File name:

DCRat.exe

Full analysis: https://app.any.run/tasks/59f0e6e7-def5-42ca-82a1-a2ef469f9435
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: February 19, 2025, 12:21:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
dcrat
rat
remote
darkcrystal
stealer
evasion
telegram
netreactor
wmi-base64
susp-powershell
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

92AC12A73C0E89B00B7CB8439115C4A7

SHA1:

A6A088EB5B65DE707F871200C1DE41F9753598C9

SHA256:

3FCC50BAA12B8F7D8F6071B1B2C5A39D4486A4DD26A4E41211A0C95FCE42F52C

SSDEEP:

98304:syi3V4T1M82DK9oDnx9cmzT7CTyBNUiOog7lgz8rJTkZXXsMglp3adt1:5BIv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DCRAT has been detected (YARA)

      • wscript.exe (PID: 6568)
      • System.exe (PID: 6460)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6568)

    • DCRAT mutex has been found

      • ChainPerf.exe (PID: 3524)
      • System.exe (PID: 6460)

    • Connects to the CnC server

      • System.exe (PID: 6460)

    • Steals credentials from Web Browsers

      • System.exe (PID: 6460)

    • Actions looks like stealing of personal data

      • System.exe (PID: 6460)

    • DARKCRYSTAL has been detected (SURICATA)

      • System.exe (PID: 6460)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DCRat.exe (PID: 6416)
      • ChainPerf.exe (PID: 3524)

    • Executable content was dropped or overwritten

      • DCRat.exe (PID: 6416)
      • ChainPerf.exe (PID: 3524)
      • System.exe (PID: 6460)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 6568)
      • ChainPerf.exe (PID: 3524)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6568)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6568)
      • ChainPerf.exe (PID: 3524)

    • Reads the date of Windows installation

      • ChainPerf.exe (PID: 3524)

    • The process creates files with name similar to system file names

      • ChainPerf.exe (PID: 3524)

    • There is functionality for taking screenshot (YARA)

      • System.exe (PID: 6460)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • System.exe (PID: 6460)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6304)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6304)

    • The executable file from the user directory is run by the CMD process

      • System.exe (PID: 6460)

    • Loads DLL from Mozilla Firefox

      • System.exe (PID: 6460)

    • Checks for external IP

      • System.exe (PID: 6460)
      • svchost.exe (PID: 2192)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • System.exe (PID: 6460)

  • INFO

    • Reads the computer name

      • DCRat.exe (PID: 6416)
      • ChainPerf.exe (PID: 3524)
      • System.exe (PID: 6460)

    • Checks supported languages

      • ChainPerf.exe (PID: 3524)
      • chcp.com (PID: 712)
      • DCRat.exe (PID: 6416)
      • System.exe (PID: 6460)

    • Reads the machine GUID from the registry

      • ChainPerf.exe (PID: 3524)
      • System.exe (PID: 6460)

    • Process checks computer location settings

      • ChainPerf.exe (PID: 3524)
      • DCRat.exe (PID: 6416)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6304)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • DCRat.exe (PID: 6416)

    • Create files in a temporary directory

      • ChainPerf.exe (PID: 3524)
      • System.exe (PID: 6460)

    • Reads Environment values

      • ChainPerf.exe (PID: 3524)
      • System.exe (PID: 6460)

    • Failed to create an executable file in Windows directory

      • ChainPerf.exe (PID: 3524)

    • .NET Reactor protector has been detected

      • System.exe (PID: 6460)

    • Disables trace logs

      • System.exe (PID: 6460)

    • Checks proxy server information

      • System.exe (PID: 6460)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • System.exe (PID: 6460)

    • Reads the software policy settings

      • System.exe (PID: 6460)

    • Found Base64 encoded reference to WMI classes (YARA)

      • System.exe (PID: 6460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(6460) System.exe
C2 (1)http://940706cm.nyashnyash.ru/videoUniversalcdn
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7false
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
C2 (1)http://940706cm.nyashnyash.ru/videoUniversalcdn
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7false
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 162304
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dcrat.exe #DCRAT wscript.exe no specs cmd.exe no specs conhost.exe no specs #DCRAT chainperf.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT system.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
648C:\WINDOWS\system32\cmd.exe /c ""C:\WinIntoref\t4wcB28yLMMDxaocAzIVA7TkW77JT5W4b.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
712chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3524"C:\WinIntoref/ChainPerf.exe"C:\WinIntoref\ChainPerf.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\winintoref\chainperf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6304C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\YfRHFEP9cK.bat" "C:\Windows\System32\cmd.exe—ChainPerf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6416"C:\Users\admin\AppData\Local\Temp\DCRat.exe" C:\Users\admin\AppData\Local\Temp\DCRat.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dcrat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6460"C:\Users\admin\Documents\My Music\System.exe" C:\Users\admin\Music\System.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.2.7.1277
Modules
Images
c:\users\admin\music\system.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
DcRat
(PID) Process(6460) System.exe
C2 (1)http://940706cm.nyashnyash.ru/videoUniversalcdn
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7false
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
(PID) Process(6460) System.exe
C2 (1)http://940706cm.nyashnyash.ru/videoUniversalcdn
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7false
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
6508ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
Total events
3 518
Read events
3 501
Write events
17
Delete events
0

Modification events

(PID) Process:(6416) DCRat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(3524) ChainPerf.exeKey:HKEY_CURRENT_USER\SOFTWARE\fa63dd1c2290fe13dd5686be5c54e70de898163c
Operation:writeName:2d5c0da6a72a51ec2fc1a03643ab24fc0c1fca7d
Value:
H4sIAAAAAAAEAHXMsQ7CMAwE0F9BnREfwEgZYKiEgIoBM4TEoVEUW7IdRP8exAjKevfurl2/Brgk2pOxYAS4O58fwpXC2WnesdoKX9gt/2BksiDPqS2C05/9qCgK4EJJBLBlXwuSfZJhXgxVkwc4zWpYGo/HSpYKboQzSsP0k0t0QInf/vYGO6BfFOIAAAA=
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6460) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
16
Suspicious files
21
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
3524ChainPerf.exeC:\WinIntoref\fontdrvhost.exeexecutable
MD5:670ABB7EC2B976A415B5581E7EEF5073
SHA256:7B0666F24EF2C3692FCA4AF6DA78E1761DF719E309EB0737C2C8CD21C30BE843
3524ChainPerf.exeC:\Users\admin\Desktop\JKNzOGER.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
6416DCRat.exeC:\WinIntoref\t4wcB28yLMMDxaocAzIVA7TkW77JT5W4b.battext
MD5:6B86AA5A7980EFFE957A32C555AB8A90
SHA256:A889A330A63316976FAF98D671A487F4D5BC5E5DB97CEA7860DDFDD7C5CA9BF6
3524ChainPerf.exeC:\WinIntoref\9e8d7a4ca61bd9text
MD5:AC632A8EE249470E83164F5E0E1A255F
SHA256:4033D4B4A6FE255513B038209CA10E870F44A9F1ABDA0F78A7A642F73DD3FB5D
3524ChainPerf.exeC:\WinIntoref\92728b0163a7d0text
MD5:F5687D84362F3EADC9F6C7CCAB465CE9
SHA256:D0615166C46EAEB8A4FC7A75381FA0F5FD888E6C4EAA9BCABFEB43242F5E85BB
3524ChainPerf.exeC:\Users\admin\Desktop\CmPkewel.logexecutable
MD5:69546E20149FE5633BCBA413DC3DC964
SHA256:B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
3524ChainPerf.exeC:\WinIntoref\dasHost.exeexecutable
MD5:670ABB7EC2B976A415B5581E7EEF5073
SHA256:7B0666F24EF2C3692FCA4AF6DA78E1761DF719E309EB0737C2C8CD21C30BE843
3524ChainPerf.exeC:\Users\admin\Music\27d1bcfc3c54e0text
MD5:BF0082944FF1DEB57907A08BA2306DEF
SHA256:2C78C19DB207975FB043A0C53BCB64EB0B04C89F745F70C7428434EDB28418D2
3524ChainPerf.exeC:\WinIntoref\21b1a557fd31cctext
MD5:B487BEAF6FB4CA52D0DDC0F8C71FE4CC
SHA256:9913964770D2560E5C36BCE955D97612883981AD2654DB202FD708DBE9259516
3524ChainPerf.exeC:\Users\admin\Music\System.exeexecutable
MD5:670ABB7EC2B976A415B5581E7EEF5073
SHA256:7B0666F24EF2C3692FCA4AF6DA78E1761DF719E309EB0737C2C8CD21C30BE843
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
138
TCP/UDP connections
37
DNS requests
22
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
488
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
488
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6696
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6460
System.exe
POST
200
172.67.144.20:80
http://940706cm.nyashnyash.ru/videoUniversalcdn.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1344
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
488
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
488
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.129
  • 104.126.37.163
  • 104.126.37.131
  • 104.126.37.170
  • 104.126.37.168
  • 104.126.37.178
  • 104.126.37.171
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
whitelisted
google.com
  • 142.250.184.206
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.160.67
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
6460
System.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
6460
System.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
6460
System.exe
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6460
System.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
2192
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2192
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
6460
System.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
6460
System.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DCRat.exe