File name:

sigthief.exe

Full analysis: https://app.any.run/tasks/9b921736-a5cd-476d-9d6b-890c6250f037
Verdict: Malicious activity
Analysis date: July 16, 2024, 22:26:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

3E261BECBFE12D7A5FFDBBA91C76011B

SHA1:

2E5849AA0BE921849F42121544895CE405FD9AF1

SHA256:

C85E5240DA0E9D06677278F01C55F7D2611641EBEEAFFF9529E383E6948FD9EE

SSDEEP:

98304:vXEKqOdxPEmRbS2zjI+GHE4uYeN67seVQ5jiYbUfYaHI6jdoRpl89a/ylTdN7dyF:NSq+BYNEb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sigthief.exe (PID: 2648)

  • SUSPICIOUS

    • Process drops python dynamic module

      • sigthief.exe (PID: 2648)

    • The process drops C-runtime libraries

      • sigthief.exe (PID: 2648)

    • Executable content was dropped or overwritten

      • sigthief.exe (PID: 2648)

    • Process drops legitimate windows executable

      • sigthief.exe (PID: 2648)

  • INFO

    • Reads the computer name

      • sigthief.exe (PID: 2648)

    • Checks supported languages

      • sigthief.exe (PID: 2648)

    • Create files in a temporary directory

      • sigthief.exe (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:02:19 13:44:07+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.34
CodeSize: 166400
InitializedDataSize: 152576
UninitializedDataSize: -
EntryPoint: 0xa6a0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sigthief.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2648"C:\Users\admin\AppData\Local\Temp\sigthief.exe" C:\Users\admin\AppData\Local\Temp\sigthief.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\sigthief.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sigthief.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7104C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7136"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
387
Read events
387
Write events
0
Delete events
0

Modification events

No data
Executable files
51
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\_bz2.pydexecutable
MD5:23DCE6CD4BE213F8374BF52E67A15C91
SHA256:190ADE9F09BE287FCC5328A6A497921F164C5C67E6D4FCDCB8B8FD6853B06FE2
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:AB810B5ED6A091A174196D39AF3EB40C
SHA256:4BA34EE15D266F65420F9D91BAC19DB401C9EDF97A2F9BDE69E4CE17C201AB67
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\_lzma.pydexecutable
MD5:401ECA12E2BEB9C2FBF4A0D871C1C500
SHA256:5361824DDAC7C84811B80834ECA3ACB5FE6D63BF506CF92BAF5BD6C3786BF209
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\_hashlib.pydexecutable
MD5:477DD76DBB15BAD8D77B978EA336F014
SHA256:23063B56AA067C3D4A79A873D4DB113F6396F3E1FE0AF4B12D95D240C4CF9969
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\_decimal.pydexecutable
MD5:B6ACB44C2F580991DF7B1358A0FC0B69
SHA256:2BAB2833C24EB4E07FE082D291013EED000A5CFC22DF49311C729E7A57FE632E
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\_ssl.pydexecutable
MD5:DCB25C920292192DD89821526C09A806
SHA256:4E496CB3B89550CF5883D0B52F5F4660524969C7A5FA35A3B233DF4F482D0482
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:38D6B73A450E7F77B17405CA9D726C76
SHA256:429EB73CC17924F0068222C7210806DAF5DC96DF132C347F63DC4165A51A2C62
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:869C7061D625FEC5859DCEA23C812A0A
SHA256:2087318C9EDBAE60D27B54DD5A5756FE5B1851332FB4DCD9EFDC360DFEB08D12
2648sigthief.exeC:\Users\admin\AppData\Local\Temp\_MEI26482\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:F5625259B91429BB48B24C743D045637
SHA256:39BE1D39DB5B41A1000D400D929F6858F1EB3E75A851BCBD5110FE41E8E39AE5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
62
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4696
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4448
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4448
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4456
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6580
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6580
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4656
SearchApp.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
184.30.17.189:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
52.111.236.21:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.139
  • 104.126.37.171
  • 104.126.37.163
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.160
  • 104.126.37.128
  • 104.126.37.146
  • 104.126.37.155
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.78
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.31.169.57
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sigthief.exe