File name:

b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe

Full analysis: https://app.any.run/tasks/ce77dae6-9c5a-4551-a9a9-4d8bab5744c1
Verdict: Malicious activity
Analysis date: January 10, 2025, 22:54:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
MD5:

B89C4DEA38B4191A1D7ECA9ECBBD34F7

SHA1:

A39EFA1A4D2D4B9746A180573A4F8B436A849515

SHA256:

B29AE96EA57CE81F1AB2BBC351BF1CA1ED4600EF3A2BCC183D07DDDBD3BA2AC3

SSDEEP:

1536:EhPpyASvVVVVVVVVWs5ZEDgWsgW1JqOpc7Fc7n:cpDSvVVVVVVVVIgWsgW1JqOh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • The process creates files with name similar to system file names

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Executable content was dropped or overwritten

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

  • INFO

    • UPX packer has been detected

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Creates files or folders in the user directory

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Checks supported languages

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x2130
UninitializedDataSize: 24576
InitializedDataSize: 4096
CodeSize: 8192
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
TimeStamp: 2011:03:15 04:06:07+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe

Process information

PID
CMD
Path
Indicators
Parent process
6384"C:\Users\admin\Desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe" C:\Users\admin\Desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
11
Read events
11
Write events
0
Delete events
0

Modification events

No data
Executable files
1 688
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe —
MD5:—
SHA256:—
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:C0AE1BA641F656425EBE5BEFF8795A6F
SHA256:1A4158A25671B0A5CE0ECFC663F0E1650C5280090CABDF0D62D805E884F63A01
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:49A13D79BF8E1B207476A0AEB3996E0E
SHA256:F98B261777AC3DDCA0F952B5A06859C91C4BB51CF5026F5A2636860D1DAB27CB
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:89BCBFD2B4CE684B78E2E883B1EE054E
SHA256:74159A64C163FD3FCB83431C3323BE10C7AA40861E664EF6421A951C8BB0213B
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_100_percent.pak.tmpexecutable
MD5:F8D080FDE09962F74F64C641C091FB5A
SHA256:D58C814A4E85AA323C72EB8651EE07CCE7E260BDD29E537E44B4F7F40BC3BFE4
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:84F8BDB56D4975437A03DB5B1E457D46
SHA256:DB4147BA260DD015154D90D19562C8DFAE6E7F1D6A020495266D05B2C8B72E53
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:131039CF5FD88B1D54EB9574A76F0C1E
SHA256:215C8E4E23DB70B9E2F7010757FBEFCCCFF95690E3AC8276EBDFBFFE5656F3F1
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:7EE8A4B4AC1D27530C01E9F9C49A0B8C
SHA256:2E6ECAFDB930B474BE92E78C177268EF6AE80B8CBD1544EEF3710939D8E8A397
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:88C95F5CF83E40A620FEB9055C41E9C1
SHA256:ADF98E9FF5AE8EBF6C704656D8B3A9D98EB00B03F8A4BB7737931E3A5B29BCFA
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:7B6F381321DFC16A0019A09A08854A75
SHA256:C4E86685840AEAF55C4665B17C43EFD1E4E5C20B583556735CF75E506651A949
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1140
RUXIMICS.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1140
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1140
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1140
RUXIMICS.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1488
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1140
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 13.69.239.78
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe