File name:

DhackLoader.exe

Full analysis: https://app.any.run/tasks/87409f0a-d0ce-48de-9206-bccfbe506187
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 10:23:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ms-smartcard
stealer
salatstealer
susp-powershell
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

F81DB973063E78743B71F95D8EDB79B8

SHA1:

36C9C62FDE144C6AF63D1A69BA041C573A21DCCB

SHA256:

B3ADAA8266DC932CA7EE8E552171311390C0BDDADC54072655DF88A23FC4C396

SSDEEP:

98304:jwBqmUs7x908qBXkT0lNwceRSuyFC3GB:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • DhackLoader.exe (PID: 1380)

    • Actions looks like stealing of personal data

      • sppsvc.exe (PID: 1752)

    • Steals credentials from Web Browsers

      • sppsvc.exe (PID: 1752)

    • SALATSTEALER has been detected (YARA)

      • sppsvc.exe (PID: 1752)

  • SUSPICIOUS

    • Application launched itself

      • DhackLoader.exe (PID: 3504)
      • updater.exe (PID: 6380)

    • Reads security settings of Internet Explorer

      • DhackLoader.exe (PID: 3504)

    • The process creates files with name similar to system file names

      • DhackLoader.exe (PID: 1380)

    • Executable content was dropped or overwritten

      • DhackLoader.exe (PID: 1380)
      • sppsvc.exe (PID: 1752)

    • Starts itself from another location

      • DhackLoader.exe (PID: 1380)
      • sppsvc.exe (PID: 1752)

    • Starts POWERSHELL.EXE for commands execution

      • sppsvc.exe (PID: 1752)

    • Multiple wallet extension IDs have been found

      • sppsvc.exe (PID: 1752)

    • There is functionality for taking screenshot (YARA)

      • sppsvc.exe (PID: 1752)

    • Connects to unusual port

      • sppsvc.exe (PID: 1752)

    • The process executes via Task Scheduler

      • updater.exe (PID: 6380)

  • INFO

    • Reads the machine GUID from the registry

      • DhackLoader.exe (PID: 3504)
      • DhackLoader.exe (PID: 1380)
      • sppsvc.exe (PID: 1752)
      • sppsvc.exe (PID: 6360)
      • sppsvc.exe (PID: 768)

    • Reads the computer name

      • DhackLoader.exe (PID: 3504)
      • DhackLoader.exe (PID: 1380)
      • sppsvc.exe (PID: 1752)
      • sppsvc.exe (PID: 6360)
      • sppsvc.exe (PID: 768)
      • updater.exe (PID: 6380)

    • Process checks computer location settings

      • DhackLoader.exe (PID: 3504)

    • Checks supported languages

      • DhackLoader.exe (PID: 3504)
      • DhackLoader.exe (PID: 1380)
      • sppsvc.exe (PID: 1752)
      • sppsvc.exe (PID: 6360)
      • sppsvc.exe (PID: 768)
      • updater.exe (PID: 1332)
      • updater.exe (PID: 6380)

    • Creates files or folders in the user directory

      • DhackLoader.exe (PID: 1380)

    • Launching a file from a Registry key

      • DhackLoader.exe (PID: 1380)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • sppsvc.exe (PID: 1752)

    • Create files in a temporary directory

      • sppsvc.exe (PID: 1752)

    • Found Base64 encoded file access via PowerShell (YARA)

      • sppsvc.exe (PID: 1752)

    • Application based on Golang

      • sppsvc.exe (PID: 1752)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • sppsvc.exe (PID: 1752)

    • Detects GO elliptic curve encryption (YARA)

      • sppsvc.exe (PID: 1752)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 2952)

    • Found Base64 encoded access to environment variables via PowerShell (YARA)

      • sppsvc.exe (PID: 1752)

    • Reads the software policy settings

      • sppsvc.exe (PID: 1752)
      • slui.exe (PID: 1564)

    • Checks proxy server information

      • slui.exe (PID: 1564)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6380)

