MD5:728175E20FFBCEB46760BB5E1112F38B | SHA256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077 | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\932a2db58c237abd381d22df4c63a04a_bb926e54-e3ca-40fd-ae90-2764341e7792 | binary | |
MD5:D2DED43CE07BFCE4D1C101DFCAA178C8 | SHA256:8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050 | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\ARLD18XV.6A4\J5Q0MG4O.C89\ScreenConnect.Client.dll | executable | |
MD5:C2E6C1CC43EC4E4699C468357112C621 | SHA256:51BA5DB0406854015BBC30D991EC10DDADF0713856E0681DFDB1CC8E92A06D95 | |||
| 1348 | bomb.exe | C:\Users\admin\Desktop\http209.54.101.170scanwp.exe.exe | executable | |
MD5:0F01FCF9A6A52BF8FED64778FF2D1C13 | SHA256:144246E0E99BB56DFF2C747FD7301D1C691A159819595F35A223B79251B03B30 | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42B | binary | |
MD5:0C072A41169548D6F1D7BAC188908B44 | SHA256:31CCFCA21CFEB7667E59F342B17C7A5FE145359C7463019044011A069893A236 | |||
| 1600 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\ARLD18XV.6A4\J5Q0MG4O.C89\ScreenConnect.WindowsBackstageShell.exe | executable | |
MD5:5259A1B61B61FD188703D6489BD76719 | SHA256:90AF4907175A43B62A037BEC8378DB293576CC033372D1FD673F8513A34CCB9F | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.163:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1348 | bomb.exe | GET | 200 | 77.83.207.69:80 | http://77.83.207.69/inc/SSA-7005-SM-34062529.pdf.exe | unknown | — | — | malicious |
1348 | bomb.exe | GET | — | 209.54.101.170:80 | http://209.54.101.170/scan/wp.exe | unknown | — | — | unknown |
1600 | dfsvc.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAuTYAUbzPZmQpmJmNW6l84%3D | unknown | — | — | whitelisted |
1600 | dfsvc.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | unknown | — | — | whitelisted |
7936 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1348 | bomb.exe | GET | 200 | 77.83.207.69:80 | http://77.83.207.69/inc/JFDGQDUS.exe | unknown | — | — | malicious |
1348 | bomb.exe | GET | 200 | 77.83.207.69:80 | http://77.83.207.69/inc/ClientSetup1.exe | unknown | — | — | malicious |
1348 | bomb.exe | GET | 200 | 77.83.207.69:80 | http://77.83.207.69/inc/cron1mm.exe | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6544 | svchost.exe | 20.190.160.64:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.163:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1348 | bomb.exe | 188.114.96.3:443 | maper.info | CLOUDFLARENET | NL | malicious |
1348 | bomb.exe | 142.250.185.164:443 | www.google.com | GOOGLE | US | whitelisted |
1348 | bomb.exe | 151.101.2.49:443 | urlhaus.abuse.ch | FASTLY | US | whitelisted |
1348 | bomb.exe | 209.54.101.170:80 | — | ASN-QUADRANET-GLOBAL | US | unknown |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
maper.info |
| malicious |
www.google.com |
| whitelisted |
urlhaus.abuse.ch |
| whitelisted |
support.screenconnectsoftware.com |
| unknown |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1348 | bomb.exe | Potential Corporate Privacy Violation | ET INFO IP Logger Redirect Domain in SNI |
1348 | bomb.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS *.pdf.exe in HTTP URL |
1348 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
1348 | bomb.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
1348 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
1348 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
1348 | bomb.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
1348 | bomb.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
1348 | bomb.exe | Misc activity | ET INFO Packed Executable Download |
1348 | bomb.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |