File name:

PurchaseOrderNo.4514296730.exe

Full analysis: https://app.any.run/tasks/3c9db00c-d822-4066-8315-b3b10b47067c
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Analysis date: March 24, 2025, 16:28:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
dbatloader
loader
evasion
snake
keylogger
stealer
ims-api
generic
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

56D58557714C0C04F08549E2F7C76A4B

SHA1:

F28AF35C3C4216F337CE9DE40057335B82CF94E6

SHA256:

E4808F0DCD8731D7642A89FEFAD15205EC001EB6F1819280FB664A478A22613B

SSDEEP:

49152:A9DVpgg3diNXBNkQlguf0EiUCZxXsTJi4jQK5h5myt1ze92QKmQY0JuwK:UnMRuQlgVE3CZtsTJDjHf5mytQ9PPQYn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • DBATLOADER has been detected (YARA)

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • SNAKEKEYLOGGER has been detected (SURICATA)

      • nmbgmauN.pif (PID: 7896)
    • Actions looks like stealing of personal data

      • nmbgmauN.pif (PID: 7896)
    • Steals credentials from Web Browsers

      • nmbgmauN.pif (PID: 7896)
  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Reads security settings of Internet Explorer

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Starts CMD.EXE for commands execution

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Executing commands from ".cmd" file

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7568)
    • Likely accesses (executes) a file from the Public directory

      • esentutl.exe (PID: 7672)
      • alpha.pif (PID: 7704)
      • alpha.pif (PID: 7724)
    • Drops a file with a rarely used extension (PIF)

      • esentutl.exe (PID: 7672)
      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Executable content was dropped or overwritten

      • esentutl.exe (PID: 7672)
      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Starts a Microsoft application from unusual location

      • alpha.pif (PID: 7704)
      • alpha.pif (PID: 7724)
    • Created directory related to system

      • alpha.pif (PID: 7704)
    • Starts itself from another location

      • cmd.exe (PID: 7540)
    • Starts application with an unusual extension

      • cmd.exe (PID: 7540)
      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Checks for external IP

      • svchost.exe (PID: 2196)
      • nmbgmauN.pif (PID: 7896)
    • The process verifies whether the antivirus software is installed

      • nmbgmauN.pif (PID: 7896)
    • Possible usage of Discord/Telegram API has been detected (YARA)

      • nmbgmauN.pif (PID: 7896)
  • INFO

    • Reads the computer name

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
      • nmbgmauN.pif (PID: 7896)
    • Checks supported languages

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
      • alpha.pif (PID: 7704)
      • alpha.pif (PID: 7724)
      • nmbgmauN.pif (PID: 7896)
    • Compiled with Borland Delphi (YARA)

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Creates files in the program directory

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Checks proxy server information

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
      • nmbgmauN.pif (PID: 7896)
      • slui.exe (PID: 7996)
    • The sample compiled with english language support

      • esentutl.exe (PID: 7672)
      • PurchaseOrderNo.4514296730.exe (PID: 7336)
    • Reads the machine GUID from the registry

      • PurchaseOrderNo.4514296730.exe (PID: 7336)
      • nmbgmauN.pif (PID: 7896)
    • Disables trace logs

      • nmbgmauN.pif (PID: 7896)
    • .NET Reactor protector has been detected

      • nmbgmauN.pif (PID: 7896)
    • Reads the software policy settings

      • nmbgmauN.pif (PID: 7896)
      • slui.exe (PID: 7996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.scr | Windows screen saver (55.3)
.exe | Win32 Executable (generic) (19)
.exe | Win16/32 Executable Delphi generic (8.7)
.exe | Generic Win/DOS Executable (8.4)
.exe | DOS Executable Generic (8.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 419328
InitializedDataSize: 1218048
UninitializedDataSize: -
EntryPoint: 0x67828
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DBATLOADER purchaseorderno.4514296730.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs esentutl.exe alpha.pif no specs alpha.pif no specs #SNAKEKEYLOGGER nmbgmaun.pif svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7336"C:\Users\admin\Desktop\PurchaseOrderNo.4514296730.exe" C:\Users\admin\Desktop\PurchaseOrderNo.4514296730.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\purchaseorderno.4514296730.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7540C:\WINDOWS\system32\cmd.exe /c ""C:\\Users\\All Users\\2201.cmd""C:\Windows\SysWOW64\cmd.exePurchaseOrderNo.4514296730.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7568C:\WINDOWS\system32\cmd.exe /c ""C:\\Users\\All Users\\15225.cmd""C:\Windows\SysWOW64\cmd.exePurchaseOrderNo.4514296730.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7644ping 127.0.0.1 -n 10 C:\Windows\SysWOW64\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7672C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o C:\Windows\SysWOW64\esentutl.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\esentutl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7704C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " C:\Users\Public\alpha.pifcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\public\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7724C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" C:\Users\Public\alpha.pifcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\public\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 993
Read events
7 979
Write events
14
Delete events
0

Modification events

(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7896) nmbgmauN.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\nmbgmauN_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7336PurchaseOrderNo.4514296730.exeC:\ProgramData\neo.cmdtext
MD5:5BAF253744AD26F35BA17DB6B80763E9
SHA256:9CBB41E6C4F8565A6D121B770FCF3F15A6891C8DF8BFBA6D0414B3AD3298BDBA
7672esentutl.exeC:\Users\Public\alpha.pifexecutable
MD5:D3348AC2130C7E754754A6E9CB053B09
SHA256:E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD
7336PurchaseOrderNo.4514296730.exeC:\ProgramData\15225.cmdtext
MD5:9A020804EBA1FFAC2928D7C795144BBF
SHA256:A86C6C7A2BF9E12C45275A5E7EBEBD5E6D2BA302FE0A12600B7C9FDF283D9E63
7336PurchaseOrderNo.4514296730.exeC:\Users\admin\Links\nmbgmauN.pifexecutable
MD5:C116D3604CEAFE7057D77FF27552C215
SHA256:7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
7336PurchaseOrderNo.4514296730.exeC:\ProgramData\2201.cmdtext
MD5:1DF650CCA01129127D30063634AB5C03
SHA256:EDD4094E7A82A6FF8BE65D6B075E9513BD15A6B74F8032B5C10CE18F7191FA60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
6
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7896
nmbgmauN.pif
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
whitelisted
7896
nmbgmauN.pif
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
whitelisted
GET
200
104.21.80.1:443
https://reallyfreegeoip.org/xml/91.147.1.164
unknown
text
368 b
malicious
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
7896
nmbgmauN.pif
158.101.44.242:80
checkip.dyndns.org
ORACLE-BMC-31898
US
whitelisted
7896
nmbgmauN.pif
104.21.48.1:443
reallyfreegeoip.org
CLOUDFLARENET
malicious
7000
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7996
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
checkip.dyndns.org
  • 158.101.44.242
  • 193.122.6.168
  • 132.226.8.169
  • 193.122.130.0
  • 132.226.247.73
whitelisted
reallyfreegeoip.org
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.112.1
  • 104.21.80.1
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7896
nmbgmauN.pif
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7896
nmbgmauN.pif
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7896
nmbgmauN.pif
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
7896
nmbgmauN.pif
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info