    • Creates files in the program directory

      • sppsvc.exe (PID: 1752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 3
CodeSize: 4869632
InitializedDataSize: 342016
UninitializedDataSize: -
EntryPoint: 0x6e610
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dhackloader.exe no specs dhackloader.exe #SALATSTEALER sppsvc.exe powershell.exe no specs conhost.exe no specs sppsvc.exe no specs sppsvc.exe no specs slui.exe updater.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Program Files (x86)\Microsoft\Edge\Application\sppsvc.exe" -C:\Program Files (x86)\Microsoft\Edge\Application\sppsvc.exe—sppsvc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\microsoft\edge\application\sppsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcryptprimitives.dll
c:\windows\syswow64\winmm.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1380"C:\Users\admin\AppData\Local\Temp\DhackLoader.exe" C:\Users\admin\AppData\Local\Temp\DhackLoader.exe
DhackLoader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dhackloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
1564C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1752C:\Users\admin\AppData\Local\SolidDocuments\sppsvc.exeC:\Users\admin\AppData\Local\SolidDocuments\sppsvc.exe
DhackLoader.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\soliddocuments\sppsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcryptprimitives.dll
c:\windows\syswow64\winmm.dll
2952powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—sppsvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3504"C:\Users\admin\AppData\Local\Temp\DhackLoader.exe" C:\Users\admin\AppData\Local\Temp\DhackLoader.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\dhackloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
6360"C:\Program Files\Google\Chrome\Application\sppsvc.exe" -C:\Program Files\Google\Chrome\Application\sppsvc.exe—sppsvc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\google\chrome\application\sppsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcryptprimitives.dll
c:\windows\syswow64\winmm.dll
6380"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
12 089
Read events
12 087
Write events
2
Delete events
0

Modification events

(PID) Process:(1380) DhackLoader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:csrss
Value:
C:\Users\admin\AppData\Local\VirtualStore\csrss.exe
(PID) Process:(1380) DhackLoader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:sppsvc
Value:
C:\Users\admin\AppData\Local\SolidDocuments\sppsvc.exe
Executable files
4
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1752sppsvc.exeC:\Program Files\Google\Chrome\Application\sppsvc.exeexecutable
MD5:F81DB973063E78743B71F95D8EDB79B8
SHA256:B3ADAA8266DC932CA7EE8E552171311390C0BDDADC54072655DF88A23FC4C396
1380DhackLoader.exeC:\Users\admin\AppData\Local\VirtualStore\csrss.exeexecutable
MD5:F81DB973063E78743B71F95D8EDB79B8
SHA256:B3ADAA8266DC932CA7EE8E552171311390C0BDDADC54072655DF88A23FC4C396
2952powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nvbl3rf0.h2x.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2952powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_f1seemfn.wff.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1380DhackLoader.exeC:\Users\admin\AppData\Local\SolidDocuments\sppsvc.exeexecutable
MD5:F81DB973063E78743B71F95D8EDB79B8
SHA256:B3ADAA8266DC932CA7EE8E552171311390C0BDDADC54072655DF88A23FC4C396
1752sppsvc.exeC:\Program Files (x86)\Microsoft\Edge\Application\sppsvc.exeexecutable
MD5:F81DB973063E78743B71F95D8EDB79B8
SHA256:B3ADAA8266DC932CA7EE8E552171311390C0BDDADC54072655DF88A23FC4C396
1332updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:4DEFBBB01587CF34DA8142D77AA866F5
SHA256:C2F3DFC8B7109395B52FD930B3033A9BC5AFDB919F934679F7E962E4A685FAB6
2952powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8B8A832FCE2174C8FEE26B70F2483FBB
SHA256:0FBA3A37EF443507F533A7C3F31C0B5826EA416B95FDE43479E02D4E0C29400B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
51
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4476
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2808
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2808
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4680
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1380
DhackLoader.exe
1.1.1.1:443
—
—
—
whitelisted
1380
DhackLoader.exe
188.114.97.3:443
—
—
—
unknown
1752
sppsvc.exe
1.1.1.1:443
—
—
—
whitelisted
1752
sppsvc.exe
188.114.97.3:443
—
—
—
unknown
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
  • 23.53.41.90
  • 23.53.40.202
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.bing.com
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.28
  • 92.123.104.38
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.3
  • 40.126.31.69
  • 40.126.31.130
  • 40.126.31.128
  • 20.190.159.68
  • 40.126.31.2
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DhackLoader.exe