| File name: | test47248.exe |
| Full analysis: | https://app.any.run/tasks/d29b2a17-27b5-4363-ac5c-5ec7b972ee87 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 05, 2025, 22:18:32 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | C77CD68C3E2BEF97A4852736853091F9 |
| SHA1: | E0F505B6CDED07370F87A94C81CA130ED718554B |
| SHA256: | ECFBA7A8715491943F9DEBFCE9FB6F5C2BBF446019E9CE843553DB8A5CA20E4C |
| SSDEEP: | 48:Y51iwaDiLg7tJS6BTYbdkEEjNMNz+FSh9PDMFIA1BeQ3rh9eRw0bT8mMEm9tnjlD:MaDiMNqbdu0DBE3X4w0P8rtzfOzNt |
MALICIOUS
Changes the autorun value in the registry
- test47248.exe (PID: 7384)
SUSPICIOUS
Executable content was dropped or overwritten
- test47248.exe (PID: 7384)
- asiuf34785.exe (PID: 7448)
Reads security settings of Internet Explorer
- test47248.exe (PID: 7384)
- asiuf34785.exe (PID: 7448)
- SystemctlProcess.exe (PID: 7520)
Starts CMD.EXE for commands execution
- SystemctlProcess.exe (PID: 7520)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 5972)
Potential Corporate Privacy Violation
- test47248.exe (PID: 7384)
- asiuf34785.exe (PID: 7448)
The process connected to a server suspected of theft
- SystemctlProcess.exe (PID: 7520)
Checks for external IP
- SystemctlProcess.exe (PID: 7520)
Possible usage of Discord/Telegram API has been detected (YARA)
- SystemctlProcess.exe (PID: 7520)
Reads the date of Windows installation
- SystemctlProcess.exe (PID: 7520)
INFO
Reads the machine GUID from the registry
- test47248.exe (PID: 7384)
- SystemctlProcess.exe (PID: 7520)
- asiuf34785.exe (PID: 7448)
Disables trace logs
- test47248.exe (PID: 7384)
- SystemctlProcess.exe (PID: 7520)
- asiuf34785.exe (PID: 7448)
Creates files or folders in the user directory
- test47248.exe (PID: 7384)
Checks proxy server information
- test47248.exe (PID: 7384)
- SystemctlProcess.exe (PID: 7520)
- asiuf34785.exe (PID: 7448)
- slui.exe (PID: 7640)
Reads the computer name
- test47248.exe (PID: 7384)
- asiuf34785.exe (PID: 7448)
- SystemctlProcess.exe (PID: 7520)
Process checks computer location settings
- test47248.exe (PID: 7384)
- asiuf34785.exe (PID: 7448)
- SystemctlProcess.exe (PID: 7520)
Checks supported languages
- test47248.exe (PID: 7384)
- asiuf34785.exe (PID: 7448)
- SystemctlProcess.exe (PID: 7520)
Reads Environment values
- SystemctlProcess.exe (PID: 7520)
Create files in a temporary directory
- asiuf34785.exe (PID: 7448)
Reads the software policy settings
- slui.exe (PID: 7680)
- slui.exe (PID: 7640)
- SystemctlProcess.exe (PID: 7520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2041:11:12 16:38:13+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 3584 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2de6 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | test47248 |
| FileVersion: | 1.0.0.0 |
| InternalName: | test47248.exe |
| LegalCopyright: | Copyright © 2025 |
| LegalTrademarks: | - |
| OriginalFileName: | test47248.exe |
| ProductName: | test47248 |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
143
Monitored processes
9
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5332 | powershell -Command "Add-Type -AssemblyName 'System.Windows.Forms'; [System.Windows.Forms.MessageBox]::Show('eee')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5972 | "C:\Windows\System32\cmd.exe" /C powershell -Command "Add-Type -AssemblyName 'System.Windows.Forms'; [System.Windows.Forms.MessageBox]::Show('eee')" | C:\Windows\System32\cmd.exe | — | SystemctlProcess.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7000 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7384 | "C:\Users\admin\Desktop\test47248.exe" | C:\Users\admin\Desktop\test47248.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: test47248 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 7448 | "C:\Users\admin\AppData\Roaming\RealtekAudioDriver\asiuf34785.exe" | C:\Users\admin\AppData\Roaming\RealtekAudioDriver\asiuf34785.exe | test47248.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: RealtekBootstrapper Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 7520 | "C:\Users\admin\AppData\Local\Temp\SystemctlProcess.exe" | C:\Users\admin\AppData\Local\Temp\SystemctlProcess.exe | asiuf34785.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: SystemctlProcess Version: 1.0.0.0 Modules
| |||||||||||||||
| 7640 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7644 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7680 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
8 332
Read events
8 289
Write events
43
Delete events
0
Modification events
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7448) asiuf34785.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\asiuf34785_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
2
Suspicious files
1
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7384 | test47248.exe | C:\Users\admin\AppData\Roaming\RealtekAudioDriver\asiuf34785.exe | executable | |
MD5:7DD60EA11C585E3865374844B485D966 | SHA256:D975A5C0BA5201EADC2150FB5BE861C1A057F58AD50986BADD0856F93CA99127 | |||
| 5332 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_y1ynhusa.5lu.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5332 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qs5dkr1w.nhu.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7448 | asiuf34785.exe | C:\Users\admin\AppData\Local\Temp\SystemctlProcess.exe | executable | |
MD5:537DAB1E167974B1FD7A40217AC98190 | SHA256:A668690B2E0840540E5414BD10E61E5DC0CB7755D5091AEB70F325FA8685A78B | |||
| 5332 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:94C916C0194A8766A727D9EE47BBFFC7 | SHA256:0075B2901AB72064224B744C23EA40342AD6DDE881545A635EEB3064B4DD3807 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
33
DNS requests
18
Threats
16
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7384 | test47248.exe | GET | 200 | 132.145.27.207:80 | http://theobird.com/securitycheck | unknown | — | — | unknown |
7448 | asiuf34785.exe | GET | 200 | 132.145.27.207:80 | http://theobird.com/securitycheck2 | unknown | — | — | unknown |
7520 | SystemctlProcess.exe | GET | 200 | 132.145.27.207:80 | http://bean.theobird.com/execute | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8116 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7520 | SystemctlProcess.exe | GET | 504 | 132.145.27.207:80 | http://bean.theobird.com/execute | unknown | — | — | unknown |
7520 | SystemctlProcess.exe | GET | — | 132.145.27.207:80 | http://bean.theobird.com/execute | unknown | — | — | unknown |
5800 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5800 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7520 | SystemctlProcess.exe | GET | 504 | 132.145.27.207:80 | http://bean.theobird.com/execute | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7384 | test47248.exe | 132.145.27.207:80 | theobird.com | ORACLE-BMC-31898 | GB | unknown |
7448 | asiuf34785.exe | 132.145.27.207:80 | theobird.com | ORACLE-BMC-31898 | GB | unknown |
7520 | SystemctlProcess.exe | 172.67.74.152:443 | api.ipify.org | CLOUDFLARENET | US | shared |
7520 | SystemctlProcess.exe | 132.145.27.207:80 | theobird.com | ORACLE-BMC-31898 | GB | unknown |
7520 | SystemctlProcess.exe | 162.159.138.232:443 | discord.com | CLOUDFLARENET | — | whitelisted |
6544 | svchost.exe | 20.190.160.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
theobird.com |
| unknown |
api.ipify.org |
| shared |
bean.theobird.com |
| unknown |
discord.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
7520 | SystemctlProcess.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
2196 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
7520 | SystemctlProcess.exe | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
7520 | SystemctlProcess.exe | Misc activity | ET INFO Observed Discord Service Domain (discord .com) in TLS SNI |
2196 | svchost.exe | Misc activity | ET INFO Discord Chat Service Domain in DNS Lookup (discord .com) |
7520 | SystemctlProcess.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
7384 | test47248.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
7384 | test47248.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
7384 | test47248.exe | Misc activity | ET INFO EXE - Served Attached HTTP |