File name:

b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe

Full analysis: https://app.any.run/tasks/cd4139e3-318b-4e2f-9749-89fec27df262
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 03, 2024, 02:32:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pureloader
purecrypter
loader
zgrat
pureminer
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

C1CCF8D9906984B81C192E97685E502F

SHA1:

59E728CF9787584EFE29D291B8A3A2F9704FDBBF

SHA256:

B3C3F0CE638BC6002866E0171CA2335B680A70FD854E12A49CE08954D44E241D

SSDEEP:

768:UAtZjVgRjyUUk+ASehOCXuuHn0CVx2zyT335/cCTJqW26v6YDgZV3LzT+hQl13Ek:UAPU7Hx2zyT335+W2a6J9zT+Kl1UdyX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • powershell.exe (PID: 5756)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5756)

    • Changes powershell execution policy (Bypass)

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)

    • Create files in the Startup directory

      • powershell.exe (PID: 5756)

    • PURELOADER has been detected (SURICATA)

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

    • PUREMINER has been detected (YARA)

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

    • [YARA] zgRAT detected by memory dumps

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)

    • Starts POWERSHELL.EXE for commands execution

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5756)

    • Application launched itself

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)

    • Connects to unusual port

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

  • INFO

    • Checks proxy server information

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)
      • slui.exe (PID: 5312)

    • Reads the computer name

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

    • Checks supported languages

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

    • Reads the machine GUID from the registry

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

    • Reads the software policy settings

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)
      • slui.exe (PID: 5312)

    • Reads Environment values

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 484)

    • Creates files or folders in the user directory

      • b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2053:08:12 05:03:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 35328
InitializedDataSize: 17408
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: super_market.exe
LegalCopyright:
OriginalFileName: super_market.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe powershell.exe conhost.exe no specs #PURELOADER b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
484C:\Users\admin\AppData\Local\Temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeC:\Users\admin\AppData\Local\Temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3900"C:\Users\admin\AppData\Local\Temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe" C:\Users\admin\AppData\Local\Temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5312C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5756"Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\admin\AppData\Local\Temp\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe' 'C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe' -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
Total events
7 032
Read events
7 017
Write events
15
Delete events
0

Modification events

(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3900) b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
5756powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:25429F78739AAA28AC96036727AE17E5
SHA256:40203150828ADB95700F33B43085DD79F9D1E9A77D70E7DF561F28793E816616
5756powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bajfu0w1.ypc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3900b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeC:\Users\admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe.logcsv
MD5:E37C379B6CBE2596DFCCBE610C8C4911
SHA256:449DB8A2DB009B8A7306BF3DB1815C9B7F64B99A2DC990CAD1F681941A3E2472
5756powershell.exeC:\Users\admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Powershell.exe.logtext
MD5:EEA3F69FCD7A747755D66FB5E1E0FF83
SHA256:61EF193A6B989CB857C08D7F795F6C5E84B43B286E0F7130504D1687482541BE
5756powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c2flulez.fsz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5756powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exeexecutable
MD5:C1CCF8D9906984B81C192E97685E502F
SHA256:B3C3F0CE638BC6002866E0171CA2335B680A70FD854E12A49CE08954D44E241D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
34
DNS requests
15
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1852
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
1608
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
3752
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
2464
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1852
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6896
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5928
svchost.exe
20.190.159.23:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5928
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1852
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1852
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
3900
b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
13.107.139.11:443
onedrive.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
onedrive.live.com
  • 13.107.139.11
  • 13.107.137.11
shared
zt1b0g.am.files.1drv.com
  • 13.107.42.12
unknown
www.bing.com
  • 184.86.251.27
  • 184.86.251.22
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
filebin.net
  • 88.99.137.18
unknown

Threats

PID
Process
Class
Message
3900
b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
484
b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe
Malware Command and Control Activity Detected
LOADER [ANY.RUN] PureLoader Download Attempt (LOAD)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b3c3f0ce638bc6002866e0171ca2335b680a70fd854e12a49ce08954d44e241d.exe