File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/cf60b9c5-2ec6-4a13-93a7-bee8c8fd9ece
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: August 03, 2024, 22:32:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
hausbomber
dcrat
phorpiex
stealer
miner
github
smb
autoit
opendir
risepro
upx
deerstealer
xfiles
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • t1.exe (PID: 6684)
      • 4363463463464363463463463.exe (PID: 6512)
      • pi.exe (PID: 6664)
      • peinf.exe (PID: 6644)
      • 239823184.exe (PID: 5196)
      • 2789214706.exe (PID: 6156)
      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • 1894712399.exe (PID: 2180)
      • 1954338341.exe (PID: 6360)
      • sysmysldrv.exe (PID: 5116)
      • wupgrdsv.exe (PID: 5304)
      • 11.exe (PID: 1492)
      • tpeinf.exe (PID: 6936)
      • zhw10.exe (PID: 6832)
      • npp.exe (PID: 6540)
      • cmd.exe (PID: 2900)
      • Paraguay.pif (PID: 2992)
      • pei.exe (PID: 6720)
      • nxmr.exe (PID: 3684)
      • wupgrdsv.exe (PID: 6228)
      • sysarddrvs.exe (PID: 6188)
      • radbxnzdxbd.exe (PID: 6952)

    • Changes the autorun value in the registry

      • t1.exe (PID: 6684)
      • pi.exe (PID: 6664)
      • 239823184.exe (PID: 5196)
      • 11.exe (PID: 1492)

    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 6512)

    • Creates or modifies Windows services

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)

    • Changes the Windows auto-update feature

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)

    • Changes appearance of the Explorer extensions

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)

    • DCRAT has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 6512)

    • Changes Security Center notification settings

      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)

    • PHORPIEX has been detected (SURICATA)

      • sysmablsvr.exe (PID: 6728)
      • svchost.exe (PID: 2256)
      • sylsplvc.exe (PID: 6820)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)
      • 4363463463464363463463463.exe (PID: 6512)

    • Connects to the CnC server

      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • sysmysldrv.exe (PID: 5116)
      • notepad.exe (PID: 320)
      • sysarddrvs.exe (PID: 6188)
      • notepad.exe (PID: 2476)
      • server.exe (PID: 3684)

    • Adds path to the Windows Defender exclusion list

      • sysmysldrv.exe (PID: 5116)
      • cmd.exe (PID: 6748)
      • sysarddrvs.exe (PID: 6188)
      • cmd.exe (PID: 6656)

    • PHORPIEX has been detected (YARA)

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)

    • Actions looks like stealing of personal data

      • peinf.exe (PID: 6644)

    • MINER has been detected (SURICATA)

      • notepad.exe (PID: 320)
      • notepad.exe (PID: 2476)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 2928)
      • findstr.exe (PID: 3292)

    • Create files in the Startup directory

      • cmd.exe (PID: 4324)

    • Attempt to connect to SMB server

      • System (PID: 4)

    • RISEPRO has been detected (YARA)

      • Paraguay.pif (PID: 6692)

    • Stealers network behavior

      • server.exe (PID: 3684)

    • XFILES has been detected (SURICATA)

      • server.exe (PID: 3684)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 4363463463464363463463463.exe (PID: 6512)
      • sysmysldrv.exe (PID: 5116)
      • ChatLife.exe (PID: 6956)
      • sysarddrvs.exe (PID: 6188)
      • server.exe (PID: 3684)

    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 6512)
      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • 2861732127.exe (PID: 640)
      • sysmysldrv.exe (PID: 5116)
      • 2789214706.exe (PID: 6156)
      • 1894712399.exe (PID: 2180)
      • tpeinf.exe (PID: 6936)
      • sysarddrvs.exe (PID: 6188)
      • npp.exe (PID: 6540)
      • ChatLife.exe (PID: 6956)
      • pei.exe (PID: 6720)
      • DownSysSoft.exe (PID: 5232)
      • radbxnzdxbd.exe (PID: 6952)

    • Executable content was dropped or overwritten

      • t1.exe (PID: 6684)
      • 4363463463464363463463463.exe (PID: 6512)
      • peinf.exe (PID: 6644)
      • 239823184.exe (PID: 5196)
      • 2789214706.exe (PID: 6156)
      • pi.exe (PID: 6664)
      • 1894712399.exe (PID: 2180)
      • 1954338341.exe (PID: 6360)
      • wupgrdsv.exe (PID: 5304)
      • zhw10.exe (PID: 6832)
      • 11.exe (PID: 1492)
      • tpeinf.exe (PID: 6936)
      • npp.exe (PID: 6540)
      • cmd.exe (PID: 2900)
      • Paraguay.pif (PID: 2992)
      • pei.exe (PID: 6720)
      • nxmr.exe (PID: 3684)
      • wupgrdsv.exe (PID: 6228)
      • radbxnzdxbd.exe (PID: 6952)

    • Starts itself from another location

      • t1.exe (PID: 6684)
      • pi.exe (PID: 6664)
      • 239823184.exe (PID: 5196)
      • sysmysldrv.exe (PID: 5116)
      • 11.exe (PID: 1492)

    • Potential Corporate Privacy Violation

      • 4363463463464363463463463.exe (PID: 6512)
      • 1894712399.exe (PID: 2180)
      • notepad.exe (PID: 320)
      • tpeinf.exe (PID: 6936)
      • System (PID: 4)
      • DownSysSoft.exe (PID: 5232)
      • 2789214706.exe (PID: 6156)
      • notepad.exe (PID: 2476)

    • Connects to unusual port

      • 4363463463464363463463463.exe (PID: 6512)
      • sylsplvc.exe (PID: 6820)
      • sysmablsvr.exe (PID: 6728)
      • notepad.exe (PID: 320)
      • sysmysldrv.exe (PID: 5116)
      • aaa.exe (PID: 6908)
      • DownSysSoft.exe (PID: 5232)
      • Paraguay.pif (PID: 6692)
      • notepad.exe (PID: 2476)
      • %5Binstall%5D.exe (PID: 6656)
      • %5Binstall%5D.exe (PID: 6704)
      • QQ.exe (PID: 2400)
      • sysarddrvs.exe (PID: 6188)

    • Creates or modifies Windows services

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)

    • Connects to the server without a host name

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • 2789214706.exe (PID: 6156)
      • sylsplvc.exe (PID: 6820)
      • 1894712399.exe (PID: 2180)
      • sysarddrvs.exe (PID: 6188)
      • 4363463463464363463463463.exe (PID: 6512)

    • Process drops legitimate windows executable

      • peinf.exe (PID: 6644)

    • Starts CMD.EXE for commands execution

      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)
      • ChatLife.exe (PID: 6956)
      • cmd.exe (PID: 2900)
      • Paraguay.pif (PID: 2992)
      • KB824105-x86-ENU.exe (PID: 6984)
      • SP.exe (PID: 3984)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6748)
      • cmd.exe (PID: 6656)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 6748)
      • cmd.exe (PID: 6656)

    • Process requests binary or script from the Internet

      • 2789214706.exe (PID: 6156)
      • 1894712399.exe (PID: 2180)
      • 4363463463464363463463463.exe (PID: 6512)
      • tpeinf.exe (PID: 6936)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 4664)
      • powershell.exe (PID: 4780)

    • The process executes via Task Scheduler

      • wupgrdsv.exe (PID: 5304)
      • wupgrdsv.exe (PID: 6228)

    • Drops a system driver (possible attempt to evade defenses)

      • wupgrdsv.exe (PID: 5304)
      • zhw10.exe (PID: 6832)
      • wupgrdsv.exe (PID: 6228)

    • Crypto Currency Mining Activity Detected

      • notepad.exe (PID: 320)

    • Executing commands from ".cmd" file

      • ChatLife.exe (PID: 6956)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2900)

    • Application launched itself

      • cmd.exe (PID: 2900)
      • Paraguay.pif (PID: 2992)
      • %5Binstall%5D.exe (PID: 964)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2900)
      • Paraguay.pif (PID: 2992)

    • Suspicious file concatenation

      • cmd.exe (PID: 5904)

    • The executable file from the user directory is run by the CMD process

      • Paraguay.pif (PID: 2992)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2900)
      • Paraguay.pif (PID: 2992)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2900)

    • Get information on the list of running processes

      • cmd.exe (PID: 2900)

    • Starts NET.EXE to map network drives

      • cmd.exe (PID: 1500)

    • Contacting a server suspected of hosting an CnC

      • server.exe (PID: 3684)

  • INFO

    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 6512)
      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • 2861732127.exe (PID: 640)
      • sysmysldrv.exe (PID: 5116)
      • 2789214706.exe (PID: 6156)
      • 1894712399.exe (PID: 2180)
      • zhw10.exe (PID: 6832)
      • tpeinf.exe (PID: 6936)
      • aaa.exe (PID: 6908)
      • sysarddrvs.exe (PID: 6188)
      • npp.exe (PID: 6540)
      • ChatLife.exe (PID: 6956)
      • nc64.exe (PID: 6440)
      • Paraguay.pif (PID: 2992)
      • pei.exe (PID: 6720)
      • DownSysSoft.exe (PID: 5232)
      • KB824105-x86-ENU.exe (PID: 6984)
      • radbxnzdxbd.exe (PID: 6952)
      • SP.exe (PID: 3984)
      • Paraguay.pif (PID: 6692)
      • %5Binstall%5D.exe (PID: 6656)
      • server.exe (PID: 3684)
      • %5Binstall%5D.exe (PID: 6704)
      • QQ.exe (PID: 2400)
      • mimikatz.exe (PID: 6700)
      • Population.exe (PID: 7108)

    • Reads Environment values

      • 4363463463464363463463463.exe (PID: 6512)
      • KB824105-x86-ENU.exe (PID: 6984)

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 6512)
      • peinf.exe (PID: 6644)
      • pi.exe (PID: 6664)
      • t1.exe (PID: 6684)
      • pp.exe (PID: 6704)
      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • 2861732127.exe (PID: 640)
      • 363014155.exe (PID: 872)
      • 239823184.exe (PID: 5196)
      • sysmysldrv.exe (PID: 5116)
      • 72094654.exe (PID: 5540)
      • 2789214706.exe (PID: 6156)
      • 3457411655.exe (PID: 1344)
      • 2990227768.exe (PID: 208)
      • 830128787.exe (PID: 6200)
      • 1894712399.exe (PID: 2180)
      • 2821219799.exe (PID: 2636)
      • 1954338341.exe (PID: 6360)
      • 2961713205.exe (PID: 6304)
      • wupgrdsv.exe (PID: 5304)
      • 417311002.exe (PID: 1536)
      • 2921726330.exe (PID: 5220)
      • zhw10.exe (PID: 6832)
      • o.exe (PID: 2336)
      • 11.exe (PID: 1492)
      • nc64.exe (PID: 6440)
      • tt.exe (PID: 7092)
      • tpeinf.exe (PID: 6936)
      • r.exe (PID: 6932)
      • sysarddrvs.exe (PID: 6188)
      • aaa.exe (PID: 6908)
      • npp.exe (PID: 6540)
      • m.exe (PID: 7064)
      • a.exe (PID: 5980)
      • ChatLife.exe (PID: 6956)
      • 91691011.exe (PID: 2384)
      • 102998359.exe (PID: 6332)
      • Paraguay.pif (PID: 2992)
      • pei.exe (PID: 6720)
      • nxmr.exe (PID: 3684)
      • tdrpload.exe (PID: 3292)
      • DownSysSoft.exe (PID: 5232)
      • 411220961.exe (PID: 304)
      • twztl.exe (PID: 1688)
      • KB824105-x86-ENU.exe (PID: 6984)
      • t2.exe (PID: 4592)
      • wupgrdsv.exe (PID: 6228)
      • 2703228514.exe (PID: 5168)
      • newtpp.exe (PID: 1168)
      • Downdd.exe (PID: 2248)
      • t.exe (PID: 2456)
      • 1327411970.exe (PID: 6900)
      • radbxnzdxbd.exe (PID: 6952)
      • 332493390.exe (PID: 5168)
      • SP.exe (PID: 3984)
      • s.exe (PID: 6688)
      • server.exe (PID: 3684)
      • 243031083.exe (PID: 1692)
      • Paraguay.pif (PID: 6692)
      • %5Binstall%5D.exe (PID: 6704)
      • 1.exe (PID: 2424)
      • %5Binstall%5D.exe (PID: 6656)
      • %5Binstall%5D.exe (PID: 964)
      • QQ.exe (PID: 2400)
      • ber.exe (PID: 6364)
      • build_2024-07-25_20-56.exe (PID: 6920)
      • 2.exe (PID: 6440)
      • Population.exe (PID: 7108)
      • mimikatz.exe (PID: 6700)

