File name: | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe |
Full analysis: | https://app.any.run/tasks/9d4ff1e3-ea5e-4a33-ad9f-5e7457686978 |
Verdict: | Malicious activity |
Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
Analysis date: | January 10, 2025, 21:03:40 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections |
MD5: | 85F60E5FA96C016385008424EB02CB12 |
SHA1: | 63827B2FCC9D8569FD68466DBF2BF8A5731C4D47 |
SHA256: | 9918ED94D2CC5AA6AA09D186914D11922B1DBCDB31F491DE34F3F48118444ECA |
SSDEEP: | 1536:LHekPaeUxqN//aKCdczaDa69l+GtJODZ/CGA//gum/DydnxcrG9t7/dq7adDtjSC:ykPaeGyLCdcz+aTuz/Z7d897KJRiJZKT |
.exe | | | Win32 Executable Microsoft Visual Basic 6 (54.4) |
---|---|---|
.exe | | | UPX compressed Win32 Executable (17.9) |
.exe | | | Win32 EXE Yoda's Crypter (17.6) |
.dll | | | Win32 Dynamic Link Library (generic) (4.3) |
.exe | | | Win32 Executable (generic) (2.9) |
OriginalFileName: | de'cocher.exe |
---|---|
InternalName: | de'cocher |
ProductVersion: | 4.02.0006 |
FileVersion: | 4.02.0006 |
ProductName: | input e'miettant |
LegalTrademarks: | borderon renifler |
LegalCopyright: | attesta médiante caoutcho 2000 |
FileDescription: | engonce'e cesures participes |
CompanyName: | barbatif lectrifierons |
Comments: | Ecorchée composta rocker |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 4.2.0.6 |
FileVersionNumber: | 4.2.0.6 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 4.2 |
OSVersion: | 4 |
EntryPoint: | 0x515f0 |
UninitializedDataSize: | 241664 |
InitializedDataSize: | 4096 |
CodeSize: | 90112 |
LinkerVersion: | 6 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
TimeStamp: | 2012:07:16 19:26:14+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6468 | "C:\Users\admin\Desktop\9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe" | C:\Users\admin\Desktop\9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | — | explorer.exe | |||||||||||
User: admin Company: barbatif lectrifierons Integrity Level: MEDIUM Description: engonce'e cesures participes Exit code: 0 Version: 4.02.0006 Modules
| |||||||||||||||
6804 | "C:\Users\admin\Desktop\9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe" | C:\Users\admin\Desktop\9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | ||||||||||||
User: admin Company: barbatif lectrifierons Integrity Level: MEDIUM Description: engonce'e cesures participes Exit code: 1 Version: 4.02.0006 Modules
| |||||||||||||||
6860 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\GMRDB.bat" " | C:\Windows\SysWOW64\cmd.exe | — | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
6868 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6916 | REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe" /f | C:\Windows\SysWOW64\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6956 | "C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe" | C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe | — | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | |||||||||||
User: admin Company: barbatif lectrifierons Integrity Level: MEDIUM Description: engonce'e cesures participes Exit code: 0 Version: 4.02.0006 Modules
| |||||||||||||||
6996 | "C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe" | C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe | — | csrsll.exe | |||||||||||
User: admin Company: barbatif lectrifierons Integrity Level: MEDIUM Description: engonce'e cesures participes Version: 4.02.0006 Modules
| |||||||||||||||
7004 | "C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe" | C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe | csrsll.exe | ||||||||||||
User: admin Company: barbatif lectrifierons Integrity Level: MEDIUM Description: engonce'e cesures participes Version: 4.02.0006 Modules
| |||||||||||||||
2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (6916) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | Win Pdf |
Value: C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe |
PID | Process | Filename | Type | |
---|---|---|---|---|
6804 | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | C:\Users\admin\AppData\Local\Temp\GMRDB.bat | text | |
MD5:58935583D36D67960D1710955CEC811B | SHA256:4396608B869FF8FC6EAC9F7D81FB73D72B9397EE05AA73487481E57C619500D7 | |||
6804 | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | C:\Users\admin\AppData\Local\Temp\GMRDB.txt | text | |
MD5:58935583D36D67960D1710955CEC811B | SHA256:4396608B869FF8FC6EAC9F7D81FB73D72B9397EE05AA73487481E57C619500D7 | |||
6804 | 9918ed94d2cc5aa6aa09d186914d11922b1dbcdb31f491de34f3f48118444eca.exe | C:\Users\admin\AppData\Roaming\Microsoft\csrsll.exe | executable | |
MD5:EAABB4DF489CF611E8E0EE0803932613 | SHA256:49521D24C3A26576BF2E614FEABBE4383731183645F6B49E953FAECDFE663768 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2040 | svchost.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2040 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3488 | RUXIMICS.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2040 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3488 | RUXIMICS.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.23.227.208:443 | — | Ooredoo Q.S.C. | QA | unknown |
2040 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2040 | svchost.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
3488 | RUXIMICS.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
billabong4102.no-ip.biz |
| unknown |
self.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |