Malware analysis https://magicalbound.com/ Malicious activity

Add for printing

URL:	https://magicalbound.com/
Full analysis:	https://app.any.run/tasks/c9bb50ed-6313-4d2a-8ca3-b318c7e51b66
Verdict:	Malicious activity
Threats:	AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes. Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests. Stealc ist eine Stealer-Malware, die es auf die sensiblen Daten der Opfer abgesehen hat, die sie aus Browsern, Messaging-Apps und anderer Software exfiltriert. Die Malware ist mit fortschrittlichen Funktionen ausgestattet, darunter Fingerprinting, Bedienfeld, Umgehungsmechanismen, String-Verschleierung usw. Stealc stellt eine Persistenz her und kommuniziert mit seinem C2-Server über HTTP-POST-Anfragen. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	July 28, 2024, 17:25:21
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	evasion netreactor stealc stealer loader python crypto-regex rhadamanthys shellcode rat asyncrat remote
Indicators:
MD5:	F106F37B1DE18DE63AB414D3730BC9CE
SHA1:	3043DD3453244A7C4FEAB94EB0C9C9F34401AE42
SHA256:	4663F420418ECB86D2F6A9D1BDDAF12DBCEA286195E4AD8D57BFE7FCC29DCDAB
SSDEEP:	3:N8xqUGTK:2xqUR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Adds path to the Windows Defender exclusion list
  - Magicalbound.exe (PID: 4936)
  - Magicalbound.exe (PID: 4400)
- Drops the executable file immediately after the start
  - Magicalbound.exe (PID: 4936)
  - snss2.exe (PID: 7148)
  - msiexec.exe (PID: 5084)
  - IUService.exe (PID: 8052)
  - Magicalbound Setup.exe (PID: 2088)
  - snss2.exe (PID: 3396)
  - pythonw.exe (PID: 6044)
  - Magicalbound Setup.exe (PID: 5560)
  - Magicalbound Setup.exe (PID: 8028)
  - Magicalbound.exe (PID: 4400)
  - Ze8Ig.exe (PID: 8948)
  - Ze8Ig.exe (PID: 8896)
- STEALC has been detected (YARA)
  - explorer.exe (PID: 7124)
  - explorer.exe (PID: 8756)
- Stealers network behavior
  - explorer.exe (PID: 7124)
  - OOBE-Maintenance.exe (PID: 8636)
  - explorer.exe (PID: 8756)
- STEALC has been detected (SURICATA)
  - explorer.exe (PID: 7124)
  - explorer.exe (PID: 8756)
- Connects to the CnC server
  - explorer.exe (PID: 7124)
  - explorer.exe (PID: 8756)
- Steals credentials from Web Browsers
  - explorer.exe (PID: 7124)
- RHADAMANTHYS has been detected (SURICATA)
  - OpenWith.exe (PID: 8580)
  - OOBE-Maintenance.exe (PID: 8636)
- RHADAMANTHYS has been detected (YARA)
  - OOBE-Maintenance.exe (PID: 8636)
- ASYNCRAT has been detected (SURICATA)
  - AppLaunch.exe (PID: 8920)
- ASYNCRAT has been detected (YARA)
  - AppLaunch.exe (PID: 8920)
- Actions looks like stealing of personal data
  - OOBE-Maintenance.exe (PID: 8636)
  - explorer.exe (PID: 7124)
SUSPICIOUS
- Process drops legitimate windows executable
  - Magicalbound Setup.exe (PID: 2088)
  - explorer.exe (PID: 7124)
  - snss2.exe (PID: 3396)
  - pythonw.exe (PID: 6044)
- Executable content was dropped or overwritten
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound.exe (PID: 4936)
  - explorer.exe (PID: 7124)
  - snss2.exe (PID: 7148)
  - snss2.exe (PID: 3396)
  - IUService.exe (PID: 8052)
  - Magicalbound Setup.exe (PID: 5560)
  - Magicalbound Setup.exe (PID: 8028)
  - pythonw.exe (PID: 6044)
  - Magicalbound.exe (PID: 4400)
  - OOBE-Maintenance.exe (PID: 8636)
  - Ze8Ig.exe (PID: 8948)
  - Ze8Ig.exe (PID: 8896)
- The process creates files with name similar to system file names
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound Setup.exe (PID: 5560)
- Malware-specific behavior (creating "System.dll" in Temp)
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound Setup.exe (PID: 5560)
- The process drops C-runtime libraries
  - Magicalbound Setup.exe (PID: 2088)
  - explorer.exe (PID: 7124)
  - snss2.exe (PID: 3396)
  - pythonw.exe (PID: 6044)
- Creates a software uninstall entry
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound Setup.exe (PID: 5560)
- Script adds exclusion path to Windows Defender
  - Magicalbound.exe (PID: 4936)
  - Magicalbound.exe (PID: 4400)
- Starts POWERSHELL.EXE for commands execution
  - Magicalbound.exe (PID: 4936)
  - Magicalbound.exe (PID: 4400)
- Starts CMD.EXE for commands execution
  - snss1.exe (PID: 4400)
  - IUService.exe (PID: 700)
  - pythonw.exe (PID: 2476)
  - snss1.exe (PID: 8460)
  - m-@@a.exe (PID: 9056)
- Checks for external IP
  - svchost.exe (PID: 2284)
- Searches for installed software
  - explorer.exe (PID: 7124)
  - Magicalbound Setup.exe (PID: 8028)
  - Magicalbound Setup.exe (PID: 5560)
  - OOBE-Maintenance.exe (PID: 8636)
- Connects to the server without a host name
  - explorer.exe (PID: 7124)
  - explorer.exe (PID: 8756)
- Windows Defender mutex has been found
  - explorer.exe (PID: 7124)
  - explorer.exe (PID: 8756)
- Contacting a server suspected of hosting an CnC
  - explorer.exe (PID: 7124)
  - OOBE-Maintenance.exe (PID: 8636)
  - OpenWith.exe (PID: 8580)
  - AppLaunch.exe (PID: 8920)
  - explorer.exe (PID: 8756)
- Process requests binary or script from the Internet
  - explorer.exe (PID: 7124)
- Executes as Windows Service
  - VSSVC.exe (PID: 6040)
- Potential Corporate Privacy Violation
  - explorer.exe (PID: 7124)
- The process drops Mozilla's DLL files
  - explorer.exe (PID: 7124)
- Starts itself from another location
  - snss2.exe (PID: 7148)
  - IUService.exe (PID: 8052)
  - pythonw.exe (PID: 6044)
  - Ze8Ig.exe (PID: 8896)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 5084)
- Loads Python modules
  - pythonw.exe (PID: 6044)
  - pythonw.exe (PID: 2476)
- Found regular expressions for crypto-addresses (YARA)
  - explorer.exe (PID: 6164)
- The process checks if it is being run in the virtual environment
  - OpenWith.exe (PID: 8580)
- Loads DLL from Mozilla Firefox
  - OOBE-Maintenance.exe (PID: 8636)
- Connects to unusual port
  - AppLaunch.exe (PID: 8920)
- Process drops SQLite DLL files
  - Ze8Ig.exe (PID: 8948)
INFO
- Checks proxy server information
  - slui.exe (PID: 7868)
  - slui.exe (PID: 1584)
  - Magicalbound.exe (PID: 4936)
  - explorer.exe (PID: 7124)
  - Magicalbound.exe (PID: 4400)
  - explorer.exe (PID: 8756)
- Executable content was dropped or overwritten
  - msedge.exe (PID: 4816)
  - msiexec.exe (PID: 5084)
- Reads Microsoft Office registry keys
  - msedge.exe (PID: 4816)
  - OOBE-Maintenance.exe (PID: 8636)
- Reads the software policy settings
  - slui.exe (PID: 7868)
  - slui.exe (PID: 1584)
  - Magicalbound.exe (PID: 4936)
  - explorer.exe (PID: 7124)
  - Magicalbound.exe (PID: 4400)
  - AppLaunch.exe (PID: 8920)
- Checks supported languages
  - identity_helper.exe (PID: 6064)
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound.exe (PID: 4936)
  - snss1.exe (PID: 4400)
  - msiexec.exe (PID: 5084)
  - snss2.exe (PID: 7148)
  - snss2.exe (PID: 3396)
  - IUService.exe (PID: 8052)
  - IUService.exe (PID: 700)
  - pythonw.exe (PID: 6044)
  - pythonw.exe (PID: 2476)
  - Magicalbound Setup.exe (PID: 8028)
  - Magicalbound Setup.exe (PID: 5560)
  - Magicalbound.exe (PID: 4400)
  - snss1.exe (PID: 8460)
  - wmplayer.exe (PID: 8836)
  - AppLaunch.exe (PID: 8920)
  - Ze8Ig.exe (PID: 8896)
  - Ze8Ig.exe (PID: 8948)
  - m-@@a.exe (PID: 9056)
- Reads the computer name
  - identity_helper.exe (PID: 6064)
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound.exe (PID: 4936)
  - snss1.exe (PID: 4400)
  - msiexec.exe (PID: 5084)
  - snss2.exe (PID: 3396)
  - IUService.exe (PID: 8052)
  - IUService.exe (PID: 700)
  - pythonw.exe (PID: 6044)
  - Magicalbound Setup.exe (PID: 5560)
  - Magicalbound Setup.exe (PID: 8028)
  - Magicalbound.exe (PID: 4400)
  - snss1.exe (PID: 8460)
  - AppLaunch.exe (PID: 8920)
  - Ze8Ig.exe (PID: 8948)
  - m-@@a.exe (PID: 9056)
  - pythonw.exe (PID: 2476)
- Drops the executable file immediately after the start
  - msedge.exe (PID: 4816)
  - explorer.exe (PID: 7124)
  - OOBE-Maintenance.exe (PID: 8636)
- The process uses the downloaded file
  - msedge.exe (PID: 6340)
  - msedge.exe (PID: 4816)
- Reads Environment values
  - identity_helper.exe (PID: 6064)
  - AppLaunch.exe (PID: 8920)
- Creates files in the program directory
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound.exe (PID: 4936)
  - explorer.exe (PID: 7124)
- Create files in a temporary directory
  - Magicalbound Setup.exe (PID: 2088)
  - Magicalbound.exe (PID: 4936)
  - snss1.exe (PID: 4400)
  - snss2.exe (PID: 3396)
  - IUService.exe (PID: 700)
  - pythonw.exe (PID: 2476)
  - Magicalbound Setup.exe (PID: 5560)
  - Magicalbound Setup.exe (PID: 8028)
  - snss1.exe (PID: 8460)
  - Magicalbound.exe (PID: 4400)
  - Ze8Ig.exe (PID: 8948)
  - m-@@a.exe (PID: 9056)
- Application launched itself
  - msedge.exe (PID: 4816)
- .NET Reactor protector has been detected
  - Magicalbound.exe (PID: 4936)
  - Magicalbound.exe (PID: 4400)
- Creates files or folders in the user directory
  - Magicalbound Setup.exe (PID: 2088)
  - explorer.exe (PID: 7124)
  - msiexec.exe (PID: 5084)
  - IUService.exe (PID: 8052)
  - pythonw.exe (PID: 6044)
  - OOBE-Maintenance.exe (PID: 8636)
  - explorer.exe (PID: 8756)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 2432)
  - powershell.exe (PID: 6484)
  - powershell.exe (PID: 5592)
  - powershell.exe (PID: 3668)
  - powershell.exe (PID: 4992)
  - powershell.exe (PID: 3396)
  - powershell.exe (PID: 2072)
  - powershell.exe (PID: 7732)
- Reads security settings of Internet Explorer
  - explorer.exe (PID: 7124)
  - OOBE-Maintenance.exe (PID: 8636)
  - explorer.exe (PID: 8756)
- Creates a software uninstall entry
  - msiexec.exe (PID: 5084)
- Reads the machine GUID from the registry
  - wmplayer.exe (PID: 8836)
  - AppLaunch.exe (PID: 8920)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

Stealc

(PID) Process(7124) explorer.exe

C2188.130.207.115

Strings (353)INSERT_KEY_HERE

GetProcAddress

LoadLibraryA

lstrcatA

OpenEventA

CreateEventA

CloseHandle

Sleep

GetUserDefaultLangID

VirtualAllocExNuma

VirtualFree

GetSystemInfo

VirtualAlloc

HeapAlloc

GetComputerNameA

lstrcpyA

GetProcessHeap

GetCurrentProcess

lstrlenA

ExitProcess

GlobalMemoryStatusEx

GetSystemTime

SystemTimeToFileTime

advapi32.dll

gdi32.dll

user32.dll

crypt32.dll

ntdll.dll

GetUserNameA

CreateDCA

GetDeviceCaps

ReleaseDC

CryptStringToBinaryA

sscanf

VMwareVMware

HAL9TH

JohnDoe

DISPLAY

%hu/%hu/%hu

http://188.130.207.115

markopolo

/8b4c5bd1ddc1cb18.php

/e17d80dfc540932e/

magicalkebab23

GetEnvironmentVariableA

GetFileAttributesA

GlobalLock

HeapFree

GetFileSize

GlobalSize

CreateToolhelp32Snapshot

IsWow64Process

Process32Next

GetLocalTime

FreeLibrary

GetTimeZoneInformation

GetSystemPowerStatus

GetVolumeInformationA

GetWindowsDirectoryA

Process32First

GetLocaleInfoA

GetUserDefaultLocaleName

GetModuleFileNameA

DeleteFileA

FindNextFileA

LocalFree

FindClose

SetEnvironmentVariableA

LocalAlloc

GetFileSizeEx

ReadFile

SetFilePointer

WriteFile

CreateFileA

FindFirstFileA

CopyFileA

VirtualProtect

GetLogicalProcessorInformationEx

GetLastError

lstrcpynA

MultiByteToWideChar

GlobalFree

WideCharToMultiByte

GlobalAlloc

OpenProcess

TerminateProcess

GetCurrentProcessId

gdiplus.dll

ole32.dll

bcrypt.dll

wininet.dll

shlwapi.dll

shell32.dll

psapi.dll

rstrtmgr.dll

CreateCompatibleBitmap

SelectObject

BitBlt

DeleteObject

CreateCompatibleDC

GdipGetImageEncodersSize

GdipGetImageEncoders

GdipCreateBitmapFromHBITMAP

GdiplusStartup

GdiplusShutdown

GdipSaveImageToStream

GdipDisposeImage

GdipFree

GetHGlobalFromStream

CreateStreamOnHGlobal

CoUninitialize

CoInitialize

CoCreateInstance

BCryptGenerateSymmetricKey

BCryptCloseAlgorithmProvider

BCryptDecrypt

BCryptSetProperty

BCryptDestroyKey

BCryptOpenAlgorithmProvider

GetWindowRect

GetDesktopWindow

GetDC

CloseWindow

wsprintfA

EnumDisplayDevicesA

GetKeyboardLayoutList

CharToOemW

wsprintfW

RegQueryValueExA

RegEnumKeyExA

RegOpenKeyExA

RegCloseKey

RegEnumValueA

CryptBinaryToStringA

CryptUnprotectData

SHGetFolderPathA

ShellExecuteExA

InternetOpenUrlA

InternetConnectA

InternetCloseHandle

InternetOpenA

HttpSendRequestA

HttpOpenRequestA

InternetReadFile

InternetCrackUrlA

StrCmpCA

StrStrA

StrCmpCW

PathMatchSpecA

GetModuleFileNameExA

RmStartSession

RmRegisterResources

RmGetList

RmEndSession

sqlite3_open

sqlite3_prepare_v2

sqlite3_step

sqlite3_column_text

sqlite3_finalize

sqlite3_close

sqlite3_column_bytes

sqlite3_column_blob

encrypted_key

PATH

C:\ProgramData\nss3.dll

NSS_Init

NSS_Shutdown

PK11_GetInternalKeySlot

PK11_FreeSlot

PK11_Authenticate

PK11SDR_Decrypt

C:\ProgramData\

SELECT origin_url, username_value, password_value FROM logins

browser:

profile:

url:

password:

Opera

OperaGX

Network

.txt

SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies

TRUE

FALSE

autofill

SELECT name, value FROM autofill

history

SELECT url FROM urls LIMIT 1000

SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards

name:

month:

year:

card:

Web Data

History

logins.json

formSubmitURL

usernameField

encryptedUsername

encryptedPassword

guid

SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies

SELECT fieldname, value FROM moz_formhistory

SELECT url FROM moz_places LIMIT 1000

cookies.sqlite

formhistory.sqlite

places.sqlite

plugins

Local Extension Settings

Sync Extension Settings

IndexedDB

Opera Stable

Opera GX Stable

CURRENT

chrome-extension_

_0.indexeddb.leveldb

Local State

profiles.ini

chrome

opera

firefox

wallets

%08lX%04lX%lu

SOFTWARE\Microsoft\Windows NT\CurrentVersion

ProductName

x32

x64

%d/%d/%d %d:%d:%d

HARDWARE\DESCRIPTION\System\CentralProcessor\0

ProcessorNameString

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

DisplayName

DisplayVersion

Network Info:

- IP: IP?

- Country: ISO?

System Summary:

- HWID:

- OS:

- Architecture:

- UserName:

- Computer Name:

- Local Time:

- UTC:

- Language:

- Keyboards:

- Laptop:

- Running Path:

- CPU:

- Threads:

- Cores:

- RAM:

- Display Resolution:

- GPU:

User Agents:

Installed Apps:

All Users:

Current User:

Process List:

system_info.txt

freebl3.dll

mozglue.dll

msvcp140.dll

nss3.dll

softokn3.dll

vcruntime140.dll

\Temp\

.exe

runas

open

/c start

%DESKTOP%

%APPDATA%

%LOCALAPPDATA%

%USERPROFILE%

%DOCUMENTS%

%PROGRAMFILES%

%PROGRAMFILES_86%

%RECENT%

*.lnk

files

\discord\

\Local Storage\leveldb\CURRENT

\Local Storage\leveldb

\Telegram Desktop\

key_datas

D877F783D5D3EF8C*

map*

A7FDF864FBC10B77*

A92DAA6EA6F891F2*

F8806DD0C461824F*

Tox

*.tox

*.ini

Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\

00000001

00000002

00000003

00000004

\Outlook\accounts.txt

Pidgin

\.purple\

accounts.xml

dQw4w9WgXcQ

token:

Software\Valve\Steam

SteamPath

\config\

ssfn*

config.vdf

DialogConfig.vdf

DialogConfigOverlay*.vdf

libraryfolders.vdf

loginusers.vdf

\Steam\

sqlite3.dll

browsers

done

soft

\Discord\tokens.txt

/c timeout /t 5 & del /f /q "

" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\system32\cmd.exe

https

Content-Type: multipart/form-data; boundary=----

POST

HTTP/1.1

Content-Disposition: form-data; name="

hwid

build

token

file_name

file

message

ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890

screenshot.jpg

(PID) Process(8756) explorer.exe

C2188.130.207.115

Strings (353)INSERT_KEY_HERE

GetProcAddress

LoadLibraryA

lstrcatA

OpenEventA

CreateEventA

CloseHandle

Sleep

GetUserDefaultLangID

VirtualAllocExNuma

VirtualFree

GetSystemInfo

VirtualAlloc

HeapAlloc

GetComputerNameA

lstrcpyA

GetProcessHeap

GetCurrentProcess

lstrlenA

ExitProcess

GlobalMemoryStatusEx

GetSystemTime

SystemTimeToFileTime

advapi32.dll

gdi32.dll

user32.dll

crypt32.dll

ntdll.dll

GetUserNameA

CreateDCA

GetDeviceCaps

ReleaseDC

CryptStringToBinaryA

sscanf

VMwareVMware

HAL9TH

JohnDoe

DISPLAY

%hu/%hu/%hu

http://188.130.207.115

markopolo

/8b4c5bd1ddc1cb18.php

/e17d80dfc540932e/

magicalkebab23

GetEnvironmentVariableA

GetFileAttributesA

GlobalLock

HeapFree

GetFileSize

GlobalSize

CreateToolhelp32Snapshot

IsWow64Process

Process32Next

GetLocalTime

FreeLibrary

GetTimeZoneInformation

GetSystemPowerStatus

GetVolumeInformationA

GetWindowsDirectoryA

Process32First

GetLocaleInfoA

GetUserDefaultLocaleName

GetModuleFileNameA

DeleteFileA

FindNextFileA

LocalFree

FindClose

SetEnvironmentVariableA

LocalAlloc

GetFileSizeEx

ReadFile

SetFilePointer

WriteFile

CreateFileA

FindFirstFileA

CopyFileA

VirtualProtect

GetLogicalProcessorInformationEx

GetLastError

lstrcpynA

MultiByteToWideChar

GlobalFree

WideCharToMultiByte

GlobalAlloc

OpenProcess

TerminateProcess

GetCurrentProcessId

gdiplus.dll

ole32.dll

bcrypt.dll

wininet.dll

shlwapi.dll

shell32.dll

psapi.dll

rstrtmgr.dll

CreateCompatibleBitmap

SelectObject

BitBlt

DeleteObject

CreateCompatibleDC

GdipGetImageEncodersSize

GdipGetImageEncoders

GdipCreateBitmapFromHBITMAP

GdiplusStartup

GdiplusShutdown

GdipSaveImageToStream

GdipDisposeImage

GdipFree

GetHGlobalFromStream

CreateStreamOnHGlobal

CoUninitialize

CoInitialize

CoCreateInstance

BCryptGenerateSymmetricKey

BCryptCloseAlgorithmProvider

BCryptDecrypt

BCryptSetProperty

BCryptDestroyKey

BCryptOpenAlgorithmProvider

GetWindowRect

GetDesktopWindow

GetDC

CloseWindow

wsprintfA

EnumDisplayDevicesA

GetKeyboardLayoutList

CharToOemW

wsprintfW

RegQueryValueExA

RegEnumKeyExA

RegOpenKeyExA

RegCloseKey

RegEnumValueA

CryptBinaryToStringA

CryptUnprotectData

SHGetFolderPathA

ShellExecuteExA

InternetOpenUrlA

InternetConnectA

InternetCloseHandle

InternetOpenA

HttpSendRequestA

HttpOpenRequestA

InternetReadFile

InternetCrackUrlA

StrCmpCA

StrStrA

StrCmpCW

PathMatchSpecA

GetModuleFileNameExA

RmStartSession

RmRegisterResources

RmGetList

RmEndSession

sqlite3_open

sqlite3_prepare_v2

sqlite3_step

sqlite3_column_text

sqlite3_finalize

sqlite3_close

sqlite3_column_bytes

sqlite3_column_blob

encrypted_key

PATH

C:\ProgramData\nss3.dll

NSS_Init

NSS_Shutdown

PK11_GetInternalKeySlot

PK11_FreeSlot

PK11_Authenticate

PK11SDR_Decrypt

C:\ProgramData\

SELECT origin_url, username_value, password_value FROM logins

browser:

profile:

url:

password:

Opera

OperaGX

Network

.txt

SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies

TRUE

FALSE

autofill

SELECT name, value FROM autofill

history

SELECT url FROM urls LIMIT 1000

SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards

name:

month:

year:

card:

Web Data

History

logins.json

formSubmitURL

usernameField

encryptedUsername

encryptedPassword

guid

SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies

SELECT fieldname, value FROM moz_formhistory

SELECT url FROM moz_places LIMIT 1000

cookies.sqlite

formhistory.sqlite

places.sqlite

plugins

Local Extension Settings

Sync Extension Settings

IndexedDB

Opera Stable

Opera GX Stable

CURRENT

chrome-extension_

_0.indexeddb.leveldb

Local State

profiles.ini

chrome

opera

firefox

wallets

%08lX%04lX%lu

SOFTWARE\Microsoft\Windows NT\CurrentVersion

ProductName

x32

x64

%d/%d/%d %d:%d:%d

HARDWARE\DESCRIPTION\System\CentralProcessor\0

ProcessorNameString

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

DisplayName

DisplayVersion

Network Info:

- IP: IP?

- Country: ISO?

System Summary:

- HWID:

- OS:

- Architecture:

- UserName:

- Computer Name:

- Local Time:

- UTC:

- Language:

- Keyboards:

- Laptop:

- Running Path:

- CPU:

- Threads:

- Cores:

- RAM:

- Display Resolution:

- GPU:

User Agents:

Installed Apps:

All Users:

Current User:

Process List:

system_info.txt

freebl3.dll

mozglue.dll

msvcp140.dll

nss3.dll

softokn3.dll

vcruntime140.dll

\Temp\

.exe

runas

open

/c start

%DESKTOP%

%APPDATA%

%LOCALAPPDATA%

%USERPROFILE%

%DOCUMENTS%

%PROGRAMFILES%

%PROGRAMFILES_86%

%RECENT%

*.lnk

files

\discord\

\Local Storage\leveldb\CURRENT

\Local Storage\leveldb

\Telegram Desktop\

key_datas

D877F783D5D3EF8C*

map*

A7FDF864FBC10B77*

A92DAA6EA6F891F2*

F8806DD0C461824F*

Tox

*.tox

*.ini

Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\

00000001

00000002

00000003

00000004

\Outlook\accounts.txt

Pidgin

\.purple\

accounts.xml

dQw4w9WgXcQ

token:

Software\Valve\Steam

SteamPath

\config\

ssfn*

config.vdf

DialogConfig.vdf

DialogConfigOverlay*.vdf

libraryfolders.vdf

loginusers.vdf

\Steam\

sqlite3.dll

browsers

done

soft

\Discord\tokens.txt

/c timeout /t 5 & del /f /q "

" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\system32\cmd.exe

https

Content-Type: multipart/form-data; boundary=----

POST

HTTP/1.1

Content-Disposition: form-data; name="

hwid

build

token

file_name

file

message

ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890

screenshot.jpg

AsyncRat

(PID) Process(8920) AppLaunch.exe

C2 (1)85.192.63.68

Ports (1)8245

Version0.5.8

BotnetDefault

Options

AutoRunfalse

MutexLFs3tAXovKDK

InstallFolder%AppData%

BSoDfalse

AntiVMtrue

Certificates

Cert1MIIE4DCCAsigAwIBAgIQALLvjtCZHzFARtdMuD4D9TANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTZXJ2ZXIwIBcNMjQwNzEyMDgxODM0WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKxbGertDiPtLHGFUcSq7TdyuJxLgKnGUeCtUxiI7P90/qmVfUd6ms0P/aCWQGKZCKv+/dT2ENEMSj8wkD94AETP3KvhXqPSvZA6...

Server_SignaturemGHK9NzT6383ckP8iN8yBNB/fHCvRnFWdDYRpGfrAbiTtnlcUv34wU1KqF+JG5E8mWvhbjx/o9AktS+61WRoMDIer4ohBTpu9r9gHiQDQjCgMJIx/AC9Dm0B1Vf8ouDhFJdpzOqHuUlTFvrn36SeF2LMM3sF+f7sQzUeoIL1tTgRVuV1dRpY0eWblCGTj8szvu6dy5QUuoUSKRcgvJ27Gd4MI3VnJ596Hb6TNVy6sAa1/N5D7OGO2UwrDKMiRj57KUFyzQyxnrOy8vtwPYuTQvd0bvsIa7EuHB4wrT9bZxdJ...

Keys

AESedc7eeae28553d5aa15ef66746434def65f5caa5aae9471f897919e29ab07bb9

Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

269

Monitored processes

116

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

396

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6068 --field-trial-handle=2412,i,1821821946183819605,16333912008118307477,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

700

C:\Users\admin\AppData\Roaming\validateupload_debug\IUService.exe

—

IUService.exe

User:

admin

Company:

IObit

Integrity Level:

HIGH

Description:

IU Service Program

Exit code:

Version:

13.0.0.0

Modules

Images
c:\users\admin\appdata\roaming\validateupload_debug\iuservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll

1084

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7440 --field-trial-handle=2412,i,1821821946183819605,16333912008118307477,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1108

"C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\GCBKFIEBGC.msi" /passive

C:\Windows\SysWOW64\msiexec.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

1618

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

1136

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7132 --field-trial-handle=2412,i,1821821946183819605,16333912008118307477,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1472

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5308 --field-trial-handle=2412,i,1821821946183819605,16333912008118307477,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1584

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

1644

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2072

"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\admin'; Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

Magicalbound.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll

2088

"C:\Users\admin\Downloads\Magicalbound Setup.exe"

C:\Users\admin\Downloads\Magicalbound Setup.exe

msedge.exe

User:

admin

Company:

Magicalbound Team

Integrity Level:

HIGH

Description:

Magicalbound

Exit code:

Version:

1.2.0.0

Modules

Images
c:\users\admin\downloads\magicalbound setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

Add for printing

Total events

84 837

Read events

84 178

Write events

629

Delete events

Modification events


(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:	write	Name:	StatusCodes
Value:
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:	write	Name:	StatusCodes
Value: 01000000
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:	write	Name:	dr
Value: 1
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(4816) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:	write	Name:	UsageStatsInSample
Value: 1
(PID) Process:	(4816) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(4816) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:	write	Name:	urlstats
Value: 0

Add for printing

Executable files

515

Suspicious files

208

Text files

168

Unknown types

Dropped files

PID	Process	Filename		Type
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1c04ca.TMP		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1c04ca.TMP		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1c04ca.TMP		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1c04da.TMP		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1c0518.TMP		—
		MD5:—	SHA256:—
4816	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

