File name:

7a51a34ca5ccfe6eb43ef6abc0f92d46

Full analysis: https://app.any.run/tasks/c2e6ab12-9f94-4f07-bfb2-01de9b87e371
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: November 21, 2023, 22:00:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealer
redline
trojan
kelihos
loader
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

7A51A34CA5CCFE6EB43EF6ABC0F92D46

SHA1:

115643F90FB03144D2486F3A5F1B67D9CD8B42F1

SHA256:

5675B6A982A8224078A4C5338480F37F536A29ADE205F85A39D2CBE6CC28815D

SSDEEP:

1536:oziv7DMQRXdLG6jejoigIzgPX0xbCFQUi3O5LzgAsG5nyygacStW+W+iiiiiiiif:lvMQRlYzIz73Rg0ujyzd5W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (SURICATA)

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • svchost.exe (PID: 2664)

    • Steals credentials from Web Browsers

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Steals credentials

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • REDLINE has been detected (YARA)

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Drops the executable file immediately after the start

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)

    • Actions looks like stealing of personal data

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • KELIHOS has been detected (SURICATA)

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • ASYNCRAT has been detected (YARA)

      • svchost.exe (PID: 1980)

  • SUSPICIOUS

    • Connects to unusual port

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • svchost.exe (PID: 2664)

    • Reads settings of System Certificates

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Reads browser cookies

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Searches for installed software

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Reads the Internet Settings

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • svchost.exe (PID: 2664)
      • svchost.exe (PID: 1980)

    • The process creates files with name similar to system file names

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)

    • Connects to the server without a host name

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Process requests binary or script from the Internet

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Starts itself from another location

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)

    • Starts CMD.EXE for commands execution

      • Winupdate.exe (PID: 1296)

    • Executing commands from a ".bat" file

      • Winupdate.exe (PID: 1296)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2832)

  • INFO

    • Reads Environment values

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • svchost.exe (PID: 2796)
      • svchost.exe (PID: 2664)
      • Winupdate.exe (PID: 1296)
      • svchost.exe (PID: 1980)

    • Reads the computer name

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)
      • svchost.exe (PID: 2664)
      • svchost.exe (PID: 2796)
      • svchost.exe (PID: 1980)

    • Checks supported languages

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)
      • svchost.exe (PID: 2796)
      • svchost.exe (PID: 2664)
      • svchost.exe (PID: 1980)

    • Reads the machine GUID from the registry

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)
      • svchost.exe (PID: 2796)
      • svchost.exe (PID: 2664)
      • svchost.exe (PID: 1980)

    • Create files in a temporary directory

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)

    • Creates files or folders in the user directory

      • 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe (PID: 2704)
      • Winupdate.exe (PID: 1296)

    • The executable file from the user directory is run by the CMD process

      • svchost.exe (PID: 1980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
C2 (1)91.92.241.80:1337
Botnet11/21/23
US (153)
Environment
UNKNOWN
.
1
cmyredmyit_cmyardmys
my
as21
\
Local State
LocalPrefs.json
Host
Port
:
User
Pass
MANGO
%USEWanaLifeRPROFILE%\AppDaWanaLifeta\LWanaLifeocal
WanaLife
Def
Win
String.Replace
String.Remove
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
BCrypt.BCryptImportKey() failed with status code:{0}
BCrypt.BCryptGetProperty() (get size) failed with status code:{0}
BCrypt.BCryptGetProperty() failed with status code:{0}
-
http://
/
|
Yandex\YaAddon
91.92.241.80:1337
11/21/23
,
asf
*wallet*
Armory
\Armory
*.wallet
Atomic
\atomic
*
ibnejdfjmmkpcnlpebklmnkoeoihofec
Tronlink
jbdaocneiiinmjbjlgalhcelgbejmnid
NiftyWallet
nkbihfbeogaeaoehlefnkodbefgpgknn
Metamask
afbcbjpbpfadlkmhmclhkeeodmamcflc
MathWallet
hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase
fhbohimaelbohpjbbldcngcnapndodjp
BinanceChain
odbfpeeihdkbihmopkbjmoonfanlbfcl
BraveWallet
hpglfhgfnhbgpjdenjgmdgoeiappafln
GuardaWallet
blnieiiffboillknjnepogjhkgnoapac
EqualWallet
cjelfplplebdjjenllpjcblmjkfcffne
JaxxxLiberty
fihkakfobkmkjojpchpfgcmhfjnmnfpi
BitAppWallet
kncchdigobghenbbaddojjnnaogfppfj
iWallet
amkmjjmmflddogmhpjloimipbofnfjih
Wombat
UnknownExtension
_
Local Extension Settings
Coinomi
\Coinomi
Profile_
Tel
egram.exe
\Telegram Desktop\tdata
-*.lo--g
1*.1l1d1b
String
Replace
System.UI
File.IO
*.json
string.Replace
Guarda
\Guarda
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPstring.ReplaceROFILE%\Apstring.ReplacepData\Locastring.Replacel
ToString
(
UNIQUE
"
Width
Height
CopyFromScreen
kernel32
user32.dll
GetConsoleWindow
ShowWindow