File name:

Ana.exe

Full analysis: https://app.any.run/tasks/b7568165-57e7-40a4-8597-eb7db0630e8a
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 16, 2023, 17:12:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ponmocup
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F571FACA510BFFE809C76C1828D44523

SHA1:

7A3CA1660F0A513316B8CD5496AC7DBE82F0E0C2

SHA256:

117D7AF0DEB40B3FE532BB6CBE374884FA55ED7CFE053FE698720CDCCB5A59CB

SSDEEP:

49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoyS:OxPUDQmso0NuBZlnCItMq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Ana.exe (PID: 1776)
      • SB.EXE (PID: 2016)
      • AV2.EXE (PID: 864)
      • DB.EXE (PID: 2300)
      • setup2507764480.exe (PID: 632)

    • Creates a writable file in the system directory

      • DB.EXE (PID: 2300)

    • Connects to the CnC server

      • DB.EXE (PID: 2300)
      • DB.EXE (PID: 324)
      • AV2.EXE (PID: 864)

    • PONMOCUP has been detected (SURICATA)

      • DB.EXE (PID: 2300)
      • DB.EXE (PID: 324)

    • Changes the autorun value in the registry

      • kG17766LgChN17766.exe (PID: 2320)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Ana.exe (PID: 1776)
      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 324)
      • SB.EXE (PID: 2016)
      • DB.EXE (PID: 2300)
      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Reads the BIOS version

      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)

    • Starts itself from another location

      • SB.EXE (PID: 2016)

    • Application launched itself

      • DB.EXE (PID: 324)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 2620)

    • Starts CMD.EXE for commands execution

      • DB.EXE (PID: 2300)
      • EN.EXE (PID: 2204)

    • Executing commands from a ".bat" file

      • DB.EXE (PID: 2300)

    • Connects to the server without a host name

      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

  • INFO

    • Checks supported languages

      • Ana.exe (PID: 1776)
      • AV.EXE (PID: 392)
      • wmpnscfg.exe (PID: 2184)
      • AV2.EXE (PID: 864)
      • DB.EXE (PID: 324)
      • EN.EXE (PID: 2204)
      • SB.EXE (PID: 2016)
      • dw20.exe (PID: 1624)
      • DB.EXE (PID: 2300)
      • setup2507764480.exe (PID: 632)
      • kG17766LgChN17766.exe (PID: 2320)

    • Reads the computer name

      • Ana.exe (PID: 1776)
      • wmpnscfg.exe (PID: 2184)
      • DB.EXE (PID: 324)
      • EN.EXE (PID: 2204)
      • dw20.exe (PID: 1624)
      • SB.EXE (PID: 2016)
      • AV2.EXE (PID: 864)
      • DB.EXE (PID: 2300)
      • setup2507764480.exe (PID: 632)
      • kG17766LgChN17766.exe (PID: 2320)

    • Create files in a temporary directory

      • Ana.exe (PID: 1776)
      • AV.EXE (PID: 392)
      • SB.EXE (PID: 2016)
      • setup2507764480.exe (PID: 632)
      • AV2.EXE (PID: 864)
      • DB.EXE (PID: 2300)
      • EN.EXE (PID: 2204)

    • Reads Windows Product ID

      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)

    • Process checks are UAC notifies on

      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)

    • Checks proxy server information

      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 324)
      • DB.EXE (PID: 2300)
      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Reads the machine GUID from the registry

      • EN.EXE (PID: 2204)
      • DB.EXE (PID: 324)
      • AV.EXE (PID: 392)
      • DB.EXE (PID: 2300)
      • kG17766LgChN17766.exe (PID: 2320)
      • AV2.EXE (PID: 864)
      • dw20.exe (PID: 1624)

    • Creates files in the program directory

      • AV2.EXE (PID: 864)
      • kG17766LgChN17766.exe (PID: 2320)

    • Creates files or folders in the user directory

      • dw20.exe (PID: 1624)

    • Manual execution by a user

      • SndVol.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (31.2)
.exe | UPX compressed Win32 Executable (27)
.exe | Win32 EXE Yoda's Crypter (26.5)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:07:03 11:05:04+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 31232
InitializedDataSize: 2141696
UninitializedDataSize: -
EntryPoint: 0x3248
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
16
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start ana.exe av.exe av2.exe #PONMOCUP db.exe en.exe no specs sb.exe no specs dw20.exe no specs setup2507764480.exe no specs #PONMOCUP db.exe setup2507764480.exe rundll32.exe no specs cmd.exe no specs kg17766lgchn17766.exe sndvol.exe no specs cmd.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Users\admin\AppData\Local\Temp\DB.EXE" C:\Users\admin\AppData\Local\Temp\DB.EXE
Ana.exe
User:
admin
Company:
Prjfeusek Vdceboszrya
Integrity Level:
MEDIUM
Description:
Internet Connection Wizard
Exit code:
0
Version:
6.00.3790.3959 (srv03_sp2_rtm.070216-1710)
Modules
Images
c:\users\admin\appdata\local\temp\db.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
392"C:\Users\admin\AppData\Local\Temp\AV.EXE" C:\Users\admin\AppData\Local\Temp\AV.EXE
Ana.exe
User:
admin
Company:
Realtek Inc
Integrity Level:
MEDIUM
Description:
Realtek Audio Driver
Exit code:
3762507597
Version:
2.0.5.0
Modules
Images
c:\users\admin\appdata\local\temp\av.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
632"C:\Users\admin\AppData\Local\Temp\setup2507764480.exe" C:\Users\admin\AppData\Local\Temp\setup2507764480.exe
SB.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup2507764480.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
864"C:\Users\admin\AppData\Local\Temp\AV2.EXE" C:\Users\admin\AppData\Local\Temp\AV2.EXE
Ana.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\av2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
880SndVol.exe -f 45810791 8878C:\Windows\System32\SndVol.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Volume Mixer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sndvol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1624dw20.exe -x -s 436C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe—AV.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1776"C:\Users\admin\AppData\Local\Temp\Ana.exe" C:\Users\admin\AppData\Local\Temp\Ana.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ana.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1808"C:\Users\admin\AppData\Local\Temp\setup2507764480.exe" C:\Users\admin\AppData\Local\Temp\setup2507764480.exe—SB.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\setup2507764480.exe
c:\windows\system32\ntdll.dll
2016"C:\Users\admin\AppData\Local\Temp\SB.EXE" C:\Users\admin\AppData\Local\Temp\SB.EXE—Ana.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2184"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 950
Read events
4 583
Write events
366
Delete events
1

Modification events

(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1776) Ana.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(324) DB.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(324) DB.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2204) EN.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
15
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1776Ana.exeC:\Users\admin\AppData\Local\Temp\DB.EXEexecutable
MD5:C6746A62FEAFCB4FCA301F606F7101FA
SHA256:B5A255D0454853C8AFC0B321E1D86DCA22C3DBEFB88E5D385D2D72F9BC0109E6
1776Ana.exeC:\Users\admin\AppData\Local\Temp\SB.EXEexecutable
MD5:9252E1BE9776AF202D6AD5C093637022
SHA256:CE822FF86E584F15B6ABD14C61453BD3B481D4EC3FDEB961787FCEB52ACD8BD6
2300DB.EXEC:\Windows\system32\perfd009U.dllexecutable
MD5:F32F3CBCC773852AB6DE674279CD1E4C
SHA256:C7824B2DC303B662D0FB22BC583CE733F88555E9BAABABBDB52FFD7B64C7F013
1624dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_av.exe_bebff19cf845587bb44e6beb0e283247b493ae_0656217e\Report.wer —
MD5:—
SHA256:—
2016SB.EXEC:\Users\admin\AppData\Local\Temp\F79F.tmpexecutable
MD5:9252E1BE9776AF202D6AD5C093637022
SHA256:CE822FF86E584F15B6ABD14C61453BD3B481D4EC3FDEB961787FCEB52ACD8BD6
1776Ana.exeC:\Users\admin\AppData\Local\Temp\GB.EXEexecutable
MD5:FE731B4C6684D643EB5B55613EF9ED31
SHA256:E7953DAAD7A68F8634DED31A21A31F0C2AA394CA9232E2F980321F7B69176496
392AV.EXEC:\Users\admin\AppData\Local\Temp\tsa.crttext
MD5:6E630504BE525E953DEBD0CE831B9AA0
SHA256:2563FE2F793F119A1BAE5CCA6EAB9D8C20409AA1F1E0DB341C623E1251244EF5
2016SB.EXEC:\Users\admin\AppData\Local\Temp\FADD.tmpexecutable
MD5:9252E1BE9776AF202D6AD5C093637022
SHA256:CE822FF86E584F15B6ABD14C61453BD3B481D4EC3FDEB961787FCEB52ACD8BD6
2016SB.EXEC:\Users\admin\AppData\Local\Temp\F7B0.tmpexecutable
MD5:E670CDD55B7BA36F96B0C7B9A0E27E16
SHA256:C1CB673B1CA6734C7C9EC126AA43C0C2E346AC94D4E7BD6545E1066107A3B703
1776Ana.exeC:\Users\admin\AppData\Local\Temp\AV2.EXEexecutable
MD5:014578EDB7DA99E5BA8DD84F5D26DFD5
SHA256:4CE5E8B510895ABB204F97E883D8CBAACC29CCEF0844D9AE81F8666F234B0529
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
5
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2300
DB.EXE
GET
404
66.96.162.135:80
http://middlechrist.com/html/license_43EC922A3D0E1F403834ED436BA90C5A686E606FE2C68C471C1BE02D93514A733C47010286CE9159E8D69FE5469C45CA6C2FF8970E4D13204AFCEA8A1C5A9D2924CF3F64589D6F496DB474D2E9738A1DF4FCC664F6BC84AF1B5B4824A007F3AB85586DDE358DDF896807EF01B144D84BB2350EB808C931B4CE0A49B1E66EA1425EE82975E85C46787E735D90A4A5AF724148C5DE8210352C78091FE5FA59B3FCA76E237593366C3FDCE3427F6D815149E38ACDBE8C4949D57D50D1D6C8B71E10228AD9DB8956B2F211E0DE11DD4AD3E3F7A839823456F0461BB9697C1860FD5B19C65B8AD7A83E8379B43CCD406389BA07A85C692738E5951982A0FF89C4479A234F9C45617DC7E5C5EC5B9EBE9E00BC26E8F5E7A861DCE3EF04C356C8FF75989BCD04C4D5CC1744C3A3A52015C9EF93BF4BD8B10AB147EEAF93E9716C9A1B27609FD72E39527AA07058EFFD9E4B6F4CBFDAE336E187DDE60914916B37F947AC30B6D57FC1AE2E2819CEF9B18E4D01FC01622E675B1E0EB56813FF28836AA5B8A7845A67B5CA826CD5691319A7E0795E0ABD6F0AABD65F2AA8401DA6B6B49D6C599C89B4BC627A77C19D14078F1E660CC8829279468B418FD28DAF5C2EE80F88DE813861CEFFB87FDC22FB1D62C076860CD14062A290C78757BB00FE0B6101E099679D1599B50E4EEF1DD66C748226247A43D50FF1A2A169BFF6001F1274CE0247F20B9D2E7A5371AF807805E6028B4285B9C3D9BFAA8B14C6E2FB32AEF0F656183266906D1F8AD8E300521BE5B51B377162D1A5C769741F97F5096A71F738858136547B9EAF2AA512E6C8FD451B0F4426F718F887F69B74C3E762.html
unknown
html
867 b
unknown
324
DB.EXE
GET
404
66.96.162.135:80
http://middlechrist.com/html/license_43EC922A3D0E1F403834ED436BA90C5A686E606FE2C68C471C1BE02D93514A733C47010286CE9159E8D69FE5469D45CA6C2FF9970E4D13204AFCEB8A1C5A9D2924CF3F64589D6F496DBB75D0E9738A14A6ABC664F6BC84AF1B5B4824A007F3AB85586DDE358DDF896807EF01B144D84BB2350EB808C931B4CE0A49B1E66EA14150BC2975E85C46787E735D90A4A5AF724148C5DE8210352C78091FE5FA59B3FCA76E237593366C3FDCE3427F6D815149E38ACDBE8C4949D57D50D1D6C8B71E1077D08BDB8956B2F211E0DE11DD1F89B1F7A839823456F0461BB9697C1860FD5B19C65B8AD7A83E8379B43CCD406389BA07A85C692738E5951982A0FF89C4479A234F9C45617DC7E5C5ED5B9EBE9E00BC26E8F5E7A861DCE3EF04C356C8FF75989BCD04C4D5CC1744C3A3A52015C1F9CAB238A9B900A26DE3AAE1950D1FEA125262E3AA5A332F08A478569C81E332693ABDDE97379A8DADE309129D193AFF4EDC36B0A70FB5A42F5F6EB88BC18F5F34C10964.html
unknown
html
867 b
unknown
2320
kG17766LgChN17766.exe
GET
401
178.162.174.147:80
http://178.162.174.147/api/stats/install/1007/17766
unknown
html
590 b
unknown
864
AV2.EXE
GET
401
178.162.174.147:80
http://178.162.174.147/api/urls/?affid=17766
unknown
html
590 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
2300
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
864
AV2.EXE
178.162.174.147:80
—
LeaseWeb Netherlands B.V.
NL
unknown
2320
kG17766LgChN17766.exe
178.162.174.147:80
—
LeaseWeb Netherlands B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
middlechrist.com
  • 66.96.162.135
unknown
aeravine.com
  • —
unknown
bemachin.com
  • —
unknown

Threats

PID
Process
Class
Message
324
DB.EXE
A Network Trojan was detected
ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
324
DB.EXE
Malware Command and Control Activity Detected
ET MALWARE Ponmocup C2 Post-infection Checkin
2300
DB.EXE
Malware Command and Control Activity Detected
ET MALWARE Ponmocup C2 Post-infection Checkin
2300
DB.EXE
A Network Trojan was detected
ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
3 ETPRO signatures available at the full report
Process
Message
Ana.exe
C:\Users\admin\AppData\Local\Temp\AV.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\AV2.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\DB.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\EN.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\GB.EXE
Ana.exe
C:\Users\admin\AppData\Local\Temp\SB.EXE
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ana.exe