File name:

f07de996de69952ee792dfa038abbf78d5b12a1c981ea385e7bc5f914c12dfdb.exe

Full analysis: https://app.any.run/tasks/dc7a9449-6c7a-4c42-a15f-e36029e430e5
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: November 23, 2024, 18:08:48
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
trickbot
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (DLL) (native) Intel 80386, for MS Windows, 4 sections
MD5:

A8C6A6527458599C374E9FDBB383C993

SHA1:

CC6AA26A60963BF8304EFD1F03A77C80AFB9F262

SHA256:

F07DE996DE69952EE792DFA038ABBF78D5B12A1C981EA385E7BC5F914C12DFDB

SSDEEP:

24576:Kj82abM15xIxD4KXJg/vYRbKDBhF1TSwcQcirXuO:Kjcbo5xIxh+A+Nh+wJcir+O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TRICKBOT has been detected (YARA)

      • wermgr.exe (PID: 5460)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • wermgr.exe (PID: 5460)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 5144)

    • Reads the Internet Settings

      • wermgr.exe (PID: 5460)

  • INFO

    • Reads the software policy settings

      • wermgr.exe (PID: 5460)

    • Checks proxy server information

      • wermgr.exe (PID: 5460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:10:21 08:51:08+00:00
ImageFileCharacteristics: Executable, 32-bit, DLL
PEType: PE32
LinkerVersion: 14.16
CodeSize: 277504
InitializedDataSize: 444928
UninitializedDataSize: -
EntryPoint: 0x13a0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Native
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
110
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs rundll32.exe no specs cmd.exe no specs #TRICKBOT wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1832"C:\Windows\System32\rundll32.exe" C:\Users\admin\Desktop\f07de996de69952ee792dfa038abbf78d5b12a1c981ea385e7bc5f914c12dfdb.exe.dll, #1C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcp_win.dll
2132C:\Windows\system32\cmd.exeC:\Windows\SysWOW64\cmd.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5144"C:\Windows\System32\rundll32.exe" C:\Users\admin\Desktop\f07de996de69952ee792dfa038abbf78d5b12a1c981ea385e7bc5f914c12dfdb.exe.dll, #1C:\Windows\SysWOW64\rundll32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.22000.653 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
5460C:\Windows\system32\wermgr.exeC:\Windows\System32\wermgr.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
10.0.22000.653 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
Total events
6 522
Read events
6 522
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
31
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4532
MoUsoCoreWorker.exe
GET
304
146.75.122.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d84458bc1026bc7f
unknown
—
—
whitelisted
7052
rundll32.exe
GET
304
146.75.122.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?66518f537310c9f3
unknown
—
—
whitelisted
—
—
GET
200
184.24.77.4:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
2860
svchost.exe
GET
304
23.50.131.205:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6c35f0c1573b9bee
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
23.50.131.205:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?c8be12605aaef0f9
unknown
—
—
whitelisted
—
—
HEAD
200
23.218.208.109:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
unknown
2860
svchost.exe
GET
200
23.50.131.205:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bfcbd5bfec4ee7dd
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
23.50.131.205:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?838da79f34b29c7d
unknown
—
—
whitelisted
—
—
GET
200
52.113.194.132:443
https://ecs.office.com/config/v2/Office/officeclicktorun/16.0.16626.20134/Production/CC?&Clientid=%7b80C2A92B-EDEE-479E-8470-DBC6C547F2FB%7d&Application=officeclicktorun&Platform=win32&Version=16.0.16626.20134&MsoVersion=16.0.16626.20134&ProcessName=officec2rclient.exe&Audience=Production&Build=ship&Architecture=x64&OsVersion=10.0&OsBuild=22000&Channel=CC&InstallType=C2R&SessionId=%7bB0017E59-8178-4EE1-996D-D5127376D839%7d&LabMachine=false
unknown
binary
79.0 Kb
whitelisted
—
—
GET
200
23.218.208.109:443
https://fs.microsoft.com/fs/windows/config.json
unknown
binary
55 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
7052
rundll32.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
4088
OfficeC2RClient.exe
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
—
—
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
—
—
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
5552
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
184.24.77.4:80
—
Akamai International B.V.
DE
unknown
4532
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4532
MoUsoCoreWorker.exe
146.75.122.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
prod.remote-settings.prod.webservices.mozgcp.net
  • 34.149.100.209
whitelisted
telemetry-incoming.r53-2.services.mozilla.com
  • 34.120.208.123
whitelisted
google.com
  • 216.58.206.78
whitelisted
ctldl.windowsupdate.com
  • 146.75.122.172
  • 23.50.131.205
  • 23.50.131.196
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
mrodevicemgr.officeapps.live.com
  • 52.109.89.117
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Microsoft Connection Test
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f07de996de69952ee792dfa038abbf78d5b12a1c981ea385e7bc5f914c12dfdb.exe