File name:

XF-Sublime-KG.exe

Full analysis: https://app.any.run/tasks/11c6c382-edab-4146-915b-1f9eafba5cee
Verdict: Malicious activity
Analysis date: December 05, 2022, 19:47:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7302BF749281240439214BCBFB334A5A

SHA1:

576204F2C01CA78370C25D3147F8CBED73B7C205

SHA256:

E2EE8AE987D783EC5CD4EE7CC8AC968F0DDD85CBD40EACCE0DF57DEA00DC1417

SSDEEP:

12288:nYxTGmN/OZv6l2W0DB9BQ18QtPCKxReCh18xMb9hk:nYNGm1AvaTtPCKRhWS3k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • XF-Sublime-KG.exe (PID: 3140)
  • SUSPICIOUS

    • Application launched itself

      • XF-Sublime-KG.exe (PID: 3500)
      • XF-Sublime-KG.exe (PID: 2444)
      • XF-Sublime-KG.exe (PID: 3140)
      • XF-Sublime-KG.exe (PID: 3520)
      • XF-Sublime-KG.exe (PID: 2296)
      • XF-Sublime-KG.exe (PID: 2024)
      • XF-Sublime-KG.exe (PID: 3876)
      • XF-Sublime-KG.exe (PID: 2604)
      • XF-Sublime-KG.exe (PID: 2796)
      • XF-Sublime-KG.exe (PID: 3676)
      • XF-Sublime-KG.exe (PID: 2848)
      • XF-Sublime-KG.exe (PID: 928)
      • XF-Sublime-KG.exe (PID: 708)
      • XF-Sublime-KG.exe (PID: 3724)
      • XF-Sublime-KG.exe (PID: 3716)
      • XF-Sublime-KG.exe (PID: 3032)
      • XF-Sublime-KG.exe (PID: 3540)
      • XF-Sublime-KG.exe (PID: 1580)
      • XF-Sublime-KG.exe (PID: 2644)
      • XF-Sublime-KG.exe (PID: 3084)
      • XF-Sublime-KG.exe (PID: 1472)
      • XF-Sublime-KG.exe (PID: 3168)
      • XF-Sublime-KG.exe (PID: 2696)
      • XF-Sublime-KG.exe (PID: 3444)
      • XF-Sublime-KG.exe (PID: 2472)
      • XF-Sublime-KG.exe (PID: 2792)
      • XF-Sublime-KG.exe (PID: 2088)
      • XF-Sublime-KG.exe (PID: 3704)
      • XF-Sublime-KG.exe (PID: 2640)
      • XF-Sublime-KG.exe (PID: 2412)
      • XF-Sublime-KG.exe (PID: 1804)
      • XF-Sublime-KG.exe (PID: 3448)
      • XF-Sublime-KG.exe (PID: 2968)
      • XF-Sublime-KG.exe (PID: 3044)
      • XF-Sublime-KG.exe (PID: 2496)
      • XF-Sublime-KG.exe (PID: 4052)
      • XF-Sublime-KG.exe (PID: 3020)
      • XF-Sublime-KG.exe (PID: 2748)
      • XF-Sublime-KG.exe (PID: 2928)
      • XF-Sublime-KG.exe (PID: 2216)
      • XF-Sublime-KG.exe (PID: 2868)
      • XF-Sublime-KG.exe (PID: 3756)
      • XF-Sublime-KG.exe (PID: 2708)
      • XF-Sublime-KG.exe (PID: 4020)
      • XF-Sublime-KG.exe (PID: 2960)
      • XF-Sublime-KG.exe (PID: 3932)
      • XF-Sublime-KG.exe (PID: 1836)
      • XF-Sublime-KG.exe (PID: 3052)
      • XF-Sublime-KG.exe (PID: 1660)
      • XF-Sublime-KG.exe (PID: 3452)
      • XF-Sublime-KG.exe (PID: 3208)
      • XF-Sublime-KG.exe (PID: 2324)
      • XF-Sublime-KG.exe (PID: 4040)
      • XF-Sublime-KG.exe (PID: 3528)
      • XF-Sublime-KG.exe (PID: 3220)
      • XF-Sublime-KG.exe (PID: 2508)
      • XF-Sublime-KG.exe (PID: 3136)
      • XF-Sublime-KG.exe (PID: 3740)
      • XF-Sublime-KG.exe (PID: 3060)
      • XF-Sublime-KG.exe (PID: 3980)
      • XF-Sublime-KG.exe (PID: 2884)
      • XF-Sublime-KG.exe (PID: 2592)
      • XF-Sublime-KG.exe (PID: 2424)
      • XF-Sublime-KG.exe (PID: 3532)
      • XF-Sublime-KG.exe (PID: 3712)
      • XF-Sublime-KG.exe (PID: 3552)
      • XF-Sublime-KG.exe (PID: 2364)
      • XF-Sublime-KG.exe (PID: 2816)
      • XF-Sublime-KG.exe (PID: 2964)
      • XF-Sublime-KG.exe (PID: 988)
      • XF-Sublime-KG.exe (PID: 2404)
      • XF-Sublime-KG.exe (PID: 2036)
      • XF-Sublime-KG.exe (PID: 3424)
      • XF-Sublime-KG.exe (PID: 1576)
      • XF-Sublime-KG.exe (PID: 2876)
      • XF-Sublime-KG.exe (PID: 3504)
      • XF-Sublime-KG.exe (PID: 4072)
      • XF-Sublime-KG.exe (PID: 3296)
      • XF-Sublime-KG.exe (PID: 2836)
      • XF-Sublime-KG.exe (PID: 3268)
      • XF-Sublime-KG.exe (PID: 2416)
      • XF-Sublime-KG.exe (PID: 624)
      • XF-Sublime-KG.exe (PID: 2484)
      • XF-Sublime-KG.exe (PID: 3988)
      • XF-Sublime-KG.exe (PID: 3468)
      • XF-Sublime-KG.exe (PID: 2900)
      • XF-Sublime-KG.exe (PID: 1860)
      • XF-Sublime-KG.exe (PID: 4028)
      • XF-Sublime-KG.exe (PID: 632)
      • XF-Sublime-KG.exe (PID: 3884)
      • XF-Sublime-KG.exe (PID: 404)
    • Drops a file with too old compile date

      • XF-Sublime-KG.exe (PID: 3140)
    • Executable content was dropped or overwritten

      • XF-Sublime-KG.exe (PID: 3140)
  • INFO

    • Drops a file that was compiled in debug mode

      • XF-Sublime-KG.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: 0
e_cparhdr: 4
e_minalloc: 0
e_maxalloc: 65535
e_ss: 0
e_sp: 184
e_csum: 0
e_ip: 0
e_cs: 0
e_ovno: 0
e_oemid: 0
e_oeminfo: 0
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: 0
NumberOfSymbols: 0
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
65536
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
241664
14752
14848
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.90583

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.73482
12840
UNKNOWN
English - United States
RT_ICON
103
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG
1 (#2)
5.28747
841
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
93
Malicious processes
1
Suspicious processes
47

Behavior graph

Click at the process to see the details
start xf-sublime-kg.exe no specs xf-sublime-kg.exe xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs xf-sublime-kg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1880"C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe" C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
3140"C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe" C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2444C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeXF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3520C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeXF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3500C:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\admin\AppData\Local\Temp\XF-Sublime-KG.exeXF-Sublime-KG.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\xf-sublime-kg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll