File name:

cbsidlm-tr1_5-ImgBurn-10847481.exe

Full analysis: https://app.any.run/tasks/d2cfce4d-41f3-4190-9478-2dde2b45b089
Verdict: Malicious activity
Analysis date: February 03, 2024, 00:30:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

795CE399B0FF5850EC39B6ED73B68282

SHA1:

76A33F18410CD93DC994975222AA0AC5606AF1DC

SHA256:

A8E30CEAEB1AE11C989C952E9DABDF19F4EA384FB7F7F1D9FD36D2A6312AE76F

SSDEEP:

24576:/cn6f0IBaGp7Zo7EBV8/eCwnonoriwn5ufRlFn5e10sDvkn4n:/q6f0IBaGp7Zo7EBK2Cwn4oriwn5ufRY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

    • Executable content was dropped or overwritten

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

  • INFO

    • Reads the computer name

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

    • Checks supported languages

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

    • Create files in a temporary directory

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)

    • Process checks whether UAC notifications are on

      • cbsidlm-tr1_5-ImgBurn-10847481.exe (PID: 2088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:06:22 20:07:51+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 23552
InitializedDataSize: 123392
UninitializedDataSize: 1024
EntryPoint: 0x333b
OSVersion: 5.1
ImageVersion: 6
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.8.0.1
ProductVersionNumber: 2.8.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
Combuilddate: 8/3/2012
Combuilddir: C:\BM\2.5\WebTemplates
Combuildid: ffe9d8b1fe820ebe1ba85c8f3d7d08aa0316e94e refs/heads/master
Combuildmachine: FRANCO-PC
Combuildtime: 12:23:04 PM
Combuilduser: $%USER%
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cbsidlm-tr1_5-imgburn-10847481.exe cbsidlm-tr1_5-imgburn-10847481.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
752"C:\Users\admin\AppData\Local\Temp\cbsidlm-tr1_5-ImgBurn-10847481.exe" C:\Users\admin\AppData\Local\Temp\cbsidlm-tr1_5-ImgBurn-10847481.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\cbsidlm-tr1_5-imgburn-10847481.exe
c:\windows\system32\ntdll.dll
2088"C:\Users\admin\AppData\Local\Temp\cbsidlm-tr1_5-ImgBurn-10847481.exe" C:\Users\admin\AppData\Local\Temp\cbsidlm-tr1_5-ImgBurn-10847481.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\cbsidlm-tr1_5-imgburn-10847481.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
874
Read events
862
Write events
12
Delete events
0

Modification events

(PID) Process:(2088) cbsidlm-tr1_5-ImgBurn-10847481.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsk380E.tmp\download.com\
Executable files
10
Suspicious files
5
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\System.dllexecutable
MD5:7E3C808299AA2C405DFFA864471DDB7F
SHA256:91C47A9A54A3A8C359E89A8B4E133E6B7296586748ED3E8F4FE566ABD6C81DDD
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\definitions.luatext
MD5:840FD3D93DB939B1E4B504D8FE587ED1
SHA256:E2D0E6BCD2D6CB69A6D9E84D80F9CB182FB0B6DB5592D8B304AD6EB98590C35C
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\LuaXml_lib.dllexecutable
MD5:7292B642BD958AEB7FD7CFD19E45B068
SHA256:90F1BB98E034FCF7BFDDB8CB0A85B27A9C9DDB01B926B4E139E1E8FC53D41D09
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\LuaBridge.dllexecutable
MD5:9D05719B084770DC9DB32664D7C721DF
SHA256:F80704C617AA9B65F390B93A52EB309E0F13A3B34B855617AAD4F3126E6FE7A9
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\utils.luatext
MD5:1A08E6701868D895A482039DE5F19872
SHA256:5EE55478E71A8D5E4697EC52495FB9E1BEA104E30D783475B876A04E10781657
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\LuaSocket\lua\socket\http.luatext
MD5:61A2A779DA46E835338F1AD1EFAD1717
SHA256:68FD4BC835DA98DD1D5509333F8CC8861133C9439D3DE879BF29A96DE462940A
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\LuaSocket\lua\ltn12.luatext
MD5:E440044AFE6C761507A996B5B45AB0F9
SHA256:B1864AED85C114354B04FBE9B3F41C5EBC4DF6D129E08EF65A0C413D0DAABD29
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\LuaSocket\lua\socket.luatext
MD5:74DBE1060E91112E1C21EF9870B4A587
SHA256:15FD138A169CAE80FECF4C797B33A257D587ED446F02ECF3EF913E307A22F96D
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\lua51.dllexecutable
MD5:13C3A33C1F6E43F38DE533FD0B766C98
SHA256:4158063B0A868431F6430F54C1192BF20E58A43A6D3D03B740E090951E2F4427
2088cbsidlm-tr1_5-ImgBurn-10847481.exeC:\Users\admin\AppData\Local\Temp\nsk380E.tmp\LuaSocket\socket\core.dllexecutable
MD5:4BF7DB111ACFA7C28AD36606107B3322
SHA256:BFE8445C38EE71240E856F85D79E94123D7179BF43688DE0E2A14E32E6EF21B0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2088
cbsidlm-tr1_5-ImgBurn-10847481.exe
GET
404
23.23.235.104:80
http://23.23.235.104:80/install?filename=cbsidlm%2dtr1_5%2dImgBurn%2d10847481%2eexe
unknown
html
976 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2088
cbsidlm-tr1_5-ImgBurn-10847481.exe
23.23.235.104:80
download.webinstall.com
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
download.webinstall.com
  • 23.23.235.104
  • 18.233.221.25
malicious

Threats

PID
Process
Class
Message
2088
cbsidlm-tr1_5-ImgBurn-10847481.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cbsidlm-tr1_5-ImgBurn-10847481.exe