analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://dramacool.ec/

Full analysis: https://app.any.run/tasks/bc3e5bac-9b71-49a1-9240-672ffbcad91c
Verdict: Malicious activity
Analysis date: June 27, 2022, 11:22:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D90E521E9D20EDC19F4E13D14E86BC31

SHA1:

0755B0EFB8AF3872288AEC2768972F7DCEAD3C83

SHA256:

2988D025CBDCD25EE52C423E907B69A98B6B1D28B2D119A2294C15E37842A744

SSDEEP:

3:N1KaXAKJLAGK:CaXAS0GK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3320)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3320)
      • iexplore.exe (PID: 2952)

    • Reads the computer name

      • iexplore.exe (PID: 2952)
      • iexplore.exe (PID: 3320)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3320)
      • iexplore.exe (PID: 2952)

    • Application launched itself

      • iexplore.exe (PID: 2952)

    • Changes internet zones settings

      • iexplore.exe (PID: 2952)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2952)
      • iexplore.exe (PID: 3320)

    • Creates files in the user directory

      • iexplore.exe (PID: 3320)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2952"C:\Program Files\Internet Explorer\iexplore.exe" "http://dramacool.ec/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3320"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2952 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
16 650
Read events
16 492
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
26
Text files
86
Unknown types
19

Dropped files

PID
Process
Filename
Type
3320iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:97ACEA6306CD2B5963685F66C86BC629
SHA256:D109E4708523F4B31133F1ABBA7A6E62720B4C97C079DB45F1F4DFC69A50F9A1
3320iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:FC887F7C5EF1EEAE3FB3BA651F77AC36
SHA256:5F98609231B96FC1ECFEFF757089F66D6A74BBE8FED6B33D83A799790484AA56
2952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:577BCF8B5C67A39E82C5AE52D4D71989
SHA256:A980949A1155439B8DF0F53AC037BDE7C4074C02B7FFFC7E24A1DDA8EAF3559F
3320iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:07A3A5E89376460AEB2223958BD9D4A8
SHA256:4EDADBA4FEDC32FD81605DDFFB309943831C916EE25A0631580ECA8BF968CFA8
3320iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\front.style[1].csstext
MD5:306BF033E260A6B9F9BE7755A9264103
SHA256:4C47D937E0708B2790AAA265422D9F4A82854BC5A1B52A8518A91A26EE35629F
3320iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\00BZ0HYY.htmhtml
MD5:EDAAE3F723877A59D3BC74AF764C60B8
SHA256:1D13AF216AC5CB9D3C458FC63A18B082E6215128817D2DD443C8D17C7D9C8EDD
3320iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6RSG4IRH.txttext
MD5:95E714FCF0A3994D4B97DE88C2FCCC74
SHA256:2C8A77B85548649F54AA7A91216DF9EE2B6EEB03B7648E1C7BE30F2566F91B39
2952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342
SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E
3320iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3320iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\LI9HEVDNtext
MD5:FDA44910DEB1A460BE4AC5D56D61D837
SHA256:933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
74
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3320
iexplore.exe
GET
301
188.114.96.3:80
http://dramacool.ec/
US
—
—
malicious
3320
iexplore.exe
GET
200
178.79.242.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?694ef73567f84386
DE
compressed
60.0 Kb
whitelisted
3320
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3320
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEhFj8QPMDTBXdjhxO7%2F8SY%3D
US
der
471 b
whitelisted
3320
iexplore.exe
GET
200
178.79.242.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f9acc686963719fe
DE
compressed
4.70 Kb
whitelisted
3320
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
3320
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCOpTm6K2CNAuzhaSItrxjX
US
der
472 b
whitelisted
3320
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAT%2FrubUb6nOEpcsoEFY3SI%3D
US
der
471 b
whitelisted
2952
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3320
iexplore.exe
GET
200
2.16.241.8:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN52PhcxqRzCVjlMByjM01E9Q%3D%3D
unknown
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2952
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3320
iexplore.exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious
3320
iexplore.exe
139.45.197.236:443
zikroarg.com
—
US
malicious
3320
iexplore.exe
188.114.96.3:80
dramacool.ec
Cloudflare Inc
US
malicious
3320
iexplore.exe
172.217.18.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3320
iexplore.exe
188.114.96.3:443
dramacool.ec
Cloudflare Inc
US
malicious
3320
iexplore.exe
23.109.82.243:443
juntfemoral.com
—
NL
unknown
3320
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2952
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3320
iexplore.exe
139.45.195.8:443
my.rtmark.net
—
US
suspicious

DNS requests

Domain
IP
Reputation
dramacool.ec
  • 188.114.96.3
  • 188.114.97.3
malicious
ctldl.windowsupdate.com
  • 178.79.242.128
  • 95.140.236.0
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
zikroarg.com
  • 139.45.197.236
malicious
juntfemoral.com
  • 23.109.82.243
  • 23.109.248.143
  • 23.109.248.148
  • 23.109.248.133
  • 23.109.82.106
  • 23.109.82.111
  • 23.109.248.158
  • 23.109.82.195
  • 23.109.82.116
  • 23.109.82.171
  • 23.109.170.50
unknown
fonts.googleapis.com
  • 172.217.18.106
whitelisted
ocsp.usertrust.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
ocsp.sectigo.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://dramacool.ec/