139

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4424	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4244	svchost.exe	GET	206	217.20.57.27:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/350af2b9-b35e-49b4-965c-78ca0b3e3123?P1=1722758400&P2=404&P3=2&P4=PDnZJUOsLZLaMlX1NV0VOo4BDgVswaoKpmQvAf2lJ4R670FbkEh%2fc9OOuTZJp0Uwpg6p1ml62NEqiqDAobzZLA%3d%3d	unknown	—	—	whitelisted
6224	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
5368	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
3676	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5368	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted
4460	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4244	svchost.exe	HEAD	200	217.20.57.27:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bb2bbac4-99ee-48e9-83e5-66a07e033678?P1=1722624519&P2=404&P3=2&P4=MyO%2ftSiRZSImyfknJjGBscv8gGVnDYz673tWsPqjLUljPISX7zZOvlNlOmq71tRGevxU1ViJgrRjN5bbfKfQyw%3d%3d	unknown	—	—	whitelisted
4244	svchost.exe	GET	206	217.20.57.27:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bb2bbac4-99ee-48e9-83e5-66a07e033678?P1=1722624519&P2=404&P3=2&P4=MyO%2ftSiRZSImyfknJjGBscv8gGVnDYz673tWsPqjLUljPISX7zZOvlNlOmq71tRGevxU1ViJgrRjN5bbfKfQyw%3d%3d	unknown	—	—	whitelisted
4132	OfficeClickToRun.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	131.253.33.254:443	a-ring-fallback.msedge.net	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
4	System	192.168.100.255:138	—	—	—	whitelisted
1292	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
6012	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
5812	slui.exe	20.83.72.98:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
132	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
—	—	104.126.37.153:443	www.bing.com	Akamai International B.V.	DE	unknown
1328	slui.exe	20.83.72.98:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
3952	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
7380	msedge.exe	13.107.42.16:443	config.edge.skype.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
t-ring-fdv2.msedge.net	13.107.237.254	unknown
a-ring-fallback.msedge.net	131.253.33.254	unknown
settings-win.data.microsoft.com	40.127.240.158 51.104.136.2	whitelisted
www.bing.com	104.126.37.153 104.126.37.147 104.126.37.137 104.126.37.131 104.126.37.146 104.126.37.144 104.126.37.139 104.126.37.128 104.126.37.136 104.126.37.163 104.126.37.162 104.126.37.160 104.126.37.155 104.126.37.145 104.126.37.154 104.126.37.176	whitelisted
google.com	142.250.185.174	whitelisted
config.edge.skype.com	13.107.42.16	whitelisted
magicalbound.com	77.37.66.223	unknown
edge.microsoft.com	204.79.197.239 13.107.21.239	whitelisted
business.bing.com	13.107.6.158	whitelisted
edge-mobile-static.azureedge.net	13.107.246.60	whitelisted

Threats

PID	Process	Class	Message
7380	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Global content delivery network (unpkg .com)
7380	msedge.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
7380	msedge.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
7380	msedge.exe	Device Retrieving External IP Address Detected	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2284	svchost.exe	Potentially Bad Traffic	ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
7124	explorer.exe	Malware Command and Control Activity Detected	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
7124	explorer.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Stealc HTTP POST Request
7124	explorer.exe	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc Submitting System Information to C2
7124	explorer.exe	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc Requesting plugins Config from C2
7124	explorer.exe	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc Requesting browsers Config from C2

10 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

https://magicalbound.com/

F106F37B1DE18DE63AB414D3730BC9CE

3043DD3453244A7C4FEAB94EB0C9C9F34401AE42

4663F420418ECB86D2F6A9D1BDDAF12DBCEA286195E4AD8D57BFE7FCC29DCDAB

3:N8xqUGTK:2xqUR

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Adds path to the Windows Defender exclusion list

Drops the executable file immediately after the start

STEALC has been detected (YARA)

Stealers network behavior

STEALC has been detected (SURICATA)

Connects to the CnC server

Steals credentials from Web Browsers

RHADAMANTHYS has been detected (SURICATA)

RHADAMANTHYS has been detected (YARA)

ASYNCRAT has been detected (SURICATA)

ASYNCRAT has been detected (YARA)

Actions looks like stealing of personal data

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

The process creates files with name similar to system file names

Malware-specific behavior (creating "System.dll" in Temp)

The process drops C-runtime libraries

Creates a software uninstall entry

Script adds exclusion path to Windows Defender

Starts POWERSHELL.EXE for commands execution

Starts CMD.EXE for commands execution

Checks for external IP

Searches for installed software

Connects to the server without a host name

Windows Defender mutex has been found

Contacting a server suspected of hosting an CnC

Process requests binary or script from the Internet

Executes as Windows Service

Potential Corporate Privacy Violation

The process drops Mozilla's DLL files

Starts itself from another location

Reads the Windows owner or organization settings

Loads Python modules

Found regular expressions for crypto-addresses (YARA)

The process checks if it is being run in the virtual environment

Loads DLL from Mozilla Firefox

Connects to unusual port

Process drops SQLite DLL files

INFO

Checks proxy server information

Executable content was dropped or overwritten

Reads Microsoft Office registry keys

Reads the software policy settings

Checks supported languages

Reads the computer name

Drops the executable file immediately after the start

The process uses the downloaded file

Reads Environment values

Creates files in the program directory

Create files in a temporary directory

Application launched itself

.NET Reactor protector has been detected

Creates files or folders in the user directory

Script raised an exception (POWERSHELL)

Reads security settings of Internet Explorer

Creates a software uninstall entry

Reads the machine GUID from the registry

Malware configuration

Stealc

AsyncRat

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information