File name:

t.exe

Full analysis: https://app.any.run/tasks/a4879e9a-776a-4672-a4c6-81eadac2d3a3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 30, 2025, 09:17:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phorpiex
loader
auto
generic
stealer
miner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

0C883B1D66AFCE606D9830F48D69D74B

SHA1:

FE431FE73A4749722496F19B3B3CA0B629B50131

SHA256:

D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1

SSDEEP:

3072:cJ/hMNfDU6NP/mAyp/8+62bSKI2agWtXwU6mq/3qeR0pAP9doM4xpkOpgYtKh4mq:X28Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • MINER has been detected (SURICATA)

      • dwm.exe (PID: 6076)
    • Connects to the CnC server

      • sysnldcvmr.exe (PID: 6368)
      • dwm.exe (PID: 6076)
    • Actions looks like stealing of personal data

      • 69203450.exe (PID: 6860)
      • 1330227892.exe (PID: 2996)
    • PHORPIEX has been detected (SURICATA)

      • sysnldcvmr.exe (PID: 6368)
  • SUSPICIOUS

    • Connects to the server without a host name

      • sysnldcvmr.exe (PID: 6368)
    • Connects to unusual port

      • dwm.exe (PID: 6076)
      • sysnldcvmr.exe (PID: 6368)
    • Potential Corporate Privacy Violation

      • dwm.exe (PID: 6076)
    • Executable content was dropped or overwritten

      • 1330227892.exe (PID: 2996)
  • INFO

    • Checks supported languages

      • 1330227892.exe (PID: 2996)
      • 69203450.exe (PID: 6860)
    • Create files in a temporary directory

      • 69203450.exe (PID: 6860)
    • Creates files or folders in the user directory

      • 1330227892.exe (PID: 2996)
    • The sample compiled with english language support

      • 1330227892.exe (PID: 2996)
    • Reads the machine GUID from the registry

      • sysnldcvmr.exe (PID: 6368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:12 22:29:33+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 58368
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0x7590
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
#PHORPIEX sysnldcvmr.exe #MINER dwm.exe 1330227892.exe 69203450.exe

Process information

PID
CMD
Path
Indicators
Parent process
2996C:\Users\admin\AppData\Local\Temp\1330227892.exeC:\Users\admin\AppData\Local\Temp\1330227892.exe
2588418054.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\1330227892.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6076dwm.exeC:\Windows\System32\dwm.exe
winmngrsa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
6368C:\Users\admin\sysnldcvmr.exeC:\Users\admin\sysnldcvmr.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\uxtheme.dll
c:\windows\syswow64\napinsp.dll
c:\windows\syswow64\pnrpnsp.dll
c:\windows\syswow64\wshbth.dll
c:\windows\syswow64\nlaapi.dll
c:\windows\syswow64\dnsapi.dll
c:\windows\syswow64\winrnr.dll
c:\windows\syswow64\fwpuclnt.dll
c:\windows\syswow64\rasadhlp.dll
c:\windows\syswow64\firewallapi.dll
6860C:\Users\admin\AppData\Local\Temp\69203450.exeC:\Users\admin\AppData\Local\Temp\69203450.exe
2588418054.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\69203450.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
1 693
Read events
1 693
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6368sysnldcvmr.exeC:\Users\admin\AppData\Local\Temp\2588418054.exebinary
MD5:207624CCE0D6E32E623F082268CDB77D
SHA256:0780A2A0DA21E0AAD9B159B02A7E2169ECFE9FFC9C8D742B4DE12D2F06F26FB3
6368sysnldcvmr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\1[1]binary
MD5:207624CCE0D6E32E623F082268CDB77D
SHA256:0780A2A0DA21E0AAD9B159B02A7E2169ECFE9FFC9C8D742B4DE12D2F06F26FB3
6368sysnldcvmr.exeC:\Users\admin\tbtnds.datbinary
MD5:B7DAC03C25063DF27CDB03D71932F7AA
SHA256:B5F2D22724C7DAA93696E22BB9A698E6C06310435BD4FD43543D0E35FBA100C7
29961330227892.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:DFB789E2A35C98DC0019FDC071634EF1
SHA256:2229173D0628BC4E7B7F990A0F316EB7406B347915EE05AFB91735AF3D987606
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
40
DNS requests
19
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
malicious
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
95.101.78.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
malicious
GET
200
185.215.113.66:80
http://185.215.113.66/tcoin.exe
unknown
malicious
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
GET
404
185.215.113.66:80
http://185.215.113.66/2
unknown
malicious
6988
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
404
185.215.113.66:80
http://185.215.113.66/3
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
192.168.100.255:138
whitelisted
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
185.215.113.66:80
1337team Limited
SC
unknown
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
95.101.78.42:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
192.168.100.255:137
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 95.101.78.42
  • 95.101.78.32
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.130
  • 40.126.31.1
  • 20.190.159.73
  • 40.126.31.131
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.67
whitelisted
www.bing.com
  • 2.21.65.153
  • 2.21.65.157
  • 2.21.65.132
  • 2.21.65.134
  • 2.21.65.154
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
Misc activity
ET INFO Packed Executable Download
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6368
sysnldcvmr.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
Misc activity
ET INFO Packed Executable Download
No debug info