File name:

9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d

Full analysis: https://app.any.run/tasks/9d402a41-17a7-4c29-b0ae-523b46e43928
Verdict: Malicious activity
Analysis date: February 04, 2024, 02:44:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

57C833BFD5042E34BEC23DFD711CD151

SHA1:

6BCD1915173D57D369E209943BE31EEBEBDD535A

SHA256:

9D3C881C29156B8FD82CED7C7726C4C65D4E741533C9F886112F440698B1469D

SSDEEP:

98304:Cmqay4lq6jqJGKBBvPnwk6b/fHZpCkEPGDd42heDrOFSa7OR0D52lCH4YJ9Ei746:1hKqe0Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1652)
      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

  • SUSPICIOUS

    • Application launched itself

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1652)

    • Executable content was dropped or overwritten

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • The process creates files with name similar to system file names

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Connects to FTP

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Connects to SMTP port

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Connects to SSH

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Connects to unusual port

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

  • INFO

    • Reads the computer name

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Reads the machine GUID from the registry

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Checks supported languages

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)
      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1652)

    • Creates files in the program directory

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)

    • Create files in a temporary directory

      • 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe (PID: 1632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:06:04 21:08:19+02:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 1922560
InitializedDataSize: 3833856
UninitializedDataSize: -
EntryPoint: 0x8c4a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 25.0.0.0
ProductVersionNumber: 61.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0373)
CharacterSet: Unknown (63B6)
FileDescriptions: Buttiskarf
InternalName: Bastard.exe
LegalTrademark1: Fascal
OriginalFileName: Lameros.exe
ProductName: Jadocka
ProductVersion: 57.38.26
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe no specs 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe

Process information

PID
CMD
Path
Indicators
Parent process
1632"C:\Users\admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe" C:\Users\admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1652"C:\Users\admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe" C:\Users\admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
1 532
Read events
1 532
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\ProgramData\Drivers\csrss.exeexecutable
MD5:57C833BFD5042E34BEC23DFD711CD151
SHA256:9D3C881C29156B8FD82CED7C7726C4C65D4E741533C9F886112F440698B1469D
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4KPV6A~1\unverified-microdesc-consensus.tmptext
MD5:F7DA8CEF57BE72A16AC4EF1C4A676A68
SHA256:50513148FCA281B937A13B35B218CF7CA3A5AA526E501C9FC1DE7A8EE112A291
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4kPv6aJG8e\cached-certstext
MD5:C9596C5BEF239CE240F945CE2B79BF1B
SHA256:5C3E5404EE46F198E28E879ECE4E298FC0BB8606145D8BF726781C0628748CB4
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4kPv6aJG8e\statetext
MD5:7ECC7347D65A7697CD2A627702A416AC
SHA256:7B99CAEE34C64720F83B21EF9C6F77BF49FF3569DAF0C3855F56E70A7A1C63C0
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4KPV6A~1\state.tmptext
MD5:7ECC7347D65A7697CD2A627702A416AC
SHA256:7B99CAEE34C64720F83B21EF9C6F77BF49FF3569DAF0C3855F56E70A7A1C63C0
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4KPV6A~1\cached-certs.tmptext
MD5:C9596C5BEF239CE240F945CE2B79BF1B
SHA256:5C3E5404EE46F198E28E879ECE4E298FC0BB8606145D8BF726781C0628748CB4
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4kPv6aJG8e\cached-microdesc-consensustext
MD5:F7DA8CEF57BE72A16AC4EF1C4A676A68
SHA256:50513148FCA281B937A13B35B218CF7CA3A5AA526E501C9FC1DE7A8EE112A291
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4kPv6aJG8e\unverified-microdesc-consensustext
MD5:F7DA8CEF57BE72A16AC4EF1C4A676A68
SHA256:50513148FCA281B937A13B35B218CF7CA3A5AA526E501C9FC1DE7A8EE112A291
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newtext
MD5:4ABCA1EF98BC9BBF77ACC3F89ADE8D55
SHA256:17EB9EAD5B6AA1CA14A2C5E8EA3DD3B35D8C1C9FB8892973D712A8B06D1CF3BA
16329d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exeC:\Users\admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmptext
MD5:F7DA8CEF57BE72A16AC4EF1C4A676A68
SHA256:50513148FCA281B937A13B35B218CF7CA3A5AA526E501C9FC1DE7A8EE112A291
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
673
TCP/UDP connections
11 464
DNS requests
1 724
Threats
252

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
—
108.138.36.68:80
http://app.myloft.xyz/phpmyadmin/
unknown
—
—
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
301
34.149.46.130:80
http://accounts.snapchat.com/phpMyAdmin/
unknown
—
—
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
403
104.26.11.247:80
http://onlinepublishing.studentreasures.com/admin
unknown
html
1.70 Kb
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
200
199.59.243.225:80
http://t3s.live/PhpMyAdmin/
unknown
html
1.02 Kb
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
—
35.214.148.111:80
http://inqueritosremunerados.pt/admin/
unknown
—
—
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
301
179.191.182.65:80
http://sacola.magazineluiza.com.br/PhpMyAdmin/
unknown
html
162 b
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
301
199.36.158.100:80
http://instafrac-prod.firebaseapp.com/administrator/index.php
unknown
—
—
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
403
104.16.120.50:80
http://auth.riotgames.com/pma/
unknown
html
1.70 Kb
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
301
34.149.46.130:80
http://accounts.snapchat.com/wp-login.php
unknown
—
—
—
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
GET
301
104.21.34.65:80
http://perfectaim.io/wp-login.php
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
185.233.252.14:9001
—
Kviknet.dk ApS
DK
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
37.139.22.180:9001
—
DIGITALOCEAN-ASN
NL
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
51.195.124.251:9001
—
OVH SAS
FR
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
54.37.138.104:443
—
OVH SAS
FR
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
212.47.227.71:9001
—
Online S.a.s.
FR
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
185.220.101.198:10198
—
Zwiebelfreunde e.V.
DE
unknown
1632
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
171.25.193.9:80
—
Foreningen for digitala fri- och rattigheter
SE
unknown

DNS requests

Domain
IP
Reputation
mobile.realitykings.com
  • 66.254.114.234
unknown
inqueritosremunerados.pt
  • 35.214.148.111
unknown
enlisted.net
  • 172.67.14.1
  • 104.22.42.210
  • 104.22.43.210
unknown
app.myloft.xyz
  • 108.138.36.68
  • 108.138.36.43
  • 108.138.36.23
  • 108.138.36.39
unknown
account.xiaomi.com
  • 20.47.97.75
unknown
oficinavirtual.cvsa.com.ar
  • 181.209.30.141
unknown
business.sandiego.gov
  • —
unknown
sso.acesso.gov.br
  • 189.9.113.9
unknown
candidato.computrabajo.com.mx
  • 54.163.233.108
  • 52.7.27.34
unknown
ebs.ca-egypt.com
  • 196.13.253.13
unknown

Threats

PID
Process
Class
Message
—
—
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 274
—
—
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 234
—
—
Misc activity
ET POLICY TLS possible TOR SSL traffic
—
—
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 192
—
—
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 676
—
—
Misc activity
ET POLICY TLS possible TOR SSL traffic
—
—
Misc activity
ET POLICY TLS possible TOR SSL traffic
—
—
Misc activity
ET POLICY TLS possible TOR SSL traffic
—
—
Misc activity
ET POLICY TLS possible TOR SSL traffic
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query For XXX Adult Site Top Level Domain
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d