| File name: | t.exe |
| Full analysis: | https://app.any.run/tasks/a4879e9a-776a-4672-a4c6-81eadac2d3a3 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 30, 2025, 09:17:41 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 0C883B1D66AFCE606D9830F48D69D74B |
| SHA1: | FE431FE73A4749722496F19B3B3CA0B629B50131 |
| SHA256: | D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1 |
| SSDEEP: | 3072:cJ/hMNfDU6NP/mAyp/8+62bSKI2agWtXwU6mq/3qeR0pAP9doM4xpkOpgYtKh4mq:X28Y |
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:11:12 22:29:33+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 58368 |
| InitializedDataSize: | 25600 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x7590 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2996 | C:\Users\admin\AppData\Local\Temp\1330227892.exe | C:\Users\admin\AppData\Local\Temp\1330227892.exe | 2588418054.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6076 | dwm.exe | C:\Windows\System32\dwm.exe | winmngrsa.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Desktop Window Manager Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6368 | C:\Users\admin\sysnldcvmr.exe | C:\Users\admin\sysnldcvmr.exe | — | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6860 | C:\Users\admin\AppData\Local\Temp\69203450.exe | C:\Users\admin\AppData\Local\Temp\69203450.exe | 2588418054.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6368 | sysnldcvmr.exe | C:\Users\admin\AppData\Local\Temp\2588418054.exe | binary | |
MD5:207624CCE0D6E32E623F082268CDB77D | SHA256:0780A2A0DA21E0AAD9B159B02A7E2169ECFE9FFC9C8D742B4DE12D2F06F26FB3 | |||
| 6368 | sysnldcvmr.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\1[1] | binary | |
MD5:207624CCE0D6E32E623F082268CDB77D | SHA256:0780A2A0DA21E0AAD9B159B02A7E2169ECFE9FFC9C8D742B4DE12D2F06F26FB3 | |||
| 6368 | sysnldcvmr.exe | C:\Users\admin\tbtnds.dat | binary | |
MD5:B7DAC03C25063DF27CDB03D71932F7AA | SHA256:B5F2D22724C7DAA93696E22BB9A698E6C06310435BD4FD43543D0E35FBA100C7 | |||
| 2996 | 1330227892.exe | C:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exe | executable | |
MD5:DFB789E2A35C98DC0019FDC071634EF1 | SHA256:2229173D0628BC4E7B7F990A0F316EB7406B347915EE05AFB91735AF3D987606 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/1 | unknown | — | — | malicious |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.78.42:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/1 | unknown | — | — | malicious |
— | — | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/tcoin.exe | unknown | — | — | malicious |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/2 | unknown | — | — | malicious |
6988 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/3 | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.35.238.131:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 185.215.113.66:80 | — | 1337team Limited | SC | unknown |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 95.101.78.42:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
— | — | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
— | — | Misc activity | ET INFO Packed Executable Download |
— | — | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
— | — | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
6368 | sysnldcvmr.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 |
— | — | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
— | — | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
— | — | Misc activity | ET INFO Packed Executable Download |