File name:

xone.exe

Full analysis: https://app.any.run/tasks/409a29f3-6416-409b-bae7-f5f346bf8cc4
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 19, 2025, 14:34:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
auto-sch
auto-reg
remote
darkcrystal
netreactor
stealer
wmi-base64
susp-powershell
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

76937540A84F56C7C3F6EE56EEADDAF0

SHA1:

797800F45FA3101005847B5FE5488FDC3824409E

SHA256:

2F8C5C8422A147FD946A22044DAB431BED1F7DA50E4EAD2ACBCF71AF8231A68B

SSDEEP:

98304:oyi3yGeVPAb85dMDxpLCk3SMB2T0BWGnYB2g3N0eP34c+DHcVmyAHJNldNtKdi/T:xC16AxRhf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7852)

    • DCRAT mutex has been found

      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • UserOOBEBroker.exe (PID: 3884)
      • dwm.exe (PID: 7200)
      • UserOOBEBroker.exe (PID: 7740)
      • lsass.exe (PID: 7764)
      • ChainagentproviderserverRuntime.exe (PID: 7744)
      • RuntimeBroker.exe (PID: 7616)
      • ChainagentproviderserverRuntime.exe (PID: 7656)
      • wininit.exe (PID: 7784)
      • wininit.exe (PID: 7836)
      • RuntimeBroker.exe (PID: 2096)
      • wininit.exe (PID: 2552)
      • dwm.exe (PID: 5400)
      • lsass.exe (PID: 4300)

    • Changes the autorun value in the registry

      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Connects to the CnC server

      • UserOOBEBroker.exe (PID: 3884)

    • DARKCRYSTAL has been detected (SURICATA)

      • UserOOBEBroker.exe (PID: 3884)

    • Steals credentials from Web Browsers

      • UserOOBEBroker.exe (PID: 3884)

    • DCRAT has been detected (YARA)

      • UserOOBEBroker.exe (PID: 3884)

    • Actions looks like stealing of personal data

      • UserOOBEBroker.exe (PID: 3884)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7852)
      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7852)

    • Reads security settings of Internet Explorer

      • xone.exe (PID: 7792)
      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7852)
      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7984)

    • Executable content was dropped or overwritten

      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • csc.exe (PID: 3676)
      • UserOOBEBroker.exe (PID: 3884)

    • The process creates files with name similar to system file names

      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Executed via WMI

      • schtasks.exe (PID: 5544)
      • schtasks.exe (PID: 7324)
      • schtasks.exe (PID: 5668)
      • schtasks.exe (PID: 2108)
      • schtasks.exe (PID: 7184)
      • schtasks.exe (PID: 3176)
      • schtasks.exe (PID: 6876)
      • schtasks.exe (PID: 5380)
      • schtasks.exe (PID: 1056)
      • schtasks.exe (PID: 7048)
      • schtasks.exe (PID: 7052)
      • schtasks.exe (PID: 5376)
      • schtasks.exe (PID: 5048)
      • schtasks.exe (PID: 6048)
      • schtasks.exe (PID: 7012)
      • schtasks.exe (PID: 4724)
      • schtasks.exe (PID: 5800)
      • schtasks.exe (PID: 4620)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 7528)

    • Reads the date of Windows installation

      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7528)

    • There is functionality for taking screenshot (YARA)

      • UserOOBEBroker.exe (PID: 3884)

    • Loads DLL from Mozilla Firefox

      • UserOOBEBroker.exe (PID: 3884)

  • INFO

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • xone.exe (PID: 7792)

    • Reads the computer name

      • xone.exe (PID: 7792)
      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • UserOOBEBroker.exe (PID: 3884)
      • UserOOBEBroker.exe (PID: 7740)
      • dwm.exe (PID: 7200)
      • ChainagentproviderserverRuntime.exe (PID: 7656)
      • RuntimeBroker.exe (PID: 7616)
      • ChainagentproviderserverRuntime.exe (PID: 7744)
      • lsass.exe (PID: 7764)
      • wininit.exe (PID: 7784)
      • wininit.exe (PID: 7836)
      • RuntimeBroker.exe (PID: 2096)
      • wininit.exe (PID: 2552)
      • dwm.exe (PID: 5400)
      • lsass.exe (PID: 4300)

    • Process checks computer location settings

      • xone.exe (PID: 7792)
      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Checks supported languages

      • xone.exe (PID: 7792)
      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • csc.exe (PID: 3676)
      • cvtres.exe (PID: 1244)
      • chcp.com (PID: 7540)
      • ChainagentproviderserverRuntime.exe (PID: 7656)
      • RuntimeBroker.exe (PID: 7616)
      • UserOOBEBroker.exe (PID: 7740)
      • UserOOBEBroker.exe (PID: 3884)
      • dwm.exe (PID: 7200)
      • ChainagentproviderserverRuntime.exe (PID: 7744)
      • lsass.exe (PID: 7764)
      • wininit.exe (PID: 7784)
      • wininit.exe (PID: 7836)
      • RuntimeBroker.exe (PID: 2096)
      • wininit.exe (PID: 2552)
      • dwm.exe (PID: 5400)
      • lsass.exe (PID: 4300)

    • Reads the machine GUID from the registry

      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • csc.exe (PID: 3676)
      • UserOOBEBroker.exe (PID: 7740)
      • dwm.exe (PID: 7200)
      • RuntimeBroker.exe (PID: 7616)
      • ChainagentproviderserverRuntime.exe (PID: 7656)
      • ChainagentproviderserverRuntime.exe (PID: 7744)
      • lsass.exe (PID: 7764)
      • UserOOBEBroker.exe (PID: 3884)
      • wininit.exe (PID: 7784)
      • dwm.exe (PID: 5400)
      • RuntimeBroker.exe (PID: 2096)
      • wininit.exe (PID: 7836)
      • wininit.exe (PID: 2552)
      • lsass.exe (PID: 4300)

    • Reads Environment values

      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • UserOOBEBroker.exe (PID: 7740)
      • dwm.exe (PID: 7200)
      • ChainagentproviderserverRuntime.exe (PID: 7656)
      • lsass.exe (PID: 7764)
      • UserOOBEBroker.exe (PID: 3884)
      • RuntimeBroker.exe (PID: 7616)
      • ChainagentproviderserverRuntime.exe (PID: 7744)
      • wininit.exe (PID: 7784)
      • dwm.exe (PID: 5400)
      • wininit.exe (PID: 7836)
      • RuntimeBroker.exe (PID: 2096)
      • lsass.exe (PID: 4300)
      • wininit.exe (PID: 2552)

    • Failed to create an executable file in Windows directory

      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Creates files in the program directory

      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Create files in a temporary directory

      • cvtres.exe (PID: 1244)
      • ChainagentproviderserverRuntime.exe (PID: 8080)
      • UserOOBEBroker.exe (PID: 3884)

    • Creates files or folders in the user directory

      • csc.exe (PID: 3676)

    • Auto-launch of the file from Registry key

      • ChainagentproviderserverRuntime.exe (PID: 8080)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7528)

    • Manual execution by a user

      • UserOOBEBroker.exe (PID: 3884)
      • UserOOBEBroker.exe (PID: 7740)
      • dwm.exe (PID: 7200)
      • ChainagentproviderserverRuntime.exe (PID: 7656)
      • RuntimeBroker.exe (PID: 7616)
      • lsass.exe (PID: 7764)
      • ChainagentproviderserverRuntime.exe (PID: 7744)
      • wininit.exe (PID: 7784)
      • wininit.exe (PID: 7836)
      • RuntimeBroker.exe (PID: 2096)
      • dwm.exe (PID: 5400)
      • lsass.exe (PID: 4300)

    • Disables trace logs

      • UserOOBEBroker.exe (PID: 3884)

    • Checks proxy server information

      • UserOOBEBroker.exe (PID: 3884)
      • slui.exe (PID: 6252)

    • .NET Reactor protector has been detected

      • UserOOBEBroker.exe (PID: 3884)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • UserOOBEBroker.exe (PID: 3884)

    • Found Base64 encoded reference to AntiVirus WMI classes (YARA)

      • UserOOBEBroker.exe (PID: 3884)

    • Found Base64 encoded reference to WMI classes (YARA)

      • UserOOBEBroker.exe (PID: 3884)

    • Reads the software policy settings

      • slui.exe (PID: 6252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3884) UserOOBEBroker.exe
C2 (1)http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1true
2true
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
C2 (1)http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1true
2true
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 110080
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
46
Malicious processes
17
Suspicious processes
1

Behavior graph

Click at the process to see the details
start xone.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs #DCRAT chainagentproviderserverruntime.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT useroobebroker.exe #DCRAT useroobebroker.exe no specs #DCRAT dwm.exe no specs #DCRAT chainagentproviderserverruntime.exe no specs #DCRAT runtimebroker.exe no specs #DCRAT lsass.exe no specs #DCRAT chainagentproviderserverruntime.exe no specs #DCRAT wininit.exe no specs #DCRAT runtimebroker.exe no specs #DCRAT wininit.exe no specs svchost.exe #DCRAT dwm.exe no specs #DCRAT wininit.exe no specs #DCRAT lsass.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1056schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\DriverNet\RuntimeBroker.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1244C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES2D27.tmp" "c:\Users\admin\AppData\Local\Microsoft\OneDrive\CSC4609DBF4BB014C05AE5F86C7FEF0EAA1.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2096C:\DriverNet\RuntimeBroker.exeC:\DriverNet\RuntimeBroker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\drivernet\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2108schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\DriverNet\wininit.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2552"C:\DriverNet\wininit.exe" C:\DriverNet\wininit.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\drivernet\wininit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3176schtasks.exe /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 9 /tr "'C:\DriverNet\UserOOBEBroker.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3676"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\xnjksbad.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
ChainagentproviderserverRuntime.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3884C:\DriverNet\UserOOBEBroker.exeC:\DriverNet\UserOOBEBroker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.2.7.1277
Modules
Images
c:\drivernet\useroobebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
DcRat
(PID) Process(3884) UserOOBEBroker.exe
C2 (1)http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1true
2true
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
(PID) Process(3884) UserOOBEBroker.exe
C2 (1)http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1true
2true
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
4300"C:\Users\All Users\lsass.exe"C:\ProgramData\lsass.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\programdata\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
10 222
Read events
10 199
Write events
23
Delete events
0

Modification events

(PID) Process:(7792) xone.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\ac26a8b3a11effa4ceccb347aa08b314f097ff1d
Operation:writeName:c4251dbdd6b7b1537c233b0598243c5605165ad9
Value:
H4sIAAAAAAAEAItWcraKiXEpyixLLfJLLYmJSSnP1UutSFXSQZcILU4t8vd3cnUqys9OLcKupjwzDwhLsEsGleaVZOamYugHGVwcE+OYk6MAZeYUJxYXYzfEOSMxMy8xPTWvpKAovywzBag+tQgoCTUcrCkWAJbYx6vVAAAA
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UserOOBEBroker
Value:
"C:\DriverNet\UserOOBEBroker.exe"
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:wininit
Value:
"C:\DriverNet\wininit.exe"
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RuntimeBroker
Value:
"C:\DriverNet\RuntimeBroker.exe"
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:lsass
Value:
"C:\Users\All Users\lsass.exe"
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ChainagentproviderserverRuntime
Value:
"C:\DriverNet\ChainagentproviderserverRuntime.exe"
(PID) Process:(8080) ChainagentproviderserverRuntime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dwm
Value:
"C:\DriverNet\dwm.exe"
(PID) Process:(3884) UserOOBEBroker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\UserOOBEBroker_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3884) UserOOBEBroker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\UserOOBEBroker_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
16
Suspicious files
26
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
7792xone.exeC:\DriverNet\ChainagentproviderserverRuntime.exe —
MD5:—
SHA256:—
8080ChainagentproviderserverRuntime.exeC:\ProgramData\lsass.exe —
MD5:—
SHA256:—
8080ChainagentproviderserverRuntime.exeC:\DriverNet\RuntimeBroker.exe —
MD5:—
SHA256:—
8080ChainagentproviderserverRuntime.exeC:\DriverNet\wininit.exe —
MD5:—
SHA256:—
8080ChainagentproviderserverRuntime.exeC:\DriverNet\UserOOBEBroker.exe —
MD5:—
SHA256:—
8080ChainagentproviderserverRuntime.exeC:\DriverNet\dwm.exe —
MD5:—
SHA256:—
7792xone.exeC:\DriverNet\4D21WVqsJc3jKktxQhsQoVMCVVh8Cehbl1azUm31Le9g7x38GDXC50lIf2.battext
MD5:953F7645D4D6F6FB79EA7757C31C1618
SHA256:7C00AD6274D7E4C7E99075C5648175C9776250A9FEA4D6EEB262865295838B45
8080ChainagentproviderserverRuntime.exeC:\Users\admin\Desktop\YDBJVdXq.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
8080ChainagentproviderserverRuntime.exeC:\Users\admin\Desktop\QfEulTxK.logexecutable
MD5:2D6975FD1CC3774916D8FF75C449EE7B
SHA256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
8080ChainagentproviderserverRuntime.exeC:\Users\admin\Desktop\imVZFFcY.logexecutable
MD5:51B1964F31C557AE8C2B01EA164ABD9F
SHA256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
24
DNS requests
4
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
3884
UserOOBEBroker.exe
POST
200
104.21.96.1:80
http://074513cm.nyashware.ru/PythonPhprequesthttpasyncGeneratoruniversalDleuploads.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3884
UserOOBEBroker.exe
104.21.96.1:80
074513cm.nyashware.ru
CLOUDFLARENET
—
malicious
7476
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6252
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
074513cm.nyashware.ru
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.48.1
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.112.1
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (nyashware .ru)
3884
UserOOBEBroker.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
3884
UserOOBEBroker.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xone.exe