analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

XF-Sublime-KG.exe

Full analysis: https://app.any.run/tasks/11c6c382-edab-4146-915b-1f9eafba5cee
Verdict: Malicious activity
Analysis date: December 05, 2022, 19:47:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7302BF749281240439214BCBFB334A5A

SHA1:

576204F2C01CA78370C25D3147F8CBED73B7C205

SHA256:

E2EE8AE987D783EC5CD4EE7CC8AC968F0DDD85CBD40EACCE0DF57DEA00DC1417

SSDEEP:

12288:nYxTGmN/OZv6l2W0DB9BQ18QtPCKxReCh18xMb9hk:nYNGm1AvaTtPCKRhWS3k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • XF-Sublime-KG.exe (PID: 3140)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • XF-Sublime-KG.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • XF-Sublime-KG.exe (PID: 3140)

    • Application launched itself

      • XF-Sublime-KG.exe (PID: 3140)
      • XF-Sublime-KG.exe (PID: 2444)
      • XF-Sublime-KG.exe (PID: 3500)
      • XF-Sublime-KG.exe (PID: 2024)
      • XF-Sublime-KG.exe (PID: 3520)
      • XF-Sublime-KG.exe (PID: 3676)
      • XF-Sublime-KG.exe (PID: 3876)
      • XF-Sublime-KG.exe (PID: 928)
      • XF-Sublime-KG.exe (PID: 2296)
      • XF-Sublime-KG.exe (PID: 2848)
      • XF-Sublime-KG.exe (PID: 3032)
      • XF-Sublime-KG.exe (PID: 2796)
      • XF-Sublime-KG.exe (PID: 2604)
      • XF-Sublime-KG.exe (PID: 708)
      • XF-Sublime-KG.exe (PID: 3724)
      • XF-Sublime-KG.exe (PID: 3716)
      • XF-Sublime-KG.exe (PID: 1472)
      • XF-Sublime-KG.exe (PID: 3084)
      • XF-Sublime-KG.exe (PID: 2696)
      • XF-Sublime-KG.exe (PID: 2644)
      • XF-Sublime-KG.exe (PID: 1580)
      • XF-Sublime-KG.exe (PID: 3540)
      • XF-Sublime-KG.exe (PID: 2472)
      • XF-Sublime-KG.exe (PID: 3168)
      • XF-Sublime-KG.exe (PID: 2640)
      • XF-Sublime-KG.exe (PID: 1804)
      • XF-Sublime-KG.exe (PID: 3444)
      • XF-Sublime-KG.exe (PID: 2088)
      • XF-Sublime-KG.exe (PID: 3704)
      • XF-Sublime-KG.exe (PID: 2412)
      • XF-Sublime-KG.exe (PID: 2792)
      • XF-Sublime-KG.exe (PID: 3448)
      • XF-Sublime-KG.exe (PID: 2968)
      • XF-Sublime-KG.exe (PID: 3756)
      • XF-Sublime-KG.exe (PID: 3044)
      • XF-Sublime-KG.exe (PID: 2748)
      • XF-Sublime-KG.exe (PID: 2216)
      • XF-Sublime-KG.exe (PID: 3932)
      • XF-Sublime-KG.exe (PID: 4052)
      • XF-Sublime-KG.exe (PID: 2960)
      • XF-Sublime-KG.exe (PID: 2496)
      • XF-Sublime-KG.exe (PID: 3020)
      • XF-Sublime-KG.exe (PID: 1660)
      • XF-Sublime-KG.exe (PID: 1836)
      • XF-Sublime-KG.exe (PID: 3060)
      • XF-Sublime-KG.exe (PID: 4020)
      • XF-Sublime-KG.exe (PID: 2708)
      • XF-Sublime-KG.exe (PID: 2928)
      • XF-Sublime-KG.exe (PID: 2868)
      • XF-Sublime-KG.exe (PID: 3452)
      • XF-Sublime-KG.exe (PID: 3052)
      • XF-Sublime-KG.exe (PID: 3740)
      • XF-Sublime-KG.exe (PID: 2508)
      • XF-Sublime-KG.exe (PID: 4040)
      • XF-Sublime-KG.exe (PID: 988)
      • XF-Sublime-KG.exe (PID: 2424)
      • XF-Sublime-KG.exe (PID: 2324)
      • XF-Sublime-KG.exe (PID: 3528)
      • XF-Sublime-KG.exe (PID: 3208)
      • XF-Sublime-KG.exe (PID: 2884)
      • XF-Sublime-KG.exe (PID: 3220)
      • XF-Sublime-KG.exe (PID: 3980)
      • XF-Sublime-KG.exe (PID: 3136)
      • XF-Sublime-KG.exe (PID: 2364)
      • XF-Sublime-KG.exe (PID: 3712)
      • XF-Sublime-KG.exe (PID: 1576)
      • XF-Sublime-KG.exe (PID: 3532)
      • XF-Sublime-KG.exe (PID: 3552)
      • XF-Sublime-KG.exe (PID: 3424)
      • XF-Sublime-KG.exe (PID: 3296)
      • XF-Sublime-KG.exe (PID: 2036)
      • XF-Sublime-KG.exe (PID: 2816)
      • XF-Sublime-KG.exe (PID: 2404)
      • XF-Sublime-KG.exe (PID: 2592)
      • XF-Sublime-KG.exe (PID: 2964)
      • XF-Sublime-KG.exe (PID: 2416)
      • XF-Sublime-KG.exe (PID: 3504)
      • XF-Sublime-KG.exe (PID: 1860)
      • XF-Sublime-KG.exe (PID: 4072)
      • XF-Sublime-KG.exe (PID: 2900)
      • XF-Sublime-KG.exe (PID: 404)
      • XF-Sublime-KG.exe (PID: 4028)
      • XF-Sublime-KG.exe (PID: 3268)
      • XF-Sublime-KG.exe (PID: 2836)
      • XF-Sublime-KG.exe (PID: 3884)
      • XF-Sublime-KG.exe (PID: 624)
      • XF-Sublime-KG.exe (PID: 2484)
      • XF-Sublime-KG.exe (PID: 3988)
      • XF-Sublime-KG.exe (PID: 3468)
      • XF-Sublime-KG.exe (PID: 632)
      • XF-Sublime-KG.exe (PID: 2876)