    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 6512)
      • KB824105-x86-ENU.exe (PID: 6984)

    • Process checks computer location settings

      • 4363463463464363463463463.exe (PID: 6512)
      • sysmysldrv.exe (PID: 5116)
      • sysarddrvs.exe (PID: 6188)
      • ChatLife.exe (PID: 6956)

    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 6512)
      • sylsplvc.exe (PID: 6820)
      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • KB824105-x86-ENU.exe (PID: 6984)
      • SP.exe (PID: 3984)
      • server.exe (PID: 3684)
      • sysarddrvs.exe (PID: 6188)

    • Checks proxy server information

      • 4363463463464363463463463.exe (PID: 6512)
      • sysmablsvr.exe (PID: 6728)
      • sylsplvc.exe (PID: 6820)
      • 2861732127.exe (PID: 640)
      • sysmysldrv.exe (PID: 5116)
      • 2789214706.exe (PID: 6156)
      • 1894712399.exe (PID: 2180)
      • tpeinf.exe (PID: 6936)
      • npp.exe (PID: 6540)
      • sysarddrvs.exe (PID: 6188)
      • DownSysSoft.exe (PID: 5232)
      • pei.exe (PID: 6720)
      • KB824105-x86-ENU.exe (PID: 6984)
      • server.exe (PID: 3684)

    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 6512)
      • server.exe (PID: 3684)

    • Creates files or folders in the user directory

      • sysmablsvr.exe (PID: 6728)
      • sysmysldrv.exe (PID: 5116)
      • 2789214706.exe (PID: 6156)
      • 1894712399.exe (PID: 2180)
      • wupgrdsv.exe (PID: 5304)
      • tpeinf.exe (PID: 6936)
      • sysarddrvs.exe (PID: 6188)
      • Paraguay.pif (PID: 2992)
      • DownSysSoft.exe (PID: 5232)

    • Create files in a temporary directory

      • sysmablsvr.exe (PID: 6728)
      • 2861732127.exe (PID: 640)
      • sylsplvc.exe (PID: 6820)
      • sysmysldrv.exe (PID: 5116)
      • 2789214706.exe (PID: 6156)
      • 1894712399.exe (PID: 2180)
      • wupgrdsv.exe (PID: 5304)
      • tpeinf.exe (PID: 6936)
      • npp.exe (PID: 6540)
      • ChatLife.exe (PID: 6956)
      • sysarddrvs.exe (PID: 6188)
      • DownSysSoft.exe (PID: 5232)
      • pei.exe (PID: 6720)
      • radbxnzdxbd.exe (PID: 6952)
      • wupgrdsv.exe (PID: 6228)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6688)
      • powershell.exe (PID: 4664)
      • powershell.exe (PID: 6536)
      • powershell.exe (PID: 3276)
      • powershell.exe (PID: 4780)
      • powershell.exe (PID: 6316)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6688)
      • powershell.exe (PID: 3276)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6680)
      • Taskmgr.exe (PID: 2628)
      • powershell.exe (PID: 4664)
      • powershell.exe (PID: 6536)
      • schtasks.exe (PID: 2152)
      • notepad.exe (PID: 320)
      • powershell.exe (PID: 4780)
      • schtasks.exe (PID: 2648)
      • powershell.exe (PID: 6316)
      • notepad.exe (PID: 2476)
      • %5Binstall%5D.exe (PID: 964)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6680)

    • Reads the time zone

      • MoUsoCoreWorker.exe (PID: 6392)

    • Creates files in the program directory

      • MoUsoCoreWorker.exe (PID: 6392)

    • Reads mouse settings

      • Paraguay.pif (PID: 2992)
      • DownSysSoft.exe (PID: 5232)
      • Downdd.exe (PID: 2248)

    • UPX packer has been detected

      • %5Binstall%5D.exe (PID: 6704)
      • %5Binstall%5D.exe (PID: 6656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RisePro

(PID) Process(6692) Paraguay.pif
C2 (1)3.36.173.8:50500
Strings (55)\Signal
\OpenVPN Connect\profiles
\tlauncher_profiles.json
\Local Storage
\Microsoft\Skype for Desktop\Local Storage
\GHISLER\wcx_ftp.ini
\config.json
\.purple
\ey_tokens.txt
\Growtopia
\Element\Local Storage
\save.dat
frug?0
\launcher_msa_credentials.bin
\TLauncher
\OpenVPN Connect
\databases
\Games
\accounts.txt
\TotalCommander
UaEt,
VaultCloseVault
\.minecraft\launcher_msa_credentials.bin
\Element
\.lunarclient\settings\games\accounts.txt
\Growtopia\save.dat
\Skype
\FeatherClient
\launcher_accounts.json
C:\program files\steam
\wcx_ftp.ini
logins
C:\program files (x86)\steam
\Steam
\launcher_profiles.json
S,{w_6
\.minecraft\launcher_accounts.json
\Battle.net
\config
\accounts.xml
WSASend
\Messengers
\Session Storage
J~|Hw
\.feather\accounts.json
\LunarClient
APPDATA
\.minecraft\launcher_profiles.json
\accounts.json
VaultOpenVault
VaultGetItem
\Minecraft
\FileZilla
\Pidgin
\ICQ\0001
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
272
Monitored processes
135
Malicious processes
27
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #HAUSBOMBER 4363463463464363463463463.exe conhost.exe no specs peinf.exe pi.exe t1.exe pp.exe no specs #PHORPIEX sysmablsvr.exe #PHORPIEX sylsplvc.exe 2861732127.exe #PHORPIEX svchost.exe 363014155.exe no specs 239823184.exe #PHORPIEX sysmysldrv.exe 72094654.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs 2789214706.exe 3457411655.exe no specs 2990227768.exe no specs 830128787.exe no specs 1894712399.exe taskmgr.exe no specs taskmgr.exe 2821219799.exe no specs 2921726330.exe no specs 1954338341.exe 2961713205.exe no specs powershell.exe conhost.exe no specs schtasks.exe conhost.exe no specs wupgrdsv.exe mousocoreworker.exe no specs usoclient.exe no specs 417311002.exe no specs powershell.exe conhost.exe no specs #MINER notepad.exe zhw10.exe o.exe no specs 11.exe nc64.exe no specs conhost.exe no specs m.exe no specs tt.exe no specs tpeinf.exe r.exe no specs #PHORPIEX sysarddrvs.exe aaa.exe npp.exe a.exe no specs chatlife.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs 91691011.exe no specs cmd.exe conhost.exe no specs 102998359.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs paraguay.pif timeout.exe no specs nxmr.exe pei.exe cmd.exe conhost.exe no specs system downsyssoft.exe 411220961.exe no specs twztl.exe no specs tdrpload.exe no specs 2703228514.exe no specs kb824105-x86-enu.exe powershell.exe t2.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs schtasks.exe conhost.exe no specs wupgrdsv.exe 1327411970.exe no specs radbxnzdxbd.exe newtpp.exe no specs powershell.exe conhost.exe no specs #MINER notepad.exe downdd.exe no specs t.exe no specs 332493390.exe no specs sp.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs #RISEPRO paraguay.pif #XFILES server.exe s.exe no specs 243031083.exe no specs THREAT %5binstall%5d.exe conhost.exe no specs 1.exe no specs rundll32.exe no specs %5binstall%5d.exe no specs conhost.exe no specs THREAT %5binstall%5d.exe qq.exe ber.exe no specs mimikatz.exe no specs conhost.exe no specs 2.exe no specs build_2024-07-25_20-56.exe no specs population.exe no specs 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4System
[System Process]
User:
SYSTEM
Integrity Level:
SYSTEM
208C:\Users\admin\AppData\Local\Temp\2990227768.exeC:\Users\admin\AppData\Local\Temp\2990227768.exe—sylsplvc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2990227768.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
304C:\Users\admin\AppData\Local\Temp\411220961.exeC:\Users\admin\AppData\Local\Temp\411220961.exe—sysarddrvs.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\411220961.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
320C:\WINDOWS\System32\notepad.exeC:\Windows\System32\notepad.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\tvaifjwjgvdx.tmp
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
640C:\Users\admin\AppData\Local\Temp\2861732127.exeC:\Users\admin\AppData\Local\Temp\2861732127.exe
sysmablsvr.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2861732127.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
872C:\Users\admin\AppData\Local\Temp\363014155.exeC:\Users\admin\AppData\Local\Temp\363014155.exe—sylsplvc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\363014155.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
876"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITSC:\Windows\SysWOW64\cmd.exe—sysarddrvs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
964"C:\Users\admin\Desktop\Files\%5Binstall%5D.exe" C:\Users\admin\Desktop\Files\%5Binstall%5D.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\%5binstall%5d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1168cmd /c md 768318C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1168"C:\Users\admin\Desktop\Files\newtpp.exe" C:\Users\admin\Desktop\Files\newtpp.exe—4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\newtpp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
88 163
Read events
87 596
Write events
563
Delete events
4

Modification events

(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6512) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
109
Suspicious files
117
Text files
25
Unknown types
2

Dropped files

PID
Process
Filename
Type
65124363463463464363463463463.exeC:\Users\admin\Desktop\Files\pp.exeexecutable
MD5:ABABCA6D12D96E8DD2F1D7114B406FAE
SHA256:A992920E64A64763F3DD8C2A431A0F5E56E5B3782A1496DE92BC80EE71CCA5BA
6684t1.exeC:\Windows\sysmablsvr.exeexecutable
MD5:ABABCA6D12D96E8DD2F1D7114B406FAE
SHA256:A992920E64A64763F3DD8C2A431A0F5E56E5B3782A1496DE92BC80EE71CCA5BA
65124363463463464363463463463.exeC:\Users\admin\Desktop\Files\pi.exeexecutable
MD5:1E8A2ED2E3F35620FB6B8C2A782A57F3
SHA256:3F16F4550826076B2C8CD7B392EE649AEB06740328658A2D30C3D2002C6B7879
65124363463463464363463463463.exeC:\Users\admin\Desktop\Files\t1.exeexecutable
MD5:ABABCA6D12D96E8DD2F1D7114B406FAE
SHA256:A992920E64A64763F3DD8C2A431A0F5E56E5B3782A1496DE92BC80EE71CCA5BA
6728sysmablsvr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\1[1]binary
MD5:ACC5E9F20EF10165FF0F014F9600E868
SHA256:17711519F3938EE9C93E1B15ADE22A17CFA70FFFCE02C2B1B2C77959626AB6DE
6664pi.exeC:\Windows\sylsplvc.exeexecutable
MD5:1E8A2ED2E3F35620FB6B8C2A782A57F3
SHA256:3F16F4550826076B2C8CD7B392EE649AEB06740328658A2D30C3D2002C6B7879
6820sylsplvc.exeC:\Users\admin\AppData\Local\Temp\72094654.exebinary
MD5:E57F9E2FC24A1ACE0267A7962C9E465E
SHA256:AA66DF748EF74DF48C7D1C2954C49702B15E95787B1D3B562DBA50894ABC0910
6728sysmablsvr.exeC:\Users\admin\AppData\Local\Temp\239823184.exebinary
MD5:E57F9E2FC24A1ACE0267A7962C9E465E
SHA256:AA66DF748EF74DF48C7D1C2954C49702B15E95787B1D3B562DBA50894ABC0910
6728sysmablsvr.exeC:\Users\admin\AppData\Local\Temp\2861732127.exebinary
MD5:ACC5E9F20EF10165FF0F014F9600E868
SHA256:17711519F3938EE9C93E1B15ADE22A17CFA70FFFCE02C2B1B2C77959626AB6DE
6820sylsplvc.exeC:\Users\admin\AppData\Local\Temp\363014155.exebinary
MD5:ACC5E9F20EF10165FF0F014F9600E868
SHA256:17711519F3938EE9C93E1B15ADE22A17CFA70FFFCE02C2B1B2C77959626AB6DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
269
DNS requests
42
Threats
229

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6512
4363463463464363463463463.exe
GET
200
185.215.113.84:80
http://fd8a7ef9-faae-4c3c-814a-376eb024783e.random.tsrv1.ws/pi.exe
unknown
—
—
malicious
6512
4363463463464363463463463.exe
GET
200
185.215.113.84:80
http://a012a656-f566-48a1-afad-3dcc46018380.random.tsrv1.ws/peinf.exe
unknown
—
—
malicious
6512
4363463463464363463463463.exe
GET
200
185.215.113.66:80
http://skyjsihnqew.fihsifuiiusuiuduf.com/t1.exe
unknown
—
—
malicious
6512
4363463463464363463463463.exe
GET
200
185.215.113.84:80
http://d166ab3b-91ab-410f-a50d-c702fa55858d.random.tsrv1.ws/pp.exe
unknown
—
—
malicious
6728
sysmablsvr.exe
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
—
—
—
6512
4363463463464363463463463.exe
GET
200
121.61.248.112:808
http://121.61.248.112:808/zhw10.exe
unknown
—
—
—
6728
sysmablsvr.exe
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
—
—
—
2608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
640
2861732127.exe
GET
404
185.215.113.66:80
http://twizt.net/BNTOTSTATS
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3140
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2464
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6512
4363463463464363463463463.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
6512
4363463463464363463463463.exe
185.215.113.84:80
a012a656-f566-48a1-afad-3dcc46018380.random.tsrv1.ws
1337team Limited
SC
unknown
6512
4363463463464363463463463.exe
185.215.113.66:80
skyjsihnqew.fihsifuiiusuiuduf.com
1337team Limited
SC
unknown
6512
4363463463464363463463463.exe
121.61.248.112:808
—
Chinanet
CN
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.174
whitelisted
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.194.49
  • 151.101.130.49
whitelisted
a012a656-f566-48a1-afad-3dcc46018380.random.tsrv1.ws
  • 185.215.113.84
malicious
fd8a7ef9-faae-4c3c-814a-376eb024783e.random.tsrv1.ws
  • 185.215.113.84
malicious
skyjsihnqew.fihsifuiiusuiuduf.com
  • 185.215.113.66
unknown
d166ab3b-91ab-410f-a50d-c702fa55858d.random.tsrv1.ws
  • 185.215.113.84
malicious
www.bing.com
  • 104.126.37.160
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.162
  • 104.126.37.177
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.168
  • 104.126.37.153
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.22
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
36 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4363463463464363463463463.exe