Analysis date (UTC): 7 March 2025, 12:05Analysis environment: Windows 10 Pro, build 19045, x64

zahtjev_za_ponudu.img.exe

MD5:E02E061EC0DE7BCE15AC5FA57A5443BD

SHA1:1082EA09020F5C1A7B66D22B2747CC33B6171DBE

SHA256:EB9F4892ADBA6025A04AEB048A5A068461ABBFBD910926E24E4672F1400E8A86

Analysis result

Threat level:Malicious activity

Tags:

exfiltrationpurelogspurecrypterstealer

Full analysis:Analysis zahtjev_za_ponudu.img.exe (MD5: E02E061EC0DE7BCE15AC5FA57A5443BD) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Scans artifacts that could help determine the target

InstallUtil.exe (PID: 1088)

Actions looks like stealing of personal data

InstallUtil.exe (PID: 1088)

Steals credentials from Web Browsers

InstallUtil.exe (PID: 1088)

PURELOGS has been detected (SURICATA)

InstallUtil.exe (PID: 1088)

SUSPICIOUS

Starts process via Powershell

powershell.exe (PID: 2656)

Starts POWERSHELL.EXE for commands execution

zahtjev_za_ponudu.img.exe (PID: 4488)
InstallUtil.exe (PID: 1088)

Reads security settings of Internet Explorer

zahtjev_za_ponudu.img.exe (PID: 4488)

Connects to unusual port

InstallUtil.exe (PID: 1088)

PowerShell delay command usage (probably sleep evasion)

powershell.exe (PID: 8088)

Removes files via Powershell

powershell.exe (PID: 8088)

INFO

Reads the computer name

zahtjev_za_ponudu.img.exe (PID: 4488)
InstallUtil.exe (PID: 1088)
identity_helper.exe (PID: 1388)

Disables trace logs

zahtjev_za_ponudu.img.exe (PID: 4488)

Checks supported languages

zahtjev_za_ponudu.img.exe (PID: 4488)
InstallUtil.exe (PID: 1088)
identity_helper.exe (PID: 1388)

Checks proxy server information

zahtjev_za_ponudu.img.exe (PID: 4488)
slui.exe (PID: 8036)

Reads the software policy settings

zahtjev_za_ponudu.img.exe (PID: 4488)
slui.exe (PID: 8036)

Manual execution by a user

InstallUtil.exe (PID: 1088)

Reads the machine GUID from the registry

zahtjev_za_ponudu.img.exe (PID: 4488)
InstallUtil.exe (PID: 1088)

Process checks computer location settings

zahtjev_za_ponudu.img.exe (PID: 4488)

Reads Microsoft Office registry keys

InstallUtil.exe (PID: 1088)

Reads Environment values

identity_helper.exe (PID: 1388)

Connects to unusual port

msedge.exe (PID: 6656)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 8088)

The sample compiled with english language support

msedge.exe (PID: 5228)

Application launched itself

msedge.exe (PID: 2096)

Executable content was dropped or overwritten

msedge.exe (PID: 5228)

Threats

PID	Process	Class	Message
1088	InstallUtil.exe	A Network Trojan was detected	STEALER [ANY.RUN] PureLogs Stealer Exfiltration
—	—	Potentially Bad Traffic	ET INFO Possible Chrome Plugin install
6656	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
6656	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
6656	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
6656	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com