Malware analysis updater_beta.exe Malicious activity | ANY.RUN

Add for printing

File name:	updater_beta.exe
Full analysis:	https://app.any.run/tasks/3b10e9ac-5ffb-4b76-8301-046740e0c7ab
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	May 16, 2025, 14:11:02
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	stealer
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	4AC5A9796E153B190E70E2F51E49A131
SHA1:	9C4AF8945EAC90449DD54A965EAA427924252FAE
SHA256:	5530BE4592507773E6CA5EF13160973824C8DCFF7F4CB4F97B5B508A336C8727
SSDEEP:	98304:6yJBmMLx2jvfxtxwKzvNXF0NhYkPzCQ4kJ7cjxRhJ9K/B/pnQx+OnuQJFpNKnZz1:bv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Steals credentials from Web Browsers
  - updater_beta.exe (PID: 1512)
- Actions looks like stealing of personal data
  - updater_beta.exe (PID: 1512)
  - MailRuUpdater.exe (PID: 6980)
- Executing a file with an untrusted certificate
  - MailRuUpdater.exe (PID: 1040)
  - MailRuUpdater.exe (PID: 6980)
- Changes the autorun value in the registry
  - MailRuUpdater.exe (PID: 1040)
  - f95c-c50e-422c-0456 (PID: 3008)
SUSPICIOUS
- Starts application with an unusual extension
  - updater_beta.exe (PID: 1512)
- Executable content was dropped or overwritten
  - updater_beta.exe (PID: 1512)
  - f95c-c50e-422c-0456 (PID: 3008)
  - MailRuUpdater.exe (PID: 1040)
- Searches for installed software
  - MailRuUpdater.exe (PID: 1040)
- Creates a software uninstall entry
  - MailRuUpdater.exe (PID: 1040)
- Starts itself from another location
  - MailRuUpdater.exe (PID: 1040)
  - f95c-c50e-422c-0456 (PID: 3008)
INFO
- The sample compiled with english language support
  - updater_beta.exe (PID: 1512)
  - f95c-c50e-422c-0456 (PID: 3008)
  - MailRuUpdater.exe (PID: 1040)
- Reads the computer name
  - updater_beta.exe (PID: 1512)
  - mrupdsrv.exe (PID: 5756)
  - MailRuUpdater.exe (PID: 1040)
  - MailRuUpdater.exe (PID: 6980)
  - f95c-c50e-422c-0456 (PID: 3008)
- Checks supported languages
  - updater_beta.exe (PID: 1512)
  - f95c-c50e-422c-0456 (PID: 3008)
  - mrupdsrv.exe (PID: 5756)
  - MailRuUpdater.exe (PID: 1040)
  - MailRuUpdater.exe (PID: 6980)
- Creates files in the program directory
  - updater_beta.exe (PID: 1512)
- Reads the machine GUID from the registry
  - updater_beta.exe (PID: 1512)
  - MailRuUpdater.exe (PID: 6980)
- Reads the software policy settings
  - updater_beta.exe (PID: 1512)
  - mrupdsrv.exe (PID: 5756)
  - MailRuUpdater.exe (PID: 6980)
- Process checks whether UAC notifications are on
  - updater_beta.exe (PID: 1512)
  - mrupdsrv.exe (PID: 5756)
  - MailRuUpdater.exe (PID: 1040)
  - MailRuUpdater.exe (PID: 6980)
- Creates files or folders in the user directory
  - updater_beta.exe (PID: 1512)
  - f95c-c50e-422c-0456 (PID: 3008)
  - MailRuUpdater.exe (PID: 1040)
  - mrupdsrv.exe (PID: 5756)
- Create files in a temporary directory
  - updater_beta.exe (PID: 1512)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 EXE PECompact compressed (generic) (53.4)
.exe	\|	Win64 Executable (generic) (35.5)
.exe	\|	Win32 Executable (generic) (5.8)
.exe	\|	Generic Win/DOS Executable (2.5)
.exe	\|	DOS Executable Generic (2.5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2019:02:27 16:45:17+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	14.12
CodeSize:	2716160
InitializedDataSize:	819200
UninitializedDataSize:	-
EntryPoint:	0x14369d
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	5.1.0.195
ProductVersionNumber:	5.1.0.195
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Dynamic link library
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	Mail.Ru
FileDescription:	Mail.Ru updater
FileVersion:	5.1.0.195
InternalName:	MailRuUpdater
LegalCopyright:	Copyright 2015
OriginalFileName:	MailRuUpdater.exe
ProductName:	MailRuUpdater
ProductVersion:	5.1.0.195
Comments:	-

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

131

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1040

"C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004_d\MailRuUpdater.exe" --update-installation

C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004_d\MailRuUpdater.exe

updater_beta.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\mail.ru\mailruupdater\us\2d0cd78004_d\mailruupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll

1512

"C:\Users\admin\AppData\Local\Temp\updater_beta.exe"

C:\Users\admin\AppData\Local\Temp\updater_beta.exe

explorer.exe

User:

admin

Company:

Mail.Ru

Integrity Level:

MEDIUM

Description:

Mail.Ru updater

Exit code:

Version:

5.1.0.195

Modules

Images
c:\users\admin\appdata\local\temp\updater_beta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

3008

"C:\Users\admin\AppData\Local\Temp\f95c-c50e-422c-0456" --install

C:\Users\admin\AppData\Local\Temp\f95c-c50e-422c-0456

updater_beta.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\f95c-c50e-422c-0456
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

5112

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

5680

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

5756

"C:\Users\admin\AppData\Local\Mail.Ru\Update Service\mrupdsrv.exe" --u

C:\Users\admin\AppData\Local\Mail.Ru\Update Service\mrupdsrv.exe

f95c-c50e-422c-0456

User:

admin

Company:

Mail.Ru

Integrity Level:

MEDIUM

Description:

Mail.Ru Update Service

Version:

3.12.0.10

Modules

Images
c:\users\admin\appdata\local\mail.ru\update service\mrupdsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

6980

"C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater.exe"

C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater.exe

MailRuUpdater.exe

User:

admin

Company:

Mail.Ru

Integrity Level:

MEDIUM

Description:

Mail.Ru updater

Version:

5.2.0.13

Modules

Images
c:\users\admin\appdata\local\mail.ru\mailruupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll

Add for printing

Total events

1 871

Read events

1 852

Write events

Delete events

Modification events


(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Software\Mail.Ru\IE_Bar\Settings
Operation:	write	Name:	GUID
Value: {64FE5829-027E-4038-9855-8A619DA6A16D}
(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru\Tech
Operation:	write	Name:	UserID
Value: {1AD5695B-E537-44FF-B5CD-A084655611B0}
(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru
Operation:	delete value	Name:	SicSettings
Value:
(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru\Tech\ptls\{2AB1F4AB-E3FA-4047-9033-EC223C8354F5}
Operation:	write	Name:	finished_time
Value: 8147276800000000
(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru\Tech\ptls\{84DC8324-C256-4EF5-B0DC-383B43EE77E9}\ready_items
Operation:	write	Name:	waiter
Value: 1
(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru\Tech\ptls\{84DC8324-C256-4EF5-B0DC-383B43EE77E9}
Operation:	write	Name:	finished_time
Value: 8347276800000000
(PID) Process:	(1512) updater_beta.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru\Tech\ptls\{FC604959-8A01-4E8B-A3E5-87CEEBD6FEDB}
Operation:	write	Name:	finished_time
Value: 8347276800000000
(PID) Process:	(6980) MailRuUpdater.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Software\Mail.Ru\IE_Bar\Settings
Operation:	write	Name:	GUID
Value: {64FE5829-027E-4038-9855-8A619DA6A16D}
(PID) Process:	(6980) MailRuUpdater.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Mail.Ru
Operation:	delete value	Name:	SicSettings
Value:
(PID) Process:	(3008) f95c-c50e-422c-0456	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	mrupdsrv
Value: "C:\Users\admin\AppData\Local\Mail.Ru\Update Service\mrupdsrv.exe" --u

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1512	updater_beta.exe	C:\ProgramData\Mail.Ru\ifrm		binary
		MD5:29297C9D63A5BB5A058E3EC4CBA77E46	SHA256:547CFEF5C704DF902FE4372B52B9AADE71131D8D66B3AB9082603F3D99C22F64
1512	updater_beta.exe	C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater\prodmon		binary
		MD5:12B06DDB5F347D8CE0E85AEC2A626259	SHA256:431D80649569DEBCFF8942D67B8188BDB6FF3CF05D9468CCD96C9E7530CE2DD4
1512	updater_beta.exe	C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004_d\MailRuUpdater.exe		executable
		MD5:FDB8415567C0748A3BD4FFB9AC783CB7	SHA256:92025C595D1A8E503AED2725EF9E64EF4EA919307C2694FFD564993EE4B64D43
1512	updater_beta.exe	C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004		binary
		MD5:6703DBB3A0C7BA3F152BAA6F9A1AD3F2	SHA256:C0EABD584BD675B7D0A098880D0ACD55FAC6D620443532D767F623384EAE9D35
3008	f95c-c50e-422c-0456	C:\Users\admin\AppData\Local\Mail.Ru\Update Service\mrupdsrv.exe		executable
		MD5:602CD1F0DD54E83DE1413705AA378803	SHA256:8EEEF659D4D3E827474B4C769436807EAFEDF58DC923054338CB5385DC8D3998
1512	updater_beta.exe	C:\Users\admin\AppData\Local\Temp\f95c-c50e-422c-0456		executable
		MD5:602CD1F0DD54E83DE1413705AA378803	SHA256:8EEEF659D4D3E827474B4C769436807EAFEDF58DC923054338CB5385DC8D3998
1040	MailRuUpdater.exe	C:\Users\admin\AppData\Local\Mail.Ru\MailRuUpdater.exe		executable
		MD5:FDB8415567C0748A3BD4FFB9AC783CB7	SHA256:92025C595D1A8E503AED2725EF9E64EF4EA919307C2694FFD564993EE4B64D43
1512	updater_beta.exe	C:\Users\admin\AppData\Local\Temp\3ba3-8135-ac2d-da1d		executable
		MD5:FDB8415567C0748A3BD4FFB9AC783CB7	SHA256:92025C595D1A8E503AED2725EF9E64EF4EA919307C2694FFD564993EE4B64D43
5756	mrupdsrv.exe	C:\Users\admin\AppData\Local\Mail.Ru\Update Service\us\46c6c11738		binary
		MD5:8B74F32D93C6236882242C62A5209CDC	SHA256:02ED64B95368DE3AE65D1F86F2A63D7C6DFC821466CDB97F61F3E1C4E184D005
1512	updater_beta.exe	C:\ProgramData\Mail.Ru\Id		text
		MD5:E9D1617858B70226EB5C7CA690FBF48C	SHA256:F53017A5C421BA65C12E8383B3CB433CE523A61A8E59C8B33D17CB26C931CB1B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1512	updater_beta.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=mru_online&tool=mrupdater&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.1.0.195&mailru_guard=0&mailru_updater=0&comp_mem=4090&tool_mem=9&elapsed_time=0&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D	unknown	—	—	whitelisted
1512	updater_beta.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=task_executed&taskid=%7B901B414B-72A2-48C6-8DCD-29388B8B3E40%7D&done=1&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.1.0.195&mailru_guard=0&mailru_updater=0&comp_mem=4090&tool_mem=13&elapsed_time=1&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&tool=mrupdater	unknown	—	—	whitelisted
—	—	GET	200	2.16.164.120:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1512	updater_beta.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=mruinfo&last_ch=40164141&ie_hp=about&ie_dse=www.bing.com&ie_ver=11.00.19041.1&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.1.0.195&mailru_guard=0&mailru_updater=0&comp_mem=4090&tool_mem=14&elapsed_time=1&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&tool=mrupdater	unknown	—	—	whitelisted
—	—	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1512	updater_beta.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=task_executed&taskid=%7B2AB1F4AB-E3FA-4047-9033-EC223C8354F5%7D&done=1&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.1.0.195&mailru_guard=0&mailru_updater=0&comp_mem=4090&tool_mem=14&elapsed_time=1&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&tool=mrupdater	unknown	—	—	whitelisted
1512	updater_beta.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=task_executed&taskid=smon&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.1.0.195&mailru_guard=0&mailru_updater=0&comp_mem=4090&tool_mem=17&elapsed_time=2&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&tool=mrupdater	unknown	—	—	whitelisted
1512	updater_beta.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=mru_iapp&id=waiter&event=done&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.1.0.195&mailru_guard=0&mailru_updater=1&comp_mem=4090&tool_mem=17&elapsed_time=3&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&tool=mrupdater	unknown	—	—	whitelisted
5756	mrupdsrv.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=waiter_online&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=8&osbit=64&osvernum=6.2&uac=1&admin=1&ver=3.12.0.10&mailru_guard=0&mailru_updater=1&comp_mem=4090&tool_mem=9&elapsed_time=0&mr_service=0&os=win10.0&GUID=&install_id=&tool=waiter	unknown	—	—	whitelisted
1040	MailRuUpdater.exe	GET	204	95.163.50.150:80	http://mrds.mail.ru/update/2/version.txt?type=mru_install&ovr=0&masterid=%7B723F393A-DBEA-42FD-AEF7-0791754AC190%7D&user_id=%7B1AD5695B-E537-44FF-B5CD-A084655611B0%7D&osver=10&osbit=64&osvernum=10.0&uac=1&admin=1&ver=5.2.0.13&mailru_guard=0&mailru_updater=1&comp_mem=4090&tool_mem=9&elapsed_time=0&mr_service=0&os=win10.0&install_id=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&GUID=%7B64FE5829-027E-4038-9855-8A619DA6A16D%7D&tool=mrupdater	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	2.16.164.120:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1512	updater_beta.exe	95.163.50.150:80	binupdate.mail.ru	LLC VK	RU	whitelisted
1512	updater_beta.exe	95.163.50.150:443	binupdate.mail.ru	LLC VK	RU	whitelisted
1512	updater_beta.exe	95.163.50.149:443	xmlbinupdate.mail.ru	LLC VK	RU	whitelisted
1512	updater_beta.exe	5.181.61.0:443	mailruupdater.cdnmail.ru	LLC VK	RU	malicious
5756	mrupdsrv.exe	95.163.50.150:443	binupdate.mail.ru	LLC VK	RU	whitelisted
5756	mrupdsrv.exe	95.163.50.150:80	binupdate.mail.ru	LLC VK	RU	whitelisted
5756	mrupdsrv.exe	95.163.50.149:80	xmlbinupdate.mail.ru	LLC VK	RU	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 4.231.128.59	whitelisted
crl.microsoft.com	2.16.164.120 2.16.164.106 2.16.164.16 2.16.164.34 2.16.164.129 2.16.164.114 2.16.164.122 2.16.164.82 2.16.164.89	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
google.com	216.58.206.78	whitelisted
binupdate.mail.ru	95.163.50.150	whitelisted
mrds.mail.ru	95.163.50.150	whitelisted
xmlbinupdate.mail.ru	95.163.50.149	whitelisted
mailruupdater.cdnmail.ru	5.181.61.0	malicious
xml.binupdate.mail.ru	95.163.50.149	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

updater_beta.exe

4AC5A9796E153B190E70E2F51E49A131

9C4AF8945EAC90449DD54A965EAA427924252FAE

5530BE4592507773E6CA5EF13160973824C8DCFF7F4CB4F97B5B508A336C8727

98304:6yJBmMLx2jvfxtxwKzvNXF0NhYkPzCQ4kJ7cjxRhJ9K/B/pnQx+OnuQJFpNKnZz1:bv

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Steals credentials from Web Browsers

Actions looks like stealing of personal data

Executing a file with an untrusted certificate

Changes the autorun value in the registry

SUSPICIOUS

Starts application with an unusual extension

Executable content was dropped or overwritten

Searches for installed software

Creates a software uninstall entry

Starts itself from another location

INFO

The sample compiled with english language support

Reads the computer name

Checks supported languages

Creates files in the program directory

Reads the machine GUID from the registry

Reads the software policy settings

Process checks whether UAC notifications are on

Creates files or folders in the user directory

Create files in a temporary directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings