File name:

CudoMiner.exe

Full analysis: https://app.any.run/tasks/3ab6a1cd-158d-468f-9e85-705935b7fd3b
Verdict: Malicious activity
Analysis date: May 29, 2024, 07:35:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5:

E3082028116B8DC0C19446F223CD6C44

SHA1:

0CCCFEA92F34FFB45897036549D1359A316013E2

SHA256:

B6A16A9794C048B191274FB2AB9D8489497074DF1BA278BA984AC7B507B03AE3

SSDEEP:

49152:v0ZQ5qHIz/LMvDU5dvNyscdBj7vS0wL2kHYLRNfdjL2pHtm2VShsq68GS0uiv8cY:v0i5qozovgZWjq0wLcL/f1LOHlSKqdGk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CudoMiner.exe (PID: 2072)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • CudoMiner.exe (PID: 2072)

    • Creates a software uninstall entry

      • CudoMiner.exe (PID: 2072)

    • Executable content was dropped or overwritten

      • CudoMiner.exe (PID: 2072)

    • Reads security settings of Internet Explorer

      • CudoMiner.exe (PID: 2072)

    • Reads the Internet Settings

      • CudoMiner.exe (PID: 2072)

    • Starts application with an unusual extension

      • CudoMiner.exe (PID: 2072)

    • Node.exe was dropped

      • CudoMiner.exe (PID: 2072)

    • Drops a system driver (possible attempt to evade defenses)

      • CudoMiner.exe (PID: 2072)

    • Checks Windows Trust Settings

      • CudoMiner.exe (PID: 2072)

    • Creates or modifies Windows services

      • Updater.exe (PID: 1236)
      • Cudo Miner.exe (PID: 2248)

  • INFO

    • Checks proxy server information

      • CudoMiner.exe (PID: 2072)

    • Reads the computer name

      • CudoMiner.exe (PID: 2072)
      • wmpnscfg.exe (PID: 2204)
      • Cudo Miner.exe (PID: 2248)
      • Updater.exe (PID: 1236)

    • Checks supported languages

      • CudoMiner.exe (PID: 2072)
      • wmpnscfg.exe (PID: 2204)
      • nsAC9F.tmp (PID: 1768)
      • nsC8F6.tmp (PID: 1852)
      • nsC83A.tmp (PID: 1796)
      • Cudo Miner.exe (PID: 2248)
      • nsC3A3.tmp (PID: 552)
      • nsC450.tmp (PID: 1368)
      • Updater.exe (PID: 1236)

    • Reads the software policy settings

      • CudoMiner.exe (PID: 2072)

    • Creates files or folders in the user directory

      • CudoMiner.exe (PID: 2072)

    • Reads Environment values

      • CudoMiner.exe (PID: 2072)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2204)

    • Reads the machine GUID from the registry

      • CudoMiner.exe (PID: 2072)
      • Cudo Miner.exe (PID: 2248)
      • Updater.exe (PID: 1236)

    • Create files in a temporary directory

      • CudoMiner.exe (PID: 2072)

    • Creates files in the program directory

      • CudoMiner.exe (PID: 2072)
      • Updater.exe (PID: 1236)
      • Cudo Miner.exe (PID: 2248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:08:29 19:32:12+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.34
CodeSize: 36864
InitializedDataSize: 40960
UninitializedDataSize: 152064
EntryPoint: 0x42e6
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cudominer.exe wmpnscfg.exe no specs nsac9f.tmp no specs nsc3a3.tmp no specs nsc450.tmp no specs updater.exe no specs nsc83a.tmp no specs nsc8f6.tmp no specs cudo miner.exe no specs cudominer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
552"C:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC3A3.tmp" C:\Program Files\Cudo Miner\Updater.exe uninstallC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC3A3.tmp—CudoMiner.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225501
Modules
Images
c:\users\admin\appdata\local\temp\nse41bf.tmp\nsc3a3.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1236"C:\Program Files\Cudo Miner\Updater.exe" installC:\Program Files\Cudo Miner\Updater.exe—nsC450.tmp
User:
admin
Integrity Level:
HIGH
Description:
Updater
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\cudo miner\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1368"C:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC450.tmp" C:\Program Files\Cudo Miner\Updater.exe installC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC450.tmp—CudoMiner.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nse41bf.tmp\nsc450.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsAC9F.tmp" C:\Program Files\Cudo Miner\Cudo Miner.exe stopC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsAC9F.tmp—CudoMiner.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225501
Modules
Images
c:\users\admin\appdata\local\temp\nse41bf.tmp\nsac9f.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1796"C:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC83A.tmp" C:\Program Files\Cudo Miner\Cudo Miner.exe uninstallC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC83A.tmp—CudoMiner.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225501
Modules
Images
c:\users\admin\appdata\local\temp\nse41bf.tmp\nsc83a.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1852"C:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC8F6.tmp" C:\Program Files\Cudo Miner\Cudo Miner.exe installC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsC8F6.tmp—CudoMiner.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nse41bf.tmp\nsc8f6.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2072"C:\Users\admin\AppData\Local\Temp\CudoMiner.exe" C:\Users\admin\AppData\Local\Temp\CudoMiner.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\cudominer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2204"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2248"C:\Program Files\Cudo Miner\Cudo Miner.exe" installC:\Program Files\Cudo Miner\Cudo Miner.exe—nsC8F6.tmp
User:
admin
Company:
Cudo Miner
Integrity Level:
HIGH
Description:
Cudo Miner
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\cudo miner\cudo miner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3980"C:\Users\admin\AppData\Local\Temp\CudoMiner.exe" C:\Users\admin\AppData\Local\Temp\CudoMiner.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\cudominer.exe
c:\windows\system32\ntdll.dll
Total events
8 448
Read events
8 393
Write events
46
Delete events
9

Modification events

(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2072) CudoMiner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
37
Suspicious files
8
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2072CudoMiner.exeC:\Program Files\Cudo Miner\Cudo Miner Core.exe —
MD5:—
SHA256:—
2072CudoMiner.exeC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsExec.dllexecutable
MD5:5402A3C64E9F1C051E22EC3E6206692F
SHA256:DD4A4A22B275C87902C58ABC43832B952410855FF98AF4D95660FE13F6B98BDA
2072CudoMiner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:B9A6CE2D8D958F97F33E4C90383555B0
SHA256:35C92A56B5F0F8520F27EE9B8D093C80DEEB4F7599DBEDFA8619559986DB3C03
2072CudoMiner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:60EFE6E26E34F5FDD7ABAB5DE3317AA3
SHA256:B1C7B8E7CFB9B00EC10FA0E74BB826D0F0D642B849EB449B444BB5A5C6AED6ED
2072CudoMiner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:60F7742297D5DEFFF3E8766A6E896310
SHA256:1997D5690BC723648F38B6458CA3234331540B25255F74AB43446AC331F345E5
2072CudoMiner.exeC:\Users\admin\AppData\Local\Temp\CudoMinerCore.zipcompressed
MD5:18B55C72BD542EFE74AF8D76FAF872C5
SHA256:3264106B8C38658CBFCD6D79B529CFFC810A927931FB95AA881CCDD9C05C05AC
2072CudoMiner.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:4123D1BC6AEAE60257B97275C331DF0B
SHA256:DBBB785A50711851EB173541CCC49CD4D787A5AAD55BA6542EB5E4491E2A54CF
2072CudoMiner.exeC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsAC9F.tmpexecutable
MD5:5402A3C64E9F1C051E22EC3E6206692F
SHA256:DD4A4A22B275C87902C58ABC43832B952410855FF98AF4D95660FE13F6B98BDA
2072CudoMiner.exeC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsisunz.dllexecutable
MD5:5F13DBC378792F23E598079FC1E4422B
SHA256:6E87ECB7F62039FBB6E7676422D1A5E75A32B90DDE6865DCB68EE658BA8DF61D
2072CudoMiner.exeC:\Users\admin\AppData\Local\Temp\nse41BF.tmp\nsDialogs.dllexecutable
MD5:87CDD064D650B3CF72F8A103BD73BACE
SHA256:A29754F0B21FBB92265F1FB924B3423A330704BBF56796DA67AECA876DBD3326
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2072
CudoMiner.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e1b0942b2bf0cfd6
unknown
—
—
unknown
2072
CudoMiner.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
2072
CudoMiner.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2072
CudoMiner.exe
104.26.11.102:443
download.cudo.org
CLOUDFLARENET
US
unknown
2072
CudoMiner.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
2072
CudoMiner.exe
142.250.181.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
download.cudo.org
  • 104.26.11.102
  • 172.67.69.190
  • 104.26.10.102
unknown
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.pki.goog
  • 142.250.181.227
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CudoMiner.exe