File name:

Ana.exe

Full analysis: https://app.any.run/tasks/b7568165-57e7-40a4-8597-eb7db0630e8a
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 16, 2023, 17:12:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ponmocup
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F571FACA510BFFE809C76C1828D44523

SHA1:

7A3CA1660F0A513316B8CD5496AC7DBE82F0E0C2

SHA256:

117D7AF0DEB40B3FE532BB6CBE374884FA55ED7CFE053FE698720CDCCB5A59CB

SSDEEP:

49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoyS:OxPUDQmso0NuBZlnCItMq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Ana.exe (PID: 1776)
      • SB.EXE (PID: 2016)
      • setup2507764480.exe (PID: 632)
      • DB.EXE (PID: 2300)
      • AV2.EXE (PID: 864)

    • Creates a writable file in the system directory

      • DB.EXE (PID: 2300)

    • Connects to the CnC server

      • DB.EXE (PID: 2300)
      • DB.EXE (PID: 324)
      • AV2.EXE (PID: 864)

    • PONMOCUP has been detected (SURICATA)

      • DB.EXE (PID: 2300)
      • DB.EXE (PID: 324)

    • Changes the autorun value in the registry

      • kG17766LgChN17766.exe (PID: 2320)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Ana.exe (PID: 1776)
      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 324)
      • SB.EXE (PID: 2016)
      • DB.EXE (PID: 2300)
      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Reads the BIOS version

      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)

    • Starts itself from another location

      • SB.EXE (PID: 2016)

    • Executing commands from a ".bat" file

      • DB.EXE (PID: 2300)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 2620)

    • Starts CMD.EXE for commands execution

      • DB.EXE (PID: 2300)
      • EN.EXE (PID: 2204)

    • Application launched itself

      • DB.EXE (PID: 324)

    • Connects to the server without a host name

      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 2184)
      • Ana.exe (PID: 1776)
      • DB.EXE (PID: 324)
      • dw20.exe (PID: 1624)
      • SB.EXE (PID: 2016)
      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 2300)
      • setup2507764480.exe (PID: 632)
      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2184)
      • Ana.exe (PID: 1776)
      • AV.EXE (PID: 392)
      • AV2.EXE (PID: 864)
      • DB.EXE (PID: 324)
      • EN.EXE (PID: 2204)
      • SB.EXE (PID: 2016)
      • dw20.exe (PID: 1624)
      • setup2507764480.exe (PID: 632)
      • DB.EXE (PID: 2300)
      • kG17766LgChN17766.exe (PID: 2320)

    • Create files in a temporary directory

      • Ana.exe (PID: 1776)
      • SB.EXE (PID: 2016)
      • AV.EXE (PID: 392)
      • setup2507764480.exe (PID: 632)
      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 2300)
      • AV2.EXE (PID: 864)

    • Reads Windows Product ID

      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)

    • Reads the machine GUID from the registry

      • EN.EXE (PID: 2204)
      • AV.EXE (PID: 392)
      • DB.EXE (PID: 324)
      • AV2.EXE (PID: 864)
      • DB.EXE (PID: 2300)
      • kG17766LgChN17766.exe (PID: 2320)
      • dw20.exe (PID: 1624)

    • Process checks are UAC notifies on

      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)

    • Checks proxy server information

      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)
      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Creates files in the program directory

      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Creates files or folders in the user directory

      • dw20.exe (PID: 1624)

    • Manual execution by a user

      • SndVol.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (31.2)
.exe | UPX compressed Win32 Executable (27)
.exe | Win32 EXE Yoda's Crypter (26.5)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:07:03 11:05:04+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 31232
InitializedDataSize: 2141696
UninitializedDataSize: -
EntryPoint: 0x3248
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
16
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start ana.exe av.exe av2.exe #PONMOCUP db.exe en.exe no specs sb.exe no specs dw20.exe no specs setup2507764480.exe no specs #PONMOCUP db.exe setup2507764480.exe rundll32.exe no specs cmd.exe no specs kg17766lgchn17766.exe sndvol.exe no specs cmd.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Users\admin\AppData\Local\Temp\DB.EXE" C:\Users\admin\AppData\Local\Temp\DB.EXE
Ana.exe
User:
admin
Company:
Prjfeusek Vdceboszrya
Integrity Level:
MEDIUM
Description:
Internet Connection Wizard
Exit code:
0
Version:
6.00.3790.3959 (srv03_sp2_rtm.070216-1710)
Modules
Images
c:\users\admin\appdata\local\temp\db.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
392"C:\Users\admin\AppData\Local\Temp\AV.EXE" C:\Users\admin\AppData\Local\Temp\AV.EXE
Ana.exe
User:
admin
Company:
Realtek Inc
Integrity Level:
MEDIUM
Description:
Realtek Audio Driver
Exit code:
3762507597
Version:
2.0.5.0
Modules
Images
c:\users\admin\appdata\local\temp\av.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
632"C:\Users\admin\AppData\Local\Temp\setup2507764480.exe" C:\Users\admin\AppData\Local\Temp\setup2507764480.exe
SB.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup2507764480.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
864"C:\Users\admin\AppData\Local\Temp\AV2.EXE" C:\Users\admin\AppData\Local\Temp\AV2.EXE
Ana.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\av2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
880SndVol.exe -f 45810791 8878C:\Windows\System32\SndVol.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Volume Mixer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sndvol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1624dw20.exe -x -s 436C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe—AV.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1776"C:\Users\admin\AppData\Local\Temp\Ana.exe" C:\Users\admin\AppData\Local\Temp\Ana.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ana.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1808"C:\Users\admin\AppData\Local\Temp\setup2507764480.exe" C:\Users\admin\AppData\Local\Temp\setup2507764480.exe—SB.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\setup2507764480.exe
c:\windows\system32\ntdll.dll
2016"C:\Users\admin\AppData\Local\Temp\SB.EXE" C:\Users\admin\AppData\Local\Temp\SB.EXE—Ana.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2184"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 950
Read events
4 583
Write events
366
Delete events
1

Modification events

(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(324) DB.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(324) DB.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
15
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1776Ana.exeC:\Users\admin\AppData\Local\Temp\GB.EXEexecutable
MD5:FE731B4C6684D643EB5B55613EF9ED31
SHA256:E7953DAAD7A68F8634DED31A21A31F0C2AA394CA9232E2F980321F7B69176496
1776Ana.exeC:\Users\admin\AppData\Local\Temp\AV.EXEexecutable
MD5:F284568010505119F479617A2E7DC189
SHA256:26C8F13EA8DC17443A9FA005610537CB6700AEBAF748E747E9278D504E416EB1
632setup2507764480.exeC:\Users\admin\AppData\Local\Temp\FBF4.tmpexecutable
MD5:9252E1BE9776AF202D6AD5C093637022
SHA256:CE822FF86E584F15B6ABD14C61453BD3B481D4EC3FDEB961787FCEB52ACD8BD6
1624dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_av.exe_bebff19cf845587bb44e6beb0e283247b493ae_0656217e\Report.wer —
MD5:—
SHA256:—
632setup2507764480.exeC:\Users\admin\AppData\Local\Temp\FD4E.tmpexecutable
MD5:9252E1BE9776AF202D6AD5C093637022
SHA256:CE822FF86E584F15B6ABD14C61453BD3B481D4EC3FDEB961787FCEB52ACD8BD6
864AV2.EXEC:\ProgramData\kG17766LgChN17766\kG17766LgChN17766.exeexecutable
MD5:014578EDB7DA99E5BA8DD84F5D26DFD5
SHA256:4CE5E8B510895ABB204F97E883D8CBAACC29CCEF0844D9AE81F8666F234B0529
864AV2.EXEC:\Users\admin\AppData\Local\Temp\AV2binary
MD5:580565BADA5193329A23BC8CDC3DB163
SHA256:2499E3BD4EC49BB1204F5F93DB9B161E151B1380A57134DD4AB5958D16B7633E
2300DB.EXEC:\Users\admin\AppData\Local\Temp\~unins6906.battext
MD5:9E0A2F5AB30517809B95A1FF1DD98C53
SHA256:97AC9FEE75A1F7B63B3115E9C4FB9DDA80B1CABA26D2FB51325670DEE261FE32
632setup2507764480.exeC:\Users\admin\AppData\Local\Temp\FBF5.tmpexecutable
MD5:E670CDD55B7BA36F96B0C7B9A0E27E16
SHA256:C1CB673B1CA6734C7C9EC126AA43C0C2E346AC94D4E7BD6545E1066107A3B703
1776Ana.exeC:\Users\admin\AppData\Local\Temp\EN.EXEexecutable
MD5:621F2279F69686E8547E476B642B6C46
SHA256:C17A18CF2C243303B8A6688AAD83B3E6E9B727FCD89F69065785EF7F1A2A3E38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
5
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
324
DB.EXE
GET
404
66.96.162.135:80
http://middlechrist.com/html/license_43EC922A3D0E1F403834ED436BA90C5A686E606FE2C68C471C1BE02D93514A733C47010286CE9159E8D69FE5469D45CA6C2FF9970E4D13204AFCEB8A1C5A9D2924CF3F64589D6F496DBB75D0E9738A14A6ABC664F6BC84AF1B5B4824A007F3AB85586DDE358DDF896807EF01B144D84BB2350EB808C931B4CE0A49B1E66EA14150BC2975E85C46787E735D90A4A5AF724148C5DE8210352C78091FE5FA59B3FCA76E237593366C3FDCE3427F6D815149E38ACDBE8C4949D57D50D1D6C8B71E1077D08BDB8956B2F211E0DE11DD1F89B1F7A839823456F0461BB9697C1860FD5B19C65B8AD7A83E8379B43CCD406389BA07A85C692738E5951982A0FF89C4479A234F9C45617DC7E5C5ED5B9EBE9E00BC26E8F5E7A861DCE3EF04C356C8FF75989BCD04C4D5CC1744C3A3A52015C1F9CAB238A9B900A26DE3AAE1950D1FEA125262E3AA5A332F08A478569C81E332693ABDDE97379A8DADE309129D193AFF4EDC36B0A70FB5A42F5F6EB88BC18F5F34C10964.html
unknown
html
867 b
unknown
2300
DB.EXE
GET
404
66.96.162.135:80
http://middlechrist.com/html/license_43EC922A3D0E1F403834ED436BA90C5A686E606FE2C68C471C1BE02D93514A733C47010286CE9159E8D69FE5469C45CA6C2FF8970E4D13204AFCEA8A1C5A9D2924CF3F64589D6F496DB474D2E9738A1DF4FCC664F6BC84AF1B5B4824A007F3AB85586DDE358DDF896807EF01B144D84BB2350EB808C931B4CE0A49B1E66EA1425EE82975E85C46787E735D90A4A5AF724148C5DE8210352C78091FE5FA59B3FCA76E237593366C3FDCE3427F6D815149E38ACDBE8C4949D57D50D1D6C8B71E10228AD9DB8956B2F211E0DE11DD4AD3E3F7A839823456F0461BB9697C1860FD5B19C65B8AD7A83E8379B43CCD406389BA07A85C692738E5951982A0FF89C4479A234F9C45617DC7E5C5EC5B9EBE9E00BC26E8F5E7A861DCE3EF04C356C8FF75989BCD04C4D5CC1744C3A3A52015C9EF93BF4BD8B10AB147EEAF93E9716C9A1B27609FD72E39527AA07058EFFD9E4B6F4CBFDAE336E187DDE60914916B37F947AC30B6D57FC1AE2E2819CEF9B18E4D01FC01622E675B1E0EB56813FF28836AA5B8A7845A67B5CA826CD5691319A7E0795E0ABD6F0AABD65F2AA8401DA6B6B49D6C599C89B4BC627A77C19D14078F1E660CC8829279468B418FD28DAF5C2EE80F88DE813861CEFFB87FDC22FB1D62C076860CD14062A290C78757BB00FE0B6101E099679D1599B50E4EEF1DD66C748226247A43D50FF1A2A169BFF6001F1274CE0247F20B9D2E7A5371AF807805E6028B4285B9C3D9BFAA8B14C6E2FB32AEF0F656183266906D1F8AD8E300521BE5B51B377162D1A5C769741F97F5096A71F738858136547B9EAF2AA512E6C8FD451B0F4426F718F887F69B74C3E762.html
unknown
html
867 b
unknown
864
AV2.EXE
GET
401
178.162.174.147:80
http://178.162.174.147/api/urls/?affid=17766
unknown
html
590 b
unknown
2320
kG17766LgChN17766.exe
GET
401
178.162.174.147:80
http://178.162.174.147/api/stats/install/1007/17766
unknown
html
590 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
2300
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
864
AV2.EXE
178.162.174.147:80
—
LeaseWeb Netherlands B.V.
NL
unknown
2320
kG17766LgChN17766.exe
178.162.174.147:80
—
LeaseWeb Netherlands B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
middlechrist.com
  • 66.96.162.135
unknown
aeravine.com
  • —
unknown
bemachin.com
  • —
unknown

Threats

PID
Process
Class
Message
324
DB.EXE
A Network Trojan was detected
ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
324
DB.EXE
Malware Command and Control Activity Detected
ET MALWARE Ponmocup C2 Post-infection Checkin
2300
DB.EXE
Malware Command and Control Activity Detected
ET MALWARE Ponmocup C2 Post-infection Checkin
2300
DB.EXE
A Network Trojan was detected
ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
3 ETPRO signatures available at the full report
Process
Message
Ana.exe
C:\Users\admin\AppData\Local\Temp\AV.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\AV2.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\DB.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\EN.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\GB.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\SB.EXE
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ana.exe