File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/31afca0e-72d3-42a3-ae38-ecce406e9c58
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: February 13, 2024, 18:37:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
rhadamanthys
stealer
hausbomber
azorult
rat
remcos
keylogger
remote
arkei
metastealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4363463463464363463463463.exe (PID: 2852)
      • asdfg.exe (PID: 2692)
      • NeonRank.exe (PID: 696)
      • cmd.exe (PID: 1556)
      • BBLb.exe (PID: 3724)
      • ama.exe (PID: 3508)
      • inst77player_1.0.0.1.exe (PID: 3792)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe (PID: 1168)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • vcredist2013.exe (PID: 3720)
      • 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe (PID: 3172)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 1236)
      • findstr.exe (PID: 1844)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3728)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3728)

    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 2852)

    • RHADAMANTHYS has been detected (SURICATA)

      • dialer.exe (PID: 2112)

    • Actions looks like stealing of personal data

      • dialer.exe (PID: 2112)
      • dialer.exe (PID: 3396)

    • Connects to the CnC server

      • 6dAEd.exe (PID: 3140)
      • 991sN.exe (PID: 2316)

    • AZORULT has been detected (SURICATA)

      • 6dAEd.exe (PID: 3140)
      • 991sN.exe (PID: 2316)

    • Remcos is detected

      • 6.exe (PID: 1832)

    • REMCOS has been detected (SURICATA)

      • 6.exe (PID: 1832)

    • ARKEI has been detected (YARA)

      • build.exe (PID: 4072)

    • REMCOS has been detected (YARA)

      • 6.exe (PID: 1832)

    • METASTEALER has been detected (YARA)

      • easy.exe (PID: 2408)

    • Disables Windows Defender

      • DefenderControl.exe (PID: 3348)
      • DefenderControl.exe (PID: 3164)

    • Creates or modifies Windows services

      • DefenderControl.exe (PID: 3348)
      • DefenderControl.exe (PID: 3164)
      • DefenderControl.exe (PID: 1584)

    • AZORULT has been detected (YARA)

      • 991sN.exe (PID: 2316)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • 4363463463464363463463463.exe (PID: 2852)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • data64_1.exe (PID: 3940)
      • build.exe (PID: 4072)
      • data64_6.exe (PID: 3588)
      • setup_wm.exe (PID: 1340)

    • Reads the Internet Settings

      • 4363463463464363463463463.exe (PID: 2852)
      • baseline.exe (PID: 2328)
      • asdfg.exe (PID: 2692)
      • NeonRank.exe (PID: 696)
      • powershell.exe (PID: 2020)
      • 6dAEd.exe (PID: 3140)
      • inst77player.exe (PID: 3456)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • powershell.exe (PID: 3728)
      • data64_1.exe (PID: 3940)
      • autoupdate.exe (PID: 2588)
      • build.exe (PID: 4072)
      • data64_6.exe (PID: 3588)
      • setup_wm.exe (PID: 1340)
      • 991sN.exe (PID: 2316)

    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 2852)
      • asdfg.exe (PID: 2692)
      • NeonRank.exe (PID: 696)
      • 6dAEd.exe (PID: 3140)
      • inst77player.exe (PID: 3456)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • build.exe (PID: 4072)
      • setup_wm.exe (PID: 1340)
      • 991sN.exe (PID: 2316)

    • Executable content was dropped or overwritten

      • 4363463463464363463463463.exe (PID: 2852)
      • asdfg.exe (PID: 2692)
      • NeonRank.exe (PID: 696)
      • cmd.exe (PID: 1556)
      • BBLb.exe (PID: 3724)
      • dialer.exe (PID: 2112)
      • ama.exe (PID: 3508)
      • inst77player_1.0.0.1.exe (PID: 3792)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe (PID: 1168)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • vcredist2013.exe (PID: 3720)
      • 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe (PID: 3172)
      • dialer.exe (PID: 3396)

    • Adds/modifies Windows certificates

      • 4363463463464363463463463.exe (PID: 2852)

    • Application launched itself

      • BBLb.exe (PID: 2896)
      • asdfg.exe (PID: 2692)
      • cmd.exe (PID: 2372)
      • a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe (PID: 2900)
      • 6dAEd.exe (PID: 3312)
      • AttributeString.exe (PID: 908)
      • MSBuild.exe (PID: 3268)
      • vcredist2013.exe (PID: 1992)
      • lumma.exe (PID: 3708)
      • net.exe (PID: 3040)
      • native.exe (PID: 2900)
      • DefenderControl.exe (PID: 3348)
      • 991sN.exe (PID: 3996)

    • Executing commands from a ".bat" file

      • NeonRank.exe (PID: 696)

    • Starts CMD.EXE for commands execution

      • NeonRank.exe (PID: 696)
      • cmd.exe (PID: 2372)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2372)

    • Get information on the list of running processes

      • cmd.exe (PID: 2372)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 1556)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2372)

    • The executable file from the user directory is run by the CMD process

      • Taxes.pif (PID: 3544)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2372)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 2112)
      • dialer.exe (PID: 3396)

    • Connects to unusual port

      • baseline.exe (PID: 2328)
      • 4363463463464363463463463.exe (PID: 2852)
      • MSBuild.exe (PID: 3548)
      • 6.exe (PID: 1832)
      • easy.exe (PID: 2408)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3728)
      • AttributeString.exe (PID: 908)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3728)

    • Reads browser cookies

      • dialer.exe (PID: 2112)

    • Loads DLL from Mozilla Firefox

      • dialer.exe (PID: 2112)
      • dialer.exe (PID: 3396)

    • Searches for installed software

      • dialer.exe (PID: 2112)
      • vcredist2013.exe (PID: 1992)
      • vcredist2013.exe (PID: 3720)
      • dialer.exe (PID: 3396)

    • Accesses Microsoft Outlook profiles

      • dialer.exe (PID: 2112)
      • dialer.exe (PID: 3396)

    • Executed via WMI

      • 6dAEd.exe (PID: 3312)
      • 991sN.exe (PID: 3996)

    • Process requests binary or script from the Internet

      • 4363463463464363463463463.exe (PID: 2852)

    • Creates a software uninstall entry

      • inst77player_1.0.0.1.exe (PID: 3792)

    • Reads the Windows owner or organization settings

      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • data64_1.exe (PID: 3940)
      • build.exe (PID: 4072)
      • data64_6.exe (PID: 3588)

    • Starts a Microsoft application from unusual location

      • vcredist2013.exe (PID: 1992)
      • vcredist2013.exe (PID: 3720)
      • setup_wm.exe (PID: 1340)

    • Process drops legitimate windows executable

      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • vcredist2013.exe (PID: 3720)
      • 4363463463464363463463463.exe (PID: 2852)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2388)

    • Writes files like Keylogger logs

      • 4363463463464363463463463.exe (PID: 2852)
      • 6.exe (PID: 1832)

    • Checks Windows Trust Settings

      • build.exe (PID: 4072)
      • setup_wm.exe (PID: 1340)

    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 2852)
      • build.exe (PID: 4072)
      • 991sN.exe (PID: 2316)

  • INFO

    • Reads Environment values

      • 4363463463464363463463463.exe (PID: 2852)
      • 6dAEd.exe (PID: 3140)
      • data64_1.exe (PID: 3940)
      • autoupdate.exe (PID: 2588)
      • 6.exe (PID: 1832)
      • data64_6.exe (PID: 3588)
      • 991sN.exe (PID: 2316)

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 2852)
      • baseline.exe (PID: 2328)
      • asdfg.exe (PID: 2692)
      • BBLb.exe (PID: 2896)
      • asdfg.exe (PID: 1496)
      • NeonRank.exe (PID: 696)
      • BBLb.exe (PID: 3724)
      • ama.exe (PID: 3508)
      • a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe (PID: 2900)
      • Taxes.pif (PID: 3544)
      • a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe (PID: 2384)
      • 6dAEd.exe (PID: 3312)
      • 6dAEd.exe (PID: 3140)
      • inst77player_1.0.0.1.exe (PID: 3792)
      • inst77player.exe (PID: 3456)
      • AttributeString.exe (PID: 3044)
      • MSBuild.exe (PID: 3268)
      • MSBuild.exe (PID: 3548)
      • AttributeString.exe (PID: 908)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe (PID: 1168)
      • data64_1.exe (PID: 3940)
      • vcredist2013.exe (PID: 1992)
      • vcredist2013.exe (PID: 3720)
      • lumma.exe (PID: 3708)
      • lumma.exe (PID: 3772)
      • autoupdate.exe (PID: 2588)
      • wmlaunch.exe (PID: 920)
      • 6.exe (PID: 1832)
      • build.exe (PID: 4072)
      • 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe (PID: 3172)
      • net.exe (PID: 3040)
      • native.exe (PID: 3808)
      • DefenderControl.exe (PID: 3348)
      • easy.exe (PID: 2408)
      • data64_6.exe (PID: 3588)
      • net.exe (PID: 4056)
      • native.exe (PID: 2900)
      • setup_wm.exe (PID: 1340)
      • DefenderControl.exe (PID: 3164)
      • DefenderControl.exe (PID: 1584)
      • 991sN.exe (PID: 2316)
      • 991sN.exe (PID: 3996)

    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 2852)
      • baseline.exe (PID: 2328)
      • BBLb.exe (PID: 2896)
      • asdfg.exe (PID: 2692)
      • BBLb.exe (PID: 3724)
      • NeonRank.exe (PID: 696)
      • Taxes.pif (PID: 3544)
      • 6dAEd.exe (PID: 3312)
      • 6dAEd.exe (PID: 3140)
      • ama.exe (PID: 3508)
      • inst77player_1.0.0.1.exe (PID: 3792)
      • inst77player.exe (PID: 3456)
      • AttributeString.exe (PID: 908)
      • AttributeString.exe (PID: 3044)
      • MSBuild.exe (PID: 3268)
      • MSBuild.exe (PID: 3548)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • data64_1.exe (PID: 3940)
      • vcredist2013.exe (PID: 1992)
      • vcredist2013.exe (PID: 3720)
      • 6.exe (PID: 1832)
      • build.exe (PID: 4072)
      • autoupdate.exe (PID: 2588)
      • 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe (PID: 3172)
      • net.exe (PID: 3040)
      • easy.exe (PID: 2408)
      • DefenderControl.exe (PID: 3348)
      • data64_6.exe (PID: 3588)
      • native.exe (PID: 2900)
      • setup_wm.exe (PID: 1340)
      • DefenderControl.exe (PID: 3164)
      • DefenderControl.exe (PID: 1584)
      • 991sN.exe (PID: 3996)
      • 991sN.exe (PID: 2316)

    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 2852)
      • baseline.exe (PID: 2328)
      • BBLb.exe (PID: 2896)
      • asdfg.exe (PID: 2692)
      • BBLb.exe (PID: 3724)
      • wmlaunch.exe (PID: 920)
      • 6dAEd.exe (PID: 3312)
      • 6dAEd.exe (PID: 3140)
      • inst77player.exe (PID: 3456)
      • AttributeString.exe (PID: 908)
      • AttributeString.exe (PID: 3044)
      • MSBuild.exe (PID: 3268)
      • MSBuild.exe (PID: 3548)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • data64_1.exe (PID: 3940)
      • vcredist2013.exe (PID: 1992)
      • 6.exe (PID: 1832)
      • build.exe (PID: 4072)
      • autoupdate.exe (PID: 2588)
      • 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe (PID: 3172)
      • net.exe (PID: 3040)
      • native.exe (PID: 2900)
      • easy.exe (PID: 2408)
      • data64_6.exe (PID: 3588)
      • setup_wm.exe (PID: 1340)
      • 991sN.exe (PID: 3996)
      • 991sN.exe (PID: 2316)

    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 2852)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • data64_1.exe (PID: 3940)
      • build.exe (PID: 4072)
      • data64_6.exe (PID: 3588)
      • setup_wm.exe (PID: 1340)

    • Checks proxy server information

      • baseline.exe (PID: 2328)
      • 6dAEd.exe (PID: 3140)
      • inst77player.exe (PID: 3456)
      • build.exe (PID: 4072)
      • setup_wm.exe (PID: 1340)
      • 991sN.exe (PID: 2316)

    • Create files in a temporary directory

      • asdfg.exe (PID: 2692)
      • NeonRank.exe (PID: 696)
      • inst77player_1.0.0.1.exe (PID: 3792)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe (PID: 1168)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • vcredist2013.exe (PID: 3720)
      • ama.exe (PID: 3508)
      • 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe (PID: 3172)
      • DefenderControl.exe (PID: 3348)

    • Reads mouse settings

      • Taxes.pif (PID: 3544)
      • DefenderControl.exe (PID: 3348)
      • DefenderControl.exe (PID: 3164)
      • DefenderControl.exe (PID: 1584)

    • Creates files or folders in the user directory

      • BBLb.exe (PID: 3724)
      • dialer.exe (PID: 2112)
      • inst77player_1.0.0.1.exe (PID: 3792)
      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
      • autoupdate.exe (PID: 2588)
      • build.exe (PID: 4072)
      • dialer.exe (PID: 3396)

    • Drops the executable file immediately after the start

      • dialer.exe (PID: 2112)
      • dialer.exe (PID: 3396)

    • Reads product name

      • 6dAEd.exe (PID: 3140)
      • 6.exe (PID: 1832)
      • 991sN.exe (PID: 2316)

    • Creates files in the program directory

      • inst77player_1.0.0.1.exe (PID: 3792)

    • Creates a software uninstall entry

      • %E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp (PID: 3392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(1832) 6.exe
C2 (9)hendersonk1.hopto.org:2404
henderson1.camdvr.org:2404
centplus1.serveftp.com:2404
harrywlike.ddns.net:2404
genekol.nsupdate.info:2404
harrywlike1.ddns.net:2404
hendersonk2022.hopto.org:2404
genekol1.nsupdate.info:2404
generem.camdvr.org:2404
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\ShellGY99V
Setup_path%APPDATA%
Copy_filesonic.exe
Startup_valuefuckuuuuu
Hide_fileFalse
Mutex_namegsgjdwg-1J0WWM
Keylog_flag1
Keylog_path%APPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogTrue
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_namenotepad;solitaire;
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%APPDATA%
Audio_dirMicRecords
Connect_delay0
Copy_diryakkk
Keylog_dirchrome
Max_keylog_file20000

Arkei

(PID) Process(4072) build.exe
C2 (1)https://t.me/deadftx
Strings (31)46"-vli
2>SR'
IF6FU5*
CQHBTE'#K
TG;4NC
^!onp?
ikj
=ecd"
w=!{tzn
JLXAB
cF2RY\^NH
uibydg
0qz-myG@
c48e{vejsfCo
R0/^5#!9LWP*U?GA2
3WQ98F8WRA'10/I\?
HU%QQ2DK\Y1]!3FV9
>+=OF_V]EO!#5U+
pdb<-\
\% lj3E$
N*JWA1
> ZH@V
"E0@Q1\_OSM]$
DU\ACTQZ*
1D<_ZEMMVEV
-EXH-U@:
eD3U69$NCBTE<
UDJT*SMX)4
K YC-/B4A-:
FDRPQ
^VYGWU

MetaStealer

(PID) Process(2408) easy.exe
C2 (1)5.42.65.101:48790
Botnet325904615-26990097-easy
Options
ErrorMessage
Keys
XorPyrometry

azorult

(PID) Process(2316) 991sN.exe
Hostshttp://195.245.112.115/index.php
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
60
Malicious processes
30
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #HAUSBOMBER 4363463463464363463463463.exe baseline.exe asdfg.exe bblb.exe no specs asdfg.exe asdfg.exe no specs asdfg.exe no specs neonrank.exe bblb.exe cmd.exe no specs ama.exe tasklist.exe no specs findstr.exe no specs a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs taxes.pif ping.exe no specs #RHADAMANTHYS dialer.exe a0538252234edd82661f55fea05df541c095a9f74368d8dca1582d797a1d084a.exe no specs powershell.exe no specs wmlaunch.exe no specs 6daed.exe no specs #AZORULT 6daed.exe inst77player_1.0.0.1.exe inst77player.exe no specs attributestring.exe no specs attributestring.exe no specs msbuild.exe no specs msbuild.exe powershell.exe no specs %e5%88%9d%e5%a6%86%e5%8a%a9%e6%89%8b.exe %e5%88%9d%e5%a6%86%e5%8a%a9%e6%89%8b.tmp data64_1.exe vcredist2013.exe no specs vcredist2013.exe lumma.exe no specs lumma.exe vssvc.exe no specs autoupdate.exe #REMCOS 6.exe #ARKEI build.exe 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe net.exe no specs net.exe dialer.exe native.exe no specs native.exe defendercontrol.exe no specs #METASTEALER easy.exe data64_6.exe setup_wm.exe defendercontrol.exe defendercontrol.exe 991sn.exe no specs #AZORULT 991sn.exe 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
696"C:\Users\admin\Desktop\Files\NeonRank.exe" C:\Users\admin\Desktop\Files\NeonRank.exe
4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\neonrank.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
908C:\Users\admin\AppData\Local\TypeId\renxwnji\AttributeString.exe C:\Users\admin\AppData\Local\TypeId\renxwnji\AttributeString.exe—taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\typeid\renxwnji\attributestring.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
920"C:\Program Files\Windows Media Player\wmlaunch.exe"C:\Program Files\Windows Media Player\wmlaunch.exe—dialer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Media Player Launcher
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmlaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1168"C:\Users\admin\Desktop\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe" C:\Users\admin\Desktop\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
4363463463464363463463463.exe
User:
admin
Company:
初妆助手
Integrity Level:
HIGH
Description:
初妆助手 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\files\%e5%88%9d%e5%a6%86%e5%8a%a9%e6%89%8b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1236findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1336tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1340"C:\Users\admin\Desktop\Files\setup_wm.exe" C:\Users\admin\Desktop\Files\setup_wm.exe
4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Media Configuration Utility
Exit code:
0
Version:
12.0.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\desktop\files\setup_wm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1496C:\Users\admin\Desktop\Files\asdfg.exeC:\Users\admin\Desktop\Files\asdfg.exe
asdfg.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\asdfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
1556cmd /c copy /b Compound + Injection + Emotions + Worm + Participants + Richmond 4096\Taxes.pifC:\Windows\System32\cmd.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
64 167
Read events
63 346
Write events
739
Delete events
82

Modification events

(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2852) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
37
Suspicious files
22
Text files
35
Unknown types
16

Dropped files

PID
Process
Filename
Type
2692asdfg.exeC:\Users\admin\AppData\Local\Temp\BBLb.exeexecutable
MD5:71EB1BC6E6DA380C1CB552D78B391B2A
SHA256:CEFA92EE6CC2FAD86C49DD37D57FF8AFCB9B9ABEF0A110689E6D771394256BD6
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Emotionsbinary
MD5:4DD712F3AC47D2632B1FA470891858C9
SHA256:025BDBD4ACD0829141281AD412F7BA59E21D253C19FDECE25304A7EACA592BA8
28524363463463464363463463463.exeC:\Users\admin\Desktop\Files\baseline.exeexecutable
MD5:ED144CAEBBC81B2914858FA9A59388FB
SHA256:0034D86B2E202EEE69EF00B3551753F133278BD26E0EE0F486F0CC7E3DC61032
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Declaretext
MD5:2894B437EB1F14BB3DC2D0995DC8238E
SHA256:5B151A88F51C5AFD71E1437D61D0B5E4E8354B60570EC7EB57FF115314AC00AD
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Assuredtext
MD5:D1D04D0889C995208BFD51027D6BBFB2
SHA256:FEB509566E97E0B401FA0C358410C4E30A2CA737E97AB53BA85AA8B7233039E2
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Injectionbinary
MD5:41677AA1D64845FBD17C72F7FF1837DD
SHA256:AFBEBEC2C0199E3C01EC1D4174BC25DFAC1FBDF453450E1C4ACFEF292BC18BFE
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Bathroomstext
MD5:1730EAEBB468F5EB2EB028FEBF54AE06
SHA256:6BB1EB00577143D94353505D3FAA833A6E11A1B1E7A89665374546B6C4224D18
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Richmondbinary
MD5:7CEF207172CBDF6768101F8A2602F787
SHA256:6C3482C9F62DA91208F4F67FE2A41211F8A2A7929BFDA4841495D20D29BF1E9C
696NeonRank.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Participantsbinary
MD5:96C01CB0CAF4A239B2CDAC79372C249B
SHA256:1BD9E4921D3E304CBBDBE7E169C090F023940C3901C3F30076AA805AAE46A6F9
2372cmd.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Bathrooms.battext
MD5:1730EAEBB468F5EB2EB028FEBF54AE06
SHA256:6BB1EB00577143D94353505D3FAA833A6E11A1B1E7A89665374546B6C4224D18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
128
DNS requests
39
Threats
72

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2852
4363463463464363463463463.exe
GET
200
193.117.208.148:80
http://193.117.208.148/baseline.exe
unknown
executable
72.0 Kb
unknown
2852
4363463463464363463463463.exe
GET
200
91.215.85.223:80
http://lastimaners.ug/asdfg.exe
unknown
executable
2.13 Mb
unknown
2852
4363463463464363463463463.exe
GET
200
185.172.128.32:80
http://185.172.128.32/ama.exe
unknown
executable
1.38 Mb
unknown
3140
6dAEd.exe
POST
200
91.215.85.223:80
http://parals.ac.ug/index.php
unknown
text
4 b
unknown
2852
4363463463464363463463463.exe
GET
200
104.192.108.17:80
http://softdl.360tpcdn.com/inst77player/inst77player_1.0.0.1.exe
unknown
executable
281 Kb
unknown
4072
build.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
unknown
binary
1.98 Kb
unknown
4072
build.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
binary
2.01 Kb
unknown
4072
build.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
4072
build.exe
GET
308
116.202.2.1:80
http://116.202.2.1/1827
unknown
—
—
unknown
2852
4363463463464363463463463.exe
GET
200
91.215.85.223:80
http://partadino.ac.ug/native.exe
unknown
executable
2.13 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2852
4363463463464363463463463.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
2852
4363463463464363463463463.exe
193.117.208.148:80
—
Virtual1 Limited
GB
unknown
2852
4363463463464363463463463.exe
91.215.85.223:80
lastimaners.ug
—
RU
unknown
2328
baseline.exe
193.117.208.148:7800
—
Virtual1 Limited
GB
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2852
4363463463464363463463463.exe
140.82.121.4:443
github.com
GITHUB
US
unknown
2852
4363463463464363463463463.exe
185.199.111.133:443
raw.githubusercontent.com
FASTLY
US
unknown
2852
4363463463464363463463463.exe
185.172.128.32:80
—
OOO Nadym Svyaz Service
RU
malicious

DNS requests

Domain
IP
Reputation
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
lastimaners.ug
  • 91.215.85.223
unknown
github.com
  • 140.82.121.4
shared
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.110.133
shared
JDkGqaSrgKXZ.JDkGqaSrgKXZ
  • —
unknown
pastratas.ac.ug
  • 185.196.21.45
  • 194.50.153.126
unknown
parals.ac.ug
  • 91.215.85.223
unknown
softdl.360tpcdn.com
  • 104.192.108.17
  • 104.192.108.20
  • 104.192.108.21
unknown
u.yinyuehome.com
  • —
unknown
nickshort.ug
  • —
unknown

Threats

PID
Process
Class
Message
2852
4363463463464363463463463.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2852
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2852
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2852
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2852
4363463463464363463463463.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2852
4363463463464363463463463.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2852
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2852
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2852
4363463463464363463463463.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2852
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
17 ETPRO signatures available at the full report
Process
Message
4363463463464363463463463.exe
Unable to connect to the remote server
4363463463464363463463463.exe
Unable to connect to the remote server
4363463463464363463463463.exe
The request was aborted: Could not create SSL/TLS secure channel.
4363463463464363463463463.exe
Unable to connect to the remote server
4363463463464363463463463.exe
Unable to connect to the remote server
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4363463463464363463463463.exe