File name:

release_03421_pass1234.rar

Full analysis: https://app.any.run/tasks/4a967e2a-7274-46e6-9a9a-3fc87c6906f9
Verdict: Malicious activity
Threats:

PrivateLoader is a malware family that is specifically created to infect computer systems and drop additional malicious programs. It operates using a pay-per-install business model, which means that the individuals behind it are paid for each instance of successful deployment of different types of harmful programs, including trojans, stealers, and other ransomware.

Malware Trends Tracker     >>>
Analysis date: November 17, 2023, 19:53:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
privateloader
evasion
stealer
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

09DB8E1C2749209D74D96136307CA3CF

SHA1:

478ABD736659B2869564417CB4C22BFAA2A5D2C9

SHA256:

54758F87D4882B7D6DC4DEAA14306C5C3CF3E0737F739273291458944A4E7B31

SSDEEP:

98304:dZeu9Lpa6vJm0u8I/oHtPlO3AnTPfFvIuUFz+B11Hc/OUjncl9ZPlIevon+nq9eE:3KBNM2pGK7D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PRIVATELOADER has been detected (SURICATA)

      • RegAsm.exe (PID: 3876)
      • RegAsm.exe (PID: 300)

    • Drops the executable file immediately after the start

      • File.exe (PID: 3528)
      • AppLaunch.exe (PID: 3816)

    • Connects to the CnC server

      • RegAsm.exe (PID: 3876)
      • RegAsm.exe (PID: 300)
      • AppLaunch.exe (PID: 3816)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 300)
      • AppLaunch.exe (PID: 3816)

    • REDLINE has been detected (SURICATA)

      • AppLaunch.exe (PID: 3816)

    • REDLINE has been detected (YARA)

      • AppLaunch.exe (PID: 3816)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 3816)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3128)

    • Connects to the server without a host name

      • RegAsm.exe (PID: 3876)
      • RegAsm.exe (PID: 300)

    • Reads settings of System Certificates

      • RegAsm.exe (PID: 3876)
      • RegAsm.exe (PID: 300)
      • AppLaunch.exe (PID: 3816)

    • Checks for external IP

      • RegAsm.exe (PID: 3876)
      • RegAsm.exe (PID: 300)

    • Reads the Internet Settings

      • RegAsm.exe (PID: 300)
      • AppLaunch.exe (PID: 3816)

    • Reads security settings of Internet Explorer

      • RegAsm.exe (PID: 300)

    • Connects to unusual port

      • AppLaunch.exe (PID: 3816)

    • Adds/modifies Windows certificates

      • File.exe (PID: 1576)

    • Checks Windows Trust Settings

      • RegAsm.exe (PID: 300)

    • Searches for installed software

      • AppLaunch.exe (PID: 3816)

    • Reads browser cookies

      • AppLaunch.exe (PID: 3816)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3128)

    • Manual execution by a user

      • File.exe (PID: 3524)
      • File.exe (PID: 3528)
      • wmpnscfg.exe (PID: 3968)
      • File.exe (PID: 1576)
      • rundll32.exe (PID: 556)
      • File.exe (PID: 2000)
      • File.exe (PID: 3532)
      • File.exe (PID: 2388)
      • File.exe (PID: 2252)
      • File.exe (PID: 2884)

    • Checks supported languages

      • File.exe (PID: 3528)
      • RegAsm.exe (PID: 3876)
      • wmpnscfg.exe (PID: 3968)
      • File.exe (PID: 1576)
      • RegAsm.exe (PID: 300)
      • File.exe (PID: 2388)
      • pg5hkbPnZegCO39fuJuYnM5h.exe (PID: 1828)
      • AppLaunch.exe (PID: 3816)
      • File.exe (PID: 2884)
      • RegAsm.exe (PID: 2620)
      • RegAsm.exe (PID: 2480)

    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 3876)
      • File.exe (PID: 3528)
      • wmpnscfg.exe (PID: 3968)
      • File.exe (PID: 1576)
      • RegAsm.exe (PID: 300)
      • File.exe (PID: 2388)
      • AppLaunch.exe (PID: 3816)
      • File.exe (PID: 2884)

