| File name: | Stealer.exe |
| Full analysis: | https://app.any.run/tasks/0eb3aa7d-4ebd-4700-9103-27fce906e468 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | January 29, 2025, 08:42:26 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 41D910D583BB0000139E4BA501B85ED3 |
| SHA1: | 3F6385EBE1CFB5A9498B5A24EB18E356B4E89731 |
| SHA256: | 2BD89E81853BBC112CFEB62B676BEB0CFC741262BF9E226E15768062E6A14D6A |
| SSDEEP: | 98304:ZCconX4GslZQ7ZqTgAzRebL0r92sD7jWQtlG+eIsFlvvzj572EWfdqfhXHhHvXle:ZgRQ34DDYahd7Qa/ygQEP8S |
MALICIOUS
Adds path to the Windows Defender exclusion list
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Changes powershell execution policy (Bypass)
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Bypass execution policy to execute commands
- powershell.exe (PID: 2728)
- powershell.exe (PID: 2828)
- powershell.exe (PID: 7000)
- powershell.exe (PID: 5112)
- powershell.exe (PID: 1512)
- powershell.exe (PID: 5092)
Changes the autorun value in the registry
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Uses Task Scheduler to autorun other applications
- cmd.exe (PID: 4052)
Adds process to the Windows Defender exclusion list
- Microsoft update.exe (PID: 2744)
Uses Task Scheduler to run other applications
- Microsoft update.exe (PID: 2744)
XWORM has been detected (SURICATA)
- Microsoft update.exe (PID: 2744)
Create files in the Startup directory
- Microsoft update.exe (PID: 2744)
SUSPICIOUS
Reads security settings of Internet Explorer
- Stealer.exe (PID: 7004)
- Stealer.exe (PID: 5916)
- Anti Spyware core service.exe (PID: 2600)
- Microsoft update.exe (PID: 2744)
Reads the date of Windows installation
- Stealer.exe (PID: 7004)
- Stealer.exe (PID: 5916)
- Anti Spyware core service.exe (PID: 2600)
- Microsoft update.exe (PID: 2744)
Checks for external IP
- svchost.exe (PID: 2192)
- Stealer.exe (PID: 7004)
- Microsoft update.exe (PID: 2744)
- Stealer.exe (PID: 5916)
Application launched itself
- Stealer.exe (PID: 7004)
- CODEX17-NUKER.exe (PID: 6312)
Executable content was dropped or overwritten
- Stealer.exe (PID: 5916)
- CODEX17-NUKER.exe (PID: 6312)
- Anti Spyware core service.exe (PID: 2600)
- Microsoft update.exe (PID: 2744)
The process drops C-runtime libraries
- CODEX17-NUKER.exe (PID: 6312)
Starts POWERSHELL.EXE for commands execution
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Script adds exclusion path to Windows Defender
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Process drops legitimate windows executable
- CODEX17-NUKER.exe (PID: 6312)
Process drops python dynamic module
- CODEX17-NUKER.exe (PID: 6312)
Loads Python modules
- CODEX17-NUKER.exe (PID: 6444)
Starts CMD.EXE for commands execution
- CODEX17-NUKER.exe (PID: 6444)
- Anti Spyware core service.exe (PID: 2600)
Executing commands from a ".bat" file
- Anti Spyware core service.exe (PID: 2600)
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 4952)
The executable file from the user directory is run by the CMD process
- Anti Spyware core service.exe (PID: 6764)
Connects to unusual port
- Anti Spyware core service.exe (PID: 6764)
- Microsoft update.exe (PID: 2744)
Script adds exclusion process to Windows Defender
- Microsoft update.exe (PID: 2744)
Contacting a server suspected of hosting an CnC
- Microsoft update.exe (PID: 2744)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- Microsoft update.exe (PID: 2744)
INFO
Reads the computer name
- Stealer.exe (PID: 7004)
- Stealer.exe (PID: 5916)
- CODEX17-NUKER.exe (PID: 6312)
- Anti Spyware core service.exe (PID: 2600)
- CODEX17-NUKER.exe (PID: 6444)
- Microsoft update.exe (PID: 2744)
- Anti Spyware core service.exe (PID: 6764)
Create files in a temporary directory
- Stealer.exe (PID: 5916)
- CODEX17-NUKER.exe (PID: 6312)
- Anti Spyware core service.exe (PID: 2600)
Disables trace logs
- Stealer.exe (PID: 7004)
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Process checks computer location settings
- Stealer.exe (PID: 7004)
- Stealer.exe (PID: 5916)
- Anti Spyware core service.exe (PID: 2600)
- Microsoft update.exe (PID: 2744)
Reads Environment values
- Stealer.exe (PID: 7004)
- Microsoft update.exe (PID: 2744)
- Anti Spyware core service.exe (PID: 6764)
- Stealer.exe (PID: 5916)
Checks supported languages
- Stealer.exe (PID: 7004)
- CODEX17-NUKER.exe (PID: 6312)
- CODEX17-NUKER.exe (PID: 6444)
- Anti Spyware core service.exe (PID: 2600)
- Anti Spyware core service.exe (PID: 6764)
- Stealer.exe (PID: 5916)
- Microsoft update.exe (PID: 2744)
Reads the machine GUID from the registry
- Stealer.exe (PID: 7004)
- Anti Spyware core service.exe (PID: 2600)
- Microsoft update.exe (PID: 2744)
- Anti Spyware core service.exe (PID: 6764)
- Stealer.exe (PID: 5916)
Checks proxy server information
- Stealer.exe (PID: 7004)
- Microsoft update.exe (PID: 2744)
- Stealer.exe (PID: 5916)
The sample compiled with english language support
- CODEX17-NUKER.exe (PID: 6312)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 2728)
- powershell.exe (PID: 2828)
- powershell.exe (PID: 7000)
- powershell.exe (PID: 5112)
- powershell.exe (PID: 1512)
- powershell.exe (PID: 5092)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 2728)
- powershell.exe (PID: 2828)
- powershell.exe (PID: 7000)
- powershell.exe (PID: 5112)
- powershell.exe (PID: 1512)
- powershell.exe (PID: 5092)
Creates files or folders in the user directory
- Anti Spyware core service.exe (PID: 2600)
- Microsoft update.exe (PID: 2744)
PyInstaller has been detected (YARA)
- CODEX17-NUKER.exe (PID: 6312)
- CODEX17-NUKER.exe (PID: 6444)
Reads the software policy settings
- Microsoft update.exe (PID: 2744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:01:28 18:18:53+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 10478080 |
| InitializedDataSize: | 229376 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa0000e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 1.0.0.0 |
| InternalName: | binded.exe |
| LegalCopyright: | |
| OriginalFileName: | binded.exe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
148
Monitored processes
30
Malicious processes
6
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 624 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1156 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1512 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming\Microsoft update' | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Microsoft update.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1876 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2076 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2600 | "C:\WINDOWS\System32\Anti Spyware core service.exe" | C:\Windows\System32\Anti Spyware core service.exe | Stealer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 3.6.0.0 Modules
| |||||||||||||||
| 2728 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\WINDOWS\System32\Anti Spyware core service.exe' | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Stealer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2744 | "C:\WINDOWS\System32\Microsoft update.exe" | C:\Windows\System32\Microsoft update.exe | Stealer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Version: 1.0.0.0 Modules
| |||||||||||||||
| 2828 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\WINDOWS\System32\Microsoft update.exe' | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Stealer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
44 585
Read events
44 554
Write events
31
Delete events
0
Modification events
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7004) Stealer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stealer_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
74
Suspicious files
3
Text files
18
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\VCRUNTIME140.dll | executable | |
MD5:BE8DBE2DC77EBE7F88F910C61AEC691A | SHA256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83 | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\_decimal.pyd | executable | |
MD5:7AE94F5A66986CBC1A2B3C65A8D617F3 | SHA256:DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4 | |||
| 2728 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fehtligo.iw1.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\_multiprocessing.pyd | executable | |
MD5:41EE16713672E1BFC4543E6AE7588D72 | SHA256:2FEB0BF9658634FE8405F17C4573FEB1C300E9345D7965738BEDEB871A939E6B | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\_ctypes.pyd | executable | |
MD5:5377AB365C86BBCDD998580A79BE28B4 | SHA256:6C5F31BEF3FDBFF31BEAC0B1A477BE880DDA61346D859CF34CA93B9291594D93 | |||
| 5916 | Stealer.exe | C:\Users\admin\AppData\Local\Temp\CODEX17-NUKER.exe | executable | |
MD5:5DAC10034E3063E8BAB9E3B24B109FCF | SHA256:DA6066F78DE8A5EB976F62ABDF2F0080514A187868DDDA11354EA98E058FB6DE | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\_bz2.pyd | executable | |
MD5:30F396F8411274F15AC85B14B7B3CD3D | SHA256:CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\VCRUNTIME140_1.dll | executable | |
MD5:F8DFA78045620CF8A732E67D1B1EB53D | SHA256:A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5 | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\_hashlib.pyd | executable | |
MD5:A25BC2B21B555293554D7F611EAA75EA | SHA256:43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D | |||
| 6312 | CODEX17-NUKER.exe | C:\Users\admin\AppData\Local\Temp\_MEI63122\_uuid.pyd | executable | |
MD5:D8C6D60EA44694015BA6123FF75BD38D | SHA256:8AE23BFA84CE64C3240C61BEDB06172BFD76BE2AD30788D4499CB24047FCE09F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
72
DNS requests
16
Threats
14
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7004 | Stealer.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
5916 | Stealer.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
2744 | Microsoft update.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
— | — | GET | 304 | 52.149.20.212:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
— | — | GET | 200 | 52.149.20.212:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
— | — | POST | 403 | 23.35.229.160:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | unknown | — | — | whitelisted |
— | — | POST | 200 | 40.126.32.140:443 | https://login.live.com/RST2.srf | unknown | xml | 1.24 Kb | whitelisted |
— | — | POST | 400 | 40.126.32.68:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
— | — | POST | 403 | 23.35.229.160:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | unknown | — | — | whitelisted |
6908 | SIHClient.exe | GET | 200 | 184.30.230.103:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.21.65.153:443 | — | Akamai International B.V. | NL | unknown |
— | — | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 184.28.89.167:443 | go.microsoft.com | AKAMAI-AS | US | whitelisted |
1176 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1076 | svchost.exe | 184.28.89.167:443 | go.microsoft.com | AKAMAI-AS | US | whitelisted |
7004 | Stealer.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | shared |
5916 | Stealer.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | shared |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
login.live.com |
| whitelisted |
google.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
ip-api.com |
| shared |
slscr.update.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
api.telegram.org |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
2192 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
7004 | Stealer.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |
7004 | Stealer.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
5916 | Stealer.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |
5916 | Stealer.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
2744 | Microsoft update.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
2744 | Microsoft update.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |
2192 | svchost.exe | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
2744 | Microsoft update.exe | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |