We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
21 January 2022, 01:01
Analysis environment:
Windows 7 Pro, build 7601, x64
ldrmgan18011.exe
MD5:
46FA5C3B6FDF73BEFE0A50031999ECB2
SHA1:
0EDE58F3CFF351439B94E2E81B2E4495340FEED3
SHA256:
3DFD99F196890BA6195F1ED90DA2F3263B5A2F001D313741DF764E7F14606B40
Analysis result
Threat level:
Malicious activity
Tags:
unwanted
netsupport
Full analysis:
Analysis ldrmgan18011.exe (MD5: 46FA5C3B6FDF73BEFE0A50031999ECB2) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Writes to a start menu file
ldrmgan18011.exe (PID: 2068)
Drops executable file immediately after starts
ldrmgan18011.exe (PID: 2068)
Connects to CnC server
client32.exe (PID: 1456)
Loads dropped or rewritten executable
client32.exe (PID: 1456)
Application was dropped or rewritten from another process
client32.exe (PID: 1456)
SUSPICIOUS
Reads the computer name
ldrmgan18011.exe (PID: 2068)
client32.exe (PID: 1456)
Checks supported languages
ldrmgan18011.exe (PID: 2068)
client32.exe (PID: 1456)
Creates files in the user directory
ldrmgan18011.exe (PID: 2068)
Drops a file that was compiled in debug mode
ldrmgan18011.exe (PID: 2068)
Executable content was dropped or overwritten
ldrmgan18011.exe (PID: 2068)
Executed via COM
DllHost.exe (PID: 2120)
INFO
Checks supported languages
DllHost.exe (PID: 2120)
Reads the computer name
DllHost.exe (PID: 2120)
Threats
PID
Process
Class
Message
1456
client32.exe
Potential Corporate Privacy Violation
ET POLICY NetSupport GeoLocation Lookup Request