File name:

QuotationECDXB0007432025CJ.exe

Full analysis: https://app.any.run/tasks/344a0879-a15c-4026-b80f-5a7e2e106685
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 21:46:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
telegram
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

B7E0F34FC7C2D0952E0AEC3DE63C6980

SHA1:

54932566045F0B3F230337F9079028246E374E4D

SHA256:

DD0EA32D37CBF879BB0E5D38A454650A32817DF7E7DF1DC1A13ADE087E694B5D

SSDEEP:

49152:1Z3sLNm6h1P95svPQNznCdDAutuJILgFLiMDcPPaqqP0+nTr0aE9XW0KuxzkD7lh:1Khd1P3sH8zCZHtuJIkFL5Dc6F06T2x0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6644)

    • Executing a file with an untrusted certificate

      • QuotationECDXB0007432025CJ.exe (PID: 4988)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • msiexec.exe (PID: 5576)

    • Steals credentials from Web Browsers

      • msiexec.exe (PID: 5576)

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 5576)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • QuotationECDXB0007432025CJ.exe (PID: 4988)

    • There is functionality for taking screenshot (YARA)

      • QuotationECDXB0007432025CJ.exe (PID: 4988)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 6644)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 6644)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • msiexec.exe (PID: 5576)

    • The process verifies whether the antivirus software is installed

      • msiexec.exe (PID: 5576)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • msiexec.exe (PID: 5576)

  • INFO

    • Checks supported languages

      • QuotationECDXB0007432025CJ.exe (PID: 4988)

    • The sample compiled with english language support

      • QuotationECDXB0007432025CJ.exe (PID: 4988)
      • powershell.exe (PID: 6644)

    • Reads the computer name

      • QuotationECDXB0007432025CJ.exe (PID: 4988)

    • Creates files or folders in the user directory

      • QuotationECDXB0007432025CJ.exe (PID: 4988)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6644)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6644)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6644)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6644)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6644)

    • Disables trace logs

      • msiexec.exe (PID: 5576)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5576)

    • Reads the software policy settings

      • msiexec.exe (PID: 5576)
      • slui.exe (PID: 928)

    • Checks proxy server information

      • msiexec.exe (PID: 5576)
      • slui.exe (PID: 928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:12:27 06:25:55+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x326a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.5.0.0
ProductVersionNumber: 2.5.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Samsung
CompanyName: Polo Ralph Lauren Corp
FileDescription: Archer Daniels Midland Company
FileVersion: 2.5.0.0
LegalCopyright: Pacific Gas & Electric Corp.
ProductVersion: 2.5.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start quotationecdxb0007432025cj.exe no specs powershell.exe conhost.exe no specs #SNAKEKEYLOGGER msiexec.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
928C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4988"C:\Users\admin\Desktop\QuotationECDXB0007432025CJ.exe" C:\Users\admin\Desktop\QuotationECDXB0007432025CJ.exe—explorer.exe
User:
admin
Company:
Polo Ralph Lauren Corp
Integrity Level:
MEDIUM
Description:
Archer Daniels Midland Company
Exit code:
4294967295
Version:
2.5.0.0
Modules
Images
c:\users\admin\desktop\quotationecdxb0007432025cj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5576"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6644powershell.exe -windowstyle hidden "$Medicolegal=GC -raw 'C:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\Alderfly.Bry19';$Tinplate=$Medicolegal.SubString(42095,3);.$Tinplate($Medicolegal)"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
QuotationECDXB0007432025CJ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
15 340
Read events
15 323
Write events
17
Delete events
0

Modification events

(PID) Process:(4988) QuotationECDXB0007432025CJ.exeKey:HKEY_CURRENT_USER\Pyntede226\pulseless
Operation:writeName:inadvisableness
Value:
FF73AD7C
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5576) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msiexec_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
5
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\coolingly.gra —
MD5:—
SHA256:—
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\omregnedes.ino —
MD5:—
SHA256:—
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\inkorporeringer.initext
MD5:CE2BB787343213FFBEE81270D08B7953
SHA256:4BE1F79EE2D305A58D48FF820D68E779764B9B7436187273442BED7E8BBEB3C2
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\Tadpolism.Non198binary
MD5:FFA2B06ECF81BB3A7CE79E1F9AFC5689
SHA256:45B9A7733FC82DF39D0DA588586FBC5F470845A3B380C88E0613EAE0B7F96B26
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\kunai.joubinary
MD5:C2B324CC2DE40F98BD0DFD6387A9215F
SHA256:BAA38688D188184139650E63777A22764B785C87322B4A220C744DE2EB933047
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\sprogvidenskabsmands.torbinary
MD5:2CD4DEB635F27D365407734140052677
SHA256:5D2D4B0346C3DE9B88FB84A6159799301F26F2F4EDD6BDB0A2D998F02875A1C8
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\rottefngeren.radbinary
MD5:4CEBE59C52E139FFF0A9C0ECBC3EEEB6
SHA256:6649A5828D47408E3307D1D12168E4EECD60B052A501676AB5CB9BB42A0D9674
6644powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rpddq1b0.a4v.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4988QuotationECDXB0007432025CJ.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\truancy.jpgimage
MD5:6356AB23D24D8387795C0AE88E6A51F1
SHA256:0E99FDB5DB82FC8055B3ADCDCF233472189F30783C5B5E95FBA3C11DD23CD2AD
6644powershell.exeC:\Users\admin\AppData\Roaming\paraffine\tenacle\discophora\QuotationECDXB0007432025CJ.exeexecutable
MD5:B7E0F34FC7C2D0952E0AEC3DE63C6980
SHA256:DD0EA32D37CBF879BB0E5D38A454650A32817DF7E7DF1DC1A13ADE087E694B5D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
21
DNS requests
9
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
303
216.58.206.46:443
https://drive.google.com/uc?export=download&id=1kDalCyakCNUryo0AhOlvABi-rasDOkH7
unknown
—
—
—
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
—
—
GET
200
104.21.112.1:443
https://reallyfreegeoip.org/xml/95.25.124.41
unknown
—
—
—
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
—
—
GET
200
104.21.96.1:443
https://reallyfreegeoip.org/xml/95.25.124.41
unknown
—
—
—
5576
msiexec.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5576
msiexec.exe
142.250.186.46:443
drive.google.com
GOOGLE
US
unknown
5576
msiexec.exe
142.250.186.97:443
drive.usercontent.google.com
GOOGLE
US
unknown
5576
msiexec.exe
132.226.247.73:80
checkip.dyndns.org
ORACLE-BMC-31898
BR
unknown
5576
msiexec.exe
104.21.80.1:443
reallyfreegeoip.org
CLOUDFLARENET
—
unknown
5576
msiexec.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown
6032
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
928
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
unknown
google.com
  • 142.250.186.78
unknown
drive.google.com
  • 142.250.186.46
unknown
drive.usercontent.google.com
  • 142.250.186.97
unknown
checkip.dyndns.org
  • 132.226.247.73
  • 132.226.8.169
  • 158.101.44.242
  • 193.122.130.0
  • 193.122.6.168
unknown
reallyfreegeoip.org
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.64.1
unknown
api.telegram.org
  • 149.154.167.220
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
5576
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
5576
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
5576
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
5576
msiexec.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
5576
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
5576
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
5576
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
QuotationECDXB0007432025CJ.exe