  • INFO

    • Drops a file that was compiled in debug mode

      • XF-Sublime-KG.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
65536
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
241664
14752
14848
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.90583

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.73482
12840
UNKNOWN
English - United States
RT_ICON
103
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG
1 (#2)
5.28747
841
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
93
Malicious processes
1
Suspicious processes
47

Behavior graph

Click at the process to see the details
start xf-sublime-kg.exe no specs xf-sublime-kg.exe xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1880"C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe" C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
3140"C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe" C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2444C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3520C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3500C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
3676C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2024C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3876C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2604C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
2796C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe—XF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
61 914
Read events
61 914
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3140XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\BASSMOD.dllexecutable
MD5:E4EC57E8508C5C4040383EBE6D367928
SHA256:8AD9E47693E292F381DA42DDC13724A3063040E51C26F4CA8E1F8E2F1DDD547F
3140XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\libwinpthread-1.dllexecutable
MD5:695D4B0B03267985AA0A74DCBF3E3A0E
SHA256:B87CEEA97753D556C4598776C0AC47E5B11797E82416406B418296BD8159E8B2
3140XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\libtomcrypt.dllexecutable
MD5:77B01DD3263B26E9D85F23B0F3E669C6
SHA256:6A011B173D149E6B667B9DA3569BB6B05E6038249AB5F020AD448086E02CEDAF
3140XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\libgcc_s_dw2-1.dllexecutable
MD5:E45E405491FE9C857E27ED81FF7CEBEA
SHA256:66AC4CCC4D40BE26842CD876659241719525114C3D7BFA93C64198918AF1CB27
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
XF-Sublime-KG.exe