    • Reads the computer name

      • RegAsm.exe (PID: 3876)
      • File.exe (PID: 3528)
      • wmpnscfg.exe (PID: 3968)
      • RegAsm.exe (PID: 300)
      • File.exe (PID: 1576)
      • File.exe (PID: 2388)
      • AppLaunch.exe (PID: 3816)
      • File.exe (PID: 2884)

    • Create files in a temporary directory

      • File.exe (PID: 3528)
      • RegAsm.exe (PID: 300)
      • AppLaunch.exe (PID: 3816)

    • Checks proxy server information

      • RegAsm.exe (PID: 300)

    • Process checks computer location settings

      • RegAsm.exe (PID: 300)

    • Reads Environment values

      • AppLaunch.exe (PID: 3816)

    • Reads product name

      • AppLaunch.exe (PID: 3816)

    • Creates files or folders in the user directory

      • RegAsm.exe (PID: 300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(3816) AppLaunch.exe
C2 (1)194.49.94.142:41292
Botnet123
Err_msg
Auth_value208cea6922f6803b969d28c5c259d920
US (12)
net.tcp://
/
localhost
208cea6922f6803b969d28c5c259d920
Authorization
ns1
HiQeQiIDP1I/ORtFPgQsXioZPEA4JidcIwBObg==
HiQ8CA==
Spurnings
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
17
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs file.exe no specs file.exe #PRIVATELOADER regasm.exe wmpnscfg.exe no specs file.exe no specs file.exe #PRIVATELOADER regasm.exe rundll32.exe no specs file.exe no specs file.exe regasm.exe no specs pg5hkbpnzegco39fujuynm5h.exe no specs #REDLINE applaunch.exe file.exe no specs file.exe regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
556"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\prom\ieframe.dllC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1576"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
feedback_and_data_software
Exit code:
3221225477
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1828"C:\Users\admin\Pictures\Minor Policy\pg5hkbPnZegCO39fuJuYnM5h.exe" C:\Users\admin\Pictures\Minor Policy\pg5hkbPnZegCO39fuJuYnM5h.exe—RegAsm.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\minor policy\pg5hkbpnzegco39fujuynm5h.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2000"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
feedback_and_data_software
Exit code:
3221226540
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
2252"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
feedback_and_data_software
Exit code:
3221226540
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
2388"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
feedback_and_data_software
Exit code:
3221225477
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2480C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—File.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
203
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2620C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—File.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
205
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2884"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
feedback_and_data_software
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
16 936
Read events
16 727
Write events
144
Delete events
65

Modification events

(PID) Process:(3128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
4
Suspicious files
15
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
3528File.exeC:\Users\admin\AppData\Local\Temp\Protect544cd51a.dllexecutable
MD5:544CD51A596619B78E9B54B70088307D
SHA256:DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.31415\File.exeexecutable
MD5:E95B1E9EF5E1DA8714FD78B8F3A6C7CF
SHA256:C540C08BD43DB63DEAF6347D7DE279C47DFAECC298CA05D05F311CECCC40CA1B
300RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
300RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A65DBECD82A40019E873CE4ED0A79570binary
MD5:16CF4C163BAAF270DE654E6C095EBDF7
SHA256:88251D280C626312FCC579DA0D1FFE0F914BA7B4690824B071BCEC7810B397E2
300RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\JORLGWIU.txttext
MD5:8E56170A208D4D5FABF7530F15E389EA
SHA256:C7071655BF061CE31D2E6AC6BD934C134915869B69DA05566A6347A5F39A7746
300RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cbinary
MD5:758F0E35CE348749905BBA3C8524E921
SHA256:18E08C433139BCD96B4C7A13924562706C1030984B5B2B7922619E20C5977864
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.31415\prom\ieframe.dllexecutable
MD5:E83B0AB78E74C9C70647DB94D88669DB
SHA256:84AFB3A5F5AB695E6467795E57E606655DE1029B96B57E05AC4DC1E5E9D2A77F
300RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A65DBECD82A40019E873CE4ED0A79570binary
MD5:A25558BF6D9285D5C072EF37A6164B05
SHA256:5403E78560F5D3A80D153A96FE197EA5CF00FB51786E61E6F14022E40D7491D0
300RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:58597D66F34765AE53B69FE5F538B34E
SHA256:C8B117BDC2E7EC2410726D5183EB311D86599626CB51CCF06AB2F364395A2030
300RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\3N9LWIMR.txttext
MD5:95435E53963C57588ED419059088ED05
SHA256:C0705F05BE69162F41D30F1700BB9D6E7DD56E0D1E68E57B913E5740F1698FDA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
34
DNS requests
15
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
300
RegAsm.exe
GET
200
185.216.70.235:80
http://185.216.70.235/api/tracemap.php
unknown
text
15 b
unknown
300
RegAsm.exe
POST
200
185.216.70.235:80
http://185.216.70.235/api/firegate.php
unknown
text
108 b
unknown
3876
RegAsm.exe
GET
200
194.49.94.113:80
http://194.49.94.113/api/tracemap.php
unknown
text
15 b
unknown
300
RegAsm.exe
POST
200
185.216.70.235:80
http://185.216.70.235/api/firegate.php
unknown
text
108 b
unknown
300
RegAsm.exe
GET
403
104.18.146.235:80
http://www.maxmind.com/geoip/v2.1/city/me
unknown
html
4.41 Kb
unknown
300
RegAsm.exe
POST
200
185.216.70.235:80
http://185.216.70.235/api/firegate.php
unknown
text
108 b
unknown
300
RegAsm.exe
POST
200
185.216.70.235:80
http://185.216.70.235/api/firegate.php
unknown
text
384 b
unknown
300
RegAsm.exe
GET
200
8.60.132.114:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8cb9185a6b7018b9
unknown
compressed
61.6 Kb
unknown
300
RegAsm.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBp4iA5pDYaog9yj8g%3D%3D
unknown
binary
1.42 Kb
unknown
300
RegAsm.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDFAISJ5g2%2FpXsWindw%3D%3D
unknown
binary
1.42 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3876
RegAsm.exe
194.49.94.113:80
—
Enes Koken
DE
malicious
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3876
RegAsm.exe
104.26.9.59:443
api.myip.com
CLOUDFLARENET
US
unknown
3876
RegAsm.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
300
RegAsm.exe
185.216.70.235:80
—
Enes Koken
US
malicious
300
RegAsm.exe
104.26.8.59:443
api.myip.com
CLOUDFLARENET
US
unknown
300
RegAsm.exe
104.237.62.213:443
api64.ipify.org
WEBNX
US
unknown
300
RegAsm.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
api.myip.com
  • 104.26.9.59
  • 172.67.75.163
  • 104.26.8.59
malicious
ipinfo.io
  • 34.117.59.81
shared
api64.ipify.org
  • 104.237.62.213
  • 173.231.16.75
  • 64.185.227.155
unknown
db-ip.com
  • 172.67.75.166
  • 104.26.4.15
  • 104.26.5.15
whitelisted
www.maxmind.com
  • 104.18.146.235
  • 104.18.145.235
whitelisted
vk.com
  • 87.240.129.133
  • 87.240.132.78
  • 87.240.132.72
  • 87.240.132.67
  • 87.240.137.164
  • 93.186.225.194
whitelisted
ctldl.windowsupdate.com
  • 8.60.132.114
  • 67.27.142.126
  • 8.238.38.254
  • 8.60.132.101
  • 8.238.189.126
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp2.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
psv4.userapi.com
  • 87.240.137.134
  • 87.240.137.140
  • 87.240.190.76
  • 87.240.190.89
unknown

Threats

PID
Process
Class
Message
3876
RegAsm.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
3876
RegAsm.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
3876
RegAsm.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
300
RegAsm.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
300
RegAsm.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
300
RegAsm.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
300
RegAsm.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Check (maxmind.com/geoip)
3816
AppLaunch.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
3816
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
release_03421_pass1234.rar