File name:

Unlock856.exe

Full analysis: https://app.any.run/tasks/5a299c60-b9e0-4d50-b06d-952e5c540a2c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 21, 2023, 11:33:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
ransomware
stop
stealer
vidar
trojan
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5C03743F13DE536A0787C5D90FD96EAE

SHA1:

5179B67BC8B556ADA6770DE0EFC358A6B2061A05

SHA256:

0B5B173442717540EAFB8319B62AAA98AA3C222EAAE1EBC49A712F7B6DC9BCAF

SSDEEP:

12288:Ru2R1aBpw0DBH/qT4ExdNnv4WIm0O4ffLtPQt4ALYsaGul7T1uT5PUtD:R71av5d/qEkNvtR0O4HRcLYX7AT5PUZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stop is detected

      • Unlock856.exe (PID: 2220)

    • Application was dropped or rewritten from another process

      • build2.exe (PID: 2828)
      • build2.exe (PID: 3016)
      • build3.exe (PID: 1756)
      • mstsca.exe (PID: 2712)

    • Uses Task Scheduler to run other applications

      • build3.exe (PID: 1756)
      • mstsca.exe (PID: 2712)

    • VIDAR was detected

      • build2.exe (PID: 3016)

    • Connects to the CnC server

      • build2.exe (PID: 3016)

    • Steals credentials from Web Browsers

      • build2.exe (PID: 3016)

    • Actions looks like stealing of personal data

      • build2.exe (PID: 3016)

    • Steals credentials

      • build2.exe (PID: 3016)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Application launched itself

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2592)
      • Unlock856.exe (PID: 1672)
      • build2.exe (PID: 2828)

    • Reads the Internet Settings

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Uses ICACLS.EXE to modify access control lists

      • Unlock856.exe (PID: 2748)

    • Reads security settings of Internet Explorer

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Executable content was dropped or overwritten

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build3.exe (PID: 1756)
      • build2.exe (PID: 3016)

    • Reads settings of System Certificates

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Adds/modifies Windows certificates

      • Unlock856.exe (PID: 1672)

    • Process requests binary or script from the Internet

      • Unlock856.exe (PID: 2220)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • build2.exe (PID: 3016)

    • Connects to unusual port

      • build2.exe (PID: 3016)

    • Reads browser cookies

      • build2.exe (PID: 3016)

    • The process executes via Task Scheduler

      • mstsca.exe (PID: 2712)

    • Searches for installed software

      • build2.exe (PID: 3016)

  • INFO

    • Checks supported languages

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2592)
      • Unlock856.exe (PID: 2220)
      • Unlock856.exe (PID: 1672)
      • build2.exe (PID: 2828)
      • build2.exe (PID: 3016)
      • build3.exe (PID: 1756)
      • mstsca.exe (PID: 2712)

    • The process checks LSA protection

      • Unlock856.exe (PID: 2748)
      • icacls.exe (PID: 2380)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Creates files or folders in the user directory

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build3.exe (PID: 1756)
      • build2.exe (PID: 3016)

    • Create files in a temporary directory

      • Unlock856.exe (PID: 2748)

    • Reads the machine GUID from the registry

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Checks proxy server information

      • Unlock856.exe (PID: 2748)
      • Unlock856.exe (PID: 2220)
      • build2.exe (PID: 3016)

    • Reads the computer name

      • Unlock856.exe (PID: 2748)
      • build2.exe (PID: 3016)
      • Unlock856.exe (PID: 2220)

    • Creates files in the program directory

      • build2.exe (PID: 3016)

    • Reads Environment values

      • build2.exe (PID: 3016)

    • Reads product name

      • build2.exe (PID: 3016)

    • Reads CPU info

      • build2.exe (PID: 3016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductionVersion: 14.37.2.70
ProductName: SolarisOmir
ProductsVersion: 64.84.4.44
OriginalFileName: bigthing.exe
LegalCopyright: Copyright (C) 2023, parking
CharacterSet: Unknown (31F6)
LanguageCode: Faeroese
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0x20461)
FileFlags: (none)
FileFlagsMask: 0x183a
ProductVersionNumber: 8.0.0.0
FileVersionNumber: 18.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x9e70
UninitializedDataSize: -
InitializedDataSize: 5130240
CodeSize: 701952
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2022:05:24 00:15:22+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-May-2022 00:15:22
Detected languages:
  • Faroese - Faroe Islands
Debug artifacts:
  • C:\xebehatayu52 zesinokil.pdb
LegalCopyright: Copyright (C) 2023, parking
OriginalFilename: bigthing.exe
ProductsVersion: 64.84.4.44
ProductName: SolarisOmir
ProductionVersion: 14.37.2.70

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 24-May-2022 00:15:22
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000AB46E
0x000AB600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.93375
.data
0x000AD000
0x004C40C0
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.67539
.rsrc
0x00572000
0x0001B1E0
0x0001B200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.63489
.reloc
0x0058E000
0x000053F6
0x00005400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
2.19455

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.39292
568
UNKNOWN
UNKNOWN
RT_VERSION
2
3.62139
2216
UNKNOWN
UNKNOWN
RT_ICON
3
2.43273
9640
UNKNOWN
UNKNOWN
RT_ICON
4
2.4344
4264
UNKNOWN
UNKNOWN
RT_ICON
5
2.5985
1128
UNKNOWN
UNKNOWN
RT_ICON
6
5.35659
3752
UNKNOWN
UNKNOWN
RT_ICON
7
4.8917
2216
UNKNOWN
UNKNOWN
RT_ICON
8
4.36853
1384
UNKNOWN
UNKNOWN
RT_ICON
9
3.64074
9640
UNKNOWN
UNKNOWN
RT_ICON
10
3.66922
4264
UNKNOWN
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
11
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start unlock856.exe no specs unlock856.exe icacls.exe no specs unlock856.exe #STOP unlock856.exe build2.exe no specs #VIDAR build2.exe build3.exe schtasks.exe no specs mstsca.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1672"C:\Users\admin\AppData\Local\Temp\Unlock856.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\Unlock856.exe
Unlock856.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\unlock856.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1672/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Network\mstsca.exe"C:\Windows\SysWOW64\schtasks.exe—build3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\syswow64\schtasks.exe
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\wow64.dll
1756"C:\Users\admin\AppData\Local\d26d4dca-529c-42d6-b98a-7258f9615003\build3.exe" C:\Users\admin\AppData\Local\d26d4dca-529c-42d6-b98a-7258f9615003\build3.exe
Unlock856.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\d26d4dca-529c-42d6-b98a-7258f9615003\build3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\shell32.dll
2220"C:\Users\admin\AppData\Local\Temp\Unlock856.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\Unlock856.exe
Unlock856.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\unlock856.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2380icacls "C:\Users\admin\AppData\Local\d32b6c53-efe7-4465-8cbe-6023ff52edb4" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\SysWOW64\icacls.exe—Unlock856.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2592"C:\Users\admin\AppData\Local\Temp\Unlock856.exe" C:\Users\admin\AppData\Local\Temp\Unlock856.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\unlock856.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\user32.dll
c:\windows\system32\ntdll.dll
2712C:\Users\admin\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\mstsca.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\network\mstsca.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\user32.dll
2748"C:\Users\admin\AppData\Local\Temp\Unlock856.exe" C:\Users\admin\AppData\Local\Temp\Unlock856.exe
Unlock856.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\unlock856.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2772/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Network\mstsca.exe"C:\Windows\SysWOW64\schtasks.exe—mstsca.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\ntdll.dll
c:\windows\syswow64\schtasks.exe
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2828"C:\Users\admin\AppData\Local\d26d4dca-529c-42d6-b98a-7258f9615003\build2.exe" C:\Users\admin\AppData\Local\d26d4dca-529c-42d6-b98a-7258f9615003\build2.exe—Unlock856.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\d26d4dca-529c-42d6-b98a-7258f9615003\build2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
Total events
3 868
Read events
3 813
Write events
55
Delete events
0

Modification events

(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2748) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2748) Unlock856.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2220) Unlock856.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
12
Suspicious files
17
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2748Unlock856.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:0E4CD1480FB7F4D373371FAA594BD449
SHA256:4021918C95101103D7802097BEF124A6D4E8AB18D3B1CC609592C2EED3962FC6
2748Unlock856.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2748Unlock856.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\geo[1].jsonbinary
MD5:95DAD87B190EB236C0AD7183B41E5E99
SHA256:F8AB2A150522B8E52A8C7C19A2A74BC501C04683E850BA7B09F5AC8EE8377BB1
2220Unlock856.exeC:\Users\admin\AppData\Local\bowsakkdestx.txtbinary
MD5:67AAA5591B515F777C60AFBA425A9CEE
SHA256:FEC46F586994F181CA548D986CB047CEF452E33AF313B28F6A9DC24E4F74ED2A
2220Unlock856.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\get[1].htmbinary
MD5:67AAA5591B515F777C60AFBA425A9CEE
SHA256:FEC46F586994F181CA548D986CB047CEF452E33AF313B28F6A9DC24E4F74ED2A
3016build2.exeC:\ProgramData\05313262570261742217000245 —
MD5:—
SHA256:—
2748Unlock856.exeC:\Users\admin\AppData\Local\Temp\Cab4231.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2748Unlock856.exeC:\Users\admin\AppData\Local\d32b6c53-efe7-4465-8cbe-6023ff52edb4\Unlock856.exeexecutable
MD5:5C03743F13DE536A0787C5D90FD96EAE
SHA256:0B5B173442717540EAFB8319B62AAA98AA3C222EAAE1EBC49A712F7B6DC9BCAF
2748Unlock856.exeC:\Users\admin\AppData\Local\Temp\Tar4232.tmpbinary
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
2220Unlock856.exeC:\SystemID\PersonalID.txttext
MD5:F2750B1FC3E95B1B406AE31BC94B96A1
SHA256:E06C9B06A1A06DC5422A1A54FE8C185D08733FD8B96900C4DABDE3F97157611A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
5
Threats
239

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3016
build2.exe
GET
—
49.12.115.154:8333
http://49.12.115.154:8333/config.zip
DE
—
—
malicious
2748
Unlock856.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5815ae41b77e7315
US
compressed
62.3 Kb
whitelisted
3016
build2.exe
GET
200
49.12.115.154:8333
http://49.12.115.154:8333/9dfa7ee730fa2f1efb5ed51dbbec22f5
DE
text
213 b
malicious
3016
build2.exe
POST
—
49.12.115.154:8333
http://49.12.115.154:8333/
DE
—
—
malicious
2220
Unlock856.exe
GET
200
211.119.84.111:80
http://colisumy.com/dl/build2.exe
KR
executable
379 Kb
malicious
2220
Unlock856.exe
GET
200
211.171.233.129:80
http://zexeq.com/test1/get.php?pid=D2A34488191DA742578166D02E2C8607&first=true
KR
binary
560 b
malicious
2220
Unlock856.exe
GET
200
211.171.233.129:80
http://zexeq.com/files/1/build3.exe
KR
executable
9.50 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3016
build2.exe
49.12.115.154:8333
—
Hetzner Online GmbH
DE
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2748
Unlock856.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
2748
Unlock856.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2220
Unlock856.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
3016
build2.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
malicious
2220
Unlock856.exe
211.171.233.129:80
colisumy.com
LG DACOM Corporation
KR
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
2220
Unlock856.exe
211.119.84.111:80
colisumy.com
LG DACOM Corporation
KR
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 162.0.217.254
shared
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
colisumy.com
  • 211.119.84.111
  • 175.126.109.15
  • 95.107.163.44
  • 84.224.88.101
  • 190.229.19.7
  • 211.171.233.129
  • 210.182.29.70
  • 201.124.33.177
  • 211.40.39.251
  • 211.171.233.126
malicious
zexeq.com
  • 211.171.233.129
  • 211.119.84.111
  • 37.34.248.24
  • 187.212.201.145
  • 84.224.88.101
  • 201.124.33.177
  • 190.229.19.7
  • 210.182.29.70
  • 175.126.109.15
  • 211.171.233.126
malicious
t.me
  • 149.154.167.99
whitelisted

Threats

PID
Process
Class
Message
328
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2748
Unlock856.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
2220
Unlock856.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
2220
Unlock856.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
2220
Unlock856.exe
A Network Trojan was detected
ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
2220
Unlock856.exe
A Network Trojan was detected
ET MALWARE Win32/Vodkagats Loader Requesting Payload
2220
Unlock856.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
2220
Unlock856.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
2220
Unlock856.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
2220
Unlock856.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Unlock856.exe