analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

C:\Users\admin\AppData\Local\Temp\hqbjtglqpu.exe

Full analysis: https://app.any.run/tasks/fddc6037-4fa2-4716-8d7c-3183fb337154
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 21:15:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B43356C546A22F5EE2DAC0640F9E3D9A

SHA1:

CAC25971808C8BB8C7A3AB8FC67BF00884E33543

SHA256:

9AF9466653D00B6D8B7241A57515AE07B33615F21C16CD9E3B699B3592DCFB43

SSDEEP:

98304:Dv2peKINDrCQrx8v/bd9rukoE3VtsFprMNKvTwd/QrLH2yhU:72peKIh+QivJ5uk23rM3d/QPH2yq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3856)
      • RUNDLL32.EXE (PID: 2744)

    • Modifies files in Chrome extension folder

      • RUNDLL32.EXE (PID: 2744)

    • Actions looks like stealing of personal data

      • RUNDLL32.EXE (PID: 2744)

    • Uses Task Scheduler to run other applications

      • RUNDLL32.EXE (PID: 2744)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2704)
      • schtasks.exe (PID: 580)

    • Stealing of credential data

      • RUNDLL32.EXE (PID: 2744)

  • SUSPICIOUS

    • Loads DLL from Mozilla Firefox

      • RUNDLL32.EXE (PID: 2744)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 3856)
      • hqbjtglqpu.exe (PID: 2460)

    • Executable content was dropped or overwritten

      • hqbjtglqpu.exe (PID: 2460)

    • Drops a file with a compile date too recent

      • hqbjtglqpu.exe (PID: 2460)

    • Application launched itself

      • rundll32.exe (PID: 3856)

    • Reads Windows Product ID

      • RUNDLL32.EXE (PID: 2744)

    • Reads the cookies of Google Chrome

      • RUNDLL32.EXE (PID: 2744)

    • Creates files in the user directory

      • powershell.exe (PID: 3924)
      • powershell.exe (PID: 1332)

    • Executes PowerShell scripts

      • RUNDLL32.EXE (PID: 2744)

    • Reads the cookies of Mozilla Firefox

      • RUNDLL32.EXE (PID: 2744)

    • Searches for installed software

      • rundll32.exe (PID: 3856)
      • RUNDLL32.EXE (PID: 2744)

    • Executed as Windows Service

      • taskhost.exe (PID: 2792)

  • INFO

    • Reads CPU info

      • RUNDLL32.EXE (PID: 2744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

FileSubtype: -
ObjectFileType: Static library
FileOS: Unknown (0x40324)
FileFlags: (none)
FileFlagsMask: 0x007f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 1.0.0.1
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x5702
UninitializedDataSize: -
InitializedDataSize: 5704704
CodeSize: 57344
LinkerVersion: 9
PEType: PE32
TimeStamp: 2019:08:06 13:55:41+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 06-Aug-2019 11:55:41
Detected languages:
  • Norwegian - Norway (Nynorsk)

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 06-Aug-2019 11:55:41
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000DFE0
0x0000E000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57155
.data
0x0000F000
0x0054834C
0x003CF400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99661
.tls
0x00558000
0x00015A5D
0x00015C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.fazog
0x0056E000
0x0000015A
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.0203931
.rsrc
0x0056F000
0x0000DB48
0x0000DC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.10048
.reloc
0x0057D000
0x00004D88
0x00004E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
1.47925

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.36787
424
UNKNOWN
UNKNOWN
RT_VERSION
2
5.99005
2216
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
3
6.02361
1736
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
4
6.11564
1384
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
5
5.9923
9640
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
6
6.40112
4264
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
7
6.60871
2440
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
8
6.36907
1128
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
9
5.11819
3752
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON
10
4.82694
2216
UNKNOWN
Norwegian - Norway (Nynorsk)
RT_ICON

Imports

KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hqbjtglqpu.exe rundll32.exe no specs rundll32.exe powershell.exe no specs powershell.exe no specs nslookup.exe schtasks.exe no specs schtasks.exe no specs taskhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2460"C:\Users\admin\AppData\Local\Temp\hqbjtglqpu.exe" C:\Users\admin\AppData\Local\Temp\hqbjtglqpu.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3856C:\Windows\system32\rundll32.exe C:\Users\admin\AppData\Local\Temp\HQBJTG~1.DLL,Z C:\Users\admin\AppData\Local\Temp\HQBJTG~1.EXEC:\Windows\system32\rundll32.exe—hqbjtglqpu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2744C:\Windows\system32\RUNDLL32.EXE C:\Users\admin\AppData\Local\Temp\HQBJTG~1.DLL,GgEZHA==C:\Windows\system32\RUNDLL32.EXE
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3924"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\admin\AppData\Local\Temp\tmp7BE5.tmp.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—RUNDLL32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1332"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\admin\AppData\Local\Temp\tmp8A7D.tmp.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—RUNDLL32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2992"C:\Windows\system32\nslookup.exe" -type=any localhostC:\Windows\system32\nslookup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2704schtasks /End /tn \Microsoft\Windows\Wininet\CacheTaskC:\Windows\system32\schtasks.exe—RUNDLL32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
580schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTaskC:\Windows\system32\schtasks.exe—RUNDLL32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2792"taskhost.exe"C:\Windows\system32\taskhost.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 395
Read events
1 272
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
16
Text files
22
Unknown types
10

Dropped files

PID
Process
Filename
Type
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F718DAE-CB4.pma —
MD5:—
SHA256:—
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\History-journal —
MD5:—
SHA256:—
3924powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KIN36PZQKQXGKO7HZ8GX.temp —
MD5:—
SHA256:—
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Temp\1336859.tmpsqlite
MD5:60B51BA20224AC3783E213EA9F55F125
SHA256:0E305BA02985F26B29B234CD79D2C2AF0A51085DA2DB2BED98D20F8C61B76254
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Temp\Spxkx.tmpabr
MD5:DDB8BF1E910812F4FD3BA8D70807692F
SHA256:6A31138010652BFC63D554E3CC060E56E1514A884701E091A12D8E9D26E849D3
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7919.1028.0.0_0\_metadata\computed_hashes.jsontext
MD5:30D397A16F6D498AE58FB03EA8AF7164
SHA256:46D6D127A597AE424C38A2677781252A223FC4229391D83CDBA31851E65ECD1A
2460hqbjtglqpu.exeC:\Users\admin\AppData\Local\Temp\HQBJTG~1.EXE.dllexecutable
MD5:8AE60D14802FAC0D5D8DDF4AB4E64CFD
SHA256:B5197C3BF67DA872BA9D0B7366367C45790C4D5CC7BE8B8109ACEE8D7F1152D8
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:4AFC066387D33D5264F8E796393B223B
SHA256:BB3E0F925E883318FB09FC498CACEA57F0F71548C9D42FF07634DC30D87F2D86
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Temp\tmp7BE5.tmp.ps1text
MD5:DB3DD6EDA18B4151F9B51AA0BBFF62DD
SHA256:3D3DA64548349017EF4C362BBBD3BFEF67D5D009768EF1DE872FF8D3FBC8AC30
2744RUNDLL32.EXEC:\Users\admin\AppData\Local\Temp\1336906.tmpsqlite
MD5:60B51BA20224AC3783E213EA9F55F125
SHA256:0E305BA02985F26B29B234CD79D2C2AF0A51085DA2DB2BED98D20F8C61B76254
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2744
RUNDLL32.EXE
104.227.34.227:443
—
B2 Net Solutions Inc.
CA
unknown

DNS requests

Domain
IP
Reputation
2.100.168.192.in-addr.arpa
  • —
whitelisted
localhost
  • 127.0.0.1
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
C:\Users\admin\AppData\Local\Temp\hqbjtglqpu.exe