File name:

b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe

Full analysis: https://app.any.run/tasks/ce77dae6-9c5a-4551-a9a9-4d8bab5744c1
Verdict: Malicious activity
Analysis date: January 10, 2025, 22:54:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
MD5:

B89C4DEA38B4191A1D7ECA9ECBBD34F7

SHA1:

A39EFA1A4D2D4B9746A180573A4F8B436A849515

SHA256:

B29AE96EA57CE81F1AB2BBC351BF1CA1ED4600EF3A2BCC183D07DDDBD3BA2AC3

SSDEEP:

1536:EhPpyASvVVVVVVVVWs5ZEDgWsgW1JqOpc7Fc7n:cpDSvVVVVVVVVIgWsgW1JqOh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • The process creates files with name similar to system file names

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Executable content was dropped or overwritten

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

  • INFO

    • UPX packer has been detected

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Checks supported languages

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Creates files or folders in the user directory

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:03:15 04:06:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 8192
InitializedDataSize: 4096
UninitializedDataSize: 24576
EntryPoint: 0x2130
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe

Process information

PID
CMD
Path
Indicators
Parent process
6384"C:\Users\admin\Desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe" C:\Users\admin\Desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
11
Read events
11
Write events
0
Delete events
0

Modification events

No data
Executable files
1 688
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe —
MD5:—
SHA256:—
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:7EE8A4B4AC1D27530C01E9F9C49A0B8C
SHA256:2E6ECAFDB930B474BE92E78C177268EF6AE80B8CBD1544EEF3710939D8E8A397
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:84F8BDB56D4975437A03DB5B1E457D46
SHA256:DB4147BA260DD015154D90D19562C8DFAE6E7F1D6A020495266D05B2C8B72E53
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:7B1679156173D03F29DB663D76D74E64
SHA256:A5280E6449DC86E9B1CBD0B782F0F5541AAF9058A4A383F3C88DB649862F45C7
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_100_percent.pak.tmpexecutable
MD5:F8D080FDE09962F74F64C641C091FB5A
SHA256:D58C814A4E85AA323C72EB8651EE07CCE7E260BDD29E537E44B4F7F40BC3BFE4
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:89BCBFD2B4CE684B78E2E883B1EE054E
SHA256:74159A64C163FD3FCB83431C3323BE10C7AA40861E664EF6421A951C8BB0213B
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:88C95F5CF83E40A620FEB9055C41E9C1
SHA256:ADF98E9FF5AE8EBF6C704656D8B3A9D98EB00B03F8A4BB7737931E3A5B29BCFA
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:7B6F381321DFC16A0019A09A08854A75
SHA256:C4E86685840AEAF55C4665B17C43EFD1E4E5C20B583556735CF75E506651A949
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.tmpexecutable
MD5:DF66535D9AA48521B0E3BD5811582D71
SHA256:01BDD644F1825481C2D84DF5F32EFE4F2373D874114B4F8EDBDC95DDDEF417B6
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:C0AE1BA641F656425EBE5BEFF8795A6F
SHA256:1A4158A25671B0A5CE0ECFC663F0E1650C5280090CABDF0D62D805E884F63A01
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1140
RUXIMICS.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1140
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1140
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1140
RUXIMICS.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1488
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1140
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 13.69.239.78
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe