File name:

0f5806e0887c0d85e43e46fa9aaecda2.exe

Full analysis: https://app.any.run/tasks/f859793e-2b7c-4d44-bbe2-1e50832aa3d8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 17, 2023, 22:53:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
smoke
smokeloader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0F5806E0887C0D85E43E46FA9AAECDA2

SHA1:

C6BA6E91D40AA1507775077F9662ECB25C9F0943

SHA256:

DCD883AF6EB91AA30A58838DB875B23A981A14636C7C9CC3BCABA600FF8E034E

SSDEEP:

98304:1n2xEvMZ4H2Y8gKVaeQrKKkpudtBFLXdtP49riGVV0h1jJXAyk0oQ8W1M4p6KAfF:b1sF5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 0f5806e0887c0d85e43e46fa9aaecda2.exe (PID: 2820)
      • cmd.exe (PID: 2704)

    • Runs injected code in another process

      • 5IH0Dp8.exe (PID: 1412)

    • Application was injected by another process

      • explorer.exe (PID: 2004)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 2004)

    • Creates a writable file in the system directory

      • taskhost.exe (PID: 2308)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 2dT5311.exe (PID: 336)
      • BA8C.exe (PID: 884)

    • Connects to the server without a host name

      • explorer.exe (PID: 2004)

    • Starts CMD.EXE for commands execution

      • BA8C.exe (PID: 884)

    • Executes as Windows Service

      • taskhost.exe (PID: 2308)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 2004)

  • INFO

    • Reads the computer name

      • 2dT5311.exe (PID: 336)
      • BA8C.exe (PID: 884)

    • Create files in a temporary directory

      • 0f5806e0887c0d85e43e46fa9aaecda2.exe (PID: 2820)
      • explorer.exe (PID: 2004)

    • Reads the machine GUID from the registry

      • 2dT5311.exe (PID: 336)
      • BA8C.exe (PID: 884)

    • Checks supported languages

      • 0f5806e0887c0d85e43e46fa9aaecda2.exe (PID: 2820)
      • 2dT5311.exe (PID: 336)
      • 5IH0Dp8.exe (PID: 1412)
      • BA8C.exe (PID: 884)

    • Reads the Internet Settings

      • explorer.exe (PID: 2004)

    • Creates files in the program directory

      • cmd.exe (PID: 2704)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 2004)

    • Reads Environment values

      • 2dT5311.exe (PID: 336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:25 00:49:06+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 2356224
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
280
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject 0f5806e0887c0d85e43e46fa9aaecda2.exe no specs 2dt5311.exe 5ih0dp8.exe no specs #SMOKE explorer.exe ba8c.exe no specs cmd.exe no specs ping.exe no specs applaunch.exe no specs applaunch.exe no specs applaunch.exe no specs applaunch.exe no specs applaunch.exe no specs taskhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
336C:\Users\admin\AppData\Local\Temp\IXP000.TMP\2dT5311.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\2dT5311.exe
0f5806e0887c0d85e43e46fa9aaecda2.exe
User:
admin
Integrity Level:
MEDIUM
Description:
opinions
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\2dt5311.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
456"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—BA8C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
4294967295
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
884C:\Users\admin\AppData\Local\Temp\BA8C.exeC:\Users\admin\AppData\Local\Temp\BA8C.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\ba8c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
1412C:\Users\admin\AppData\Local\Temp\IXP000.TMP\5IH0Dp8.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5IH0Dp8.exe—0f5806e0887c0d85e43e46fa9aaecda2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\5ih0dp8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2004C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2020"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—BA8C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
4294967295
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2052"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—BA8C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
4294967295
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2308"taskhost.exe"C:\Windows\System32\taskhost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2432"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—BA8C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
4294967295
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2704"C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\AppData\Local\Temp\BA8C.exe" "C:\ProgramData\hOPMpgxrM36tza0i.exe" && ping 1.1.1.1C:\Windows\System32\cmd.exe—BA8C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
830
Read events
817
Write events
13
Delete events
0

Modification events

(PID) Process:(2004) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB010000000425B8FBD140304D952DBE1156DB516600000000020000000000106600000001000020000000DB7CFDADD20035B54FE72E91B52C386E688080B10C096541937D15768230E9B4000000000E8000000002000020000000FC5BD8C24841EC802021354E72CCCB98F326B765B114F6B99237B0E53C70855230000000E5259FA42E3216E6ABD96FBA3A6491DBFE5EABB7874FD90C6180CAAA39FCB4DA5097AFD783F475C120AF35A7DAD783F44000000017650D25D4C3008FF427790B98E977F1147A37B555438BA5F03FADACC116CEA191D18AD610A15D4BB60F12EF1F1AF002B029515D03AC7340FF8EFA43530BF5CD
(PID) Process:(884) BA8C.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(884) BA8C.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(884) BA8C.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(884) BA8C.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2004) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2704cmd.exeC:\ProgramData\hOPMpgxrM36tza0i.exeexecutable
MD5:4BA0816D674E3A239FD6E12E45435250
SHA256:AFB0A01F30AA1239F85E2EB465E374C49A274383CAA52D3C8DD46C67B17BE519
2004explorer.exeC:\Users\admin\AppData\Local\Temp\BA8C.exeexecutable
MD5:4BA0816D674E3A239FD6E12E45435250
SHA256:AFB0A01F30AA1239F85E2EB465E374C49A274383CAA52D3C8DD46C67B17BE519
28200f5806e0887c0d85e43e46fa9aaecda2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\2dT5311.exeexecutable
MD5:89DA591D5435A3963B0EB65835C32B30
SHA256:E323B5052539A7AAE8F60696811C3D6A80F6ACC23071B3BBC032FA5F4616C3D3
28200f5806e0887c0d85e43e46fa9aaecda2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\5IH0Dp8.exeexecutable
MD5:B333502D7915BBD0911087435549FD31
SHA256:DF09728A6383DB0B8BB9F28A04CCD0C358E3F525C1D340C94D481FE8C97B4ADB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
10
DNS requests
3
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2004
explorer.exe
POST
404
185.215.113.68:80
http://185.215.113.68/fks/index.php
unknown
binary
7 b
unknown
2004
explorer.exe
POST
404
185.215.113.68:80
http://185.215.113.68/fks/index.php
unknown
binary
101 b
unknown
2004
explorer.exe
GET
200
91.92.253.122:80
http://91.92.253.122/Cleaner_SetupFile.exe
unknown
executable
2.47 Mb
unknown
2004
explorer.exe
POST
404
185.215.113.68:80
http://185.215.113.68/fks/index.php
unknown
binary
54 b
unknown
2004
explorer.exe
POST
404
185.215.113.68:80
http://185.215.113.68/fks/index.php
unknown
html
340 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
352
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1220
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
336
2dT5311.exe
144.76.136.153:443
transfer.sh
Hetzner Online GmbH
DE
unknown
2004
explorer.exe
185.215.113.68:80
—
1337team Limited
SC
unknown
2004
explorer.exe
162.159.133.233:443
cdn.discordapp.com
CLOUDFLARENET
—
shared
2004
explorer.exe
91.92.253.122:80
—
—
BG
unknown

DNS requests

Domain
IP
Reputation
transfer.sh
  • 144.76.136.153
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
cdn.discordapp.com
  • 162.159.133.233
  • 162.159.129.233
  • 162.159.135.233
  • 162.159.134.233
  • 162.159.130.233
shared

Threats

PID
Process
Class
Message
352
svchost.exe
Potentially Bad Traffic
ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)
352
svchost.exe
Misc activity
ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)
2004
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
352
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
2004
explorer.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2004
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
2004
explorer.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2004
explorer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2004
explorer.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2004
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0f5806e0887c0d85e43e46fa9aaecda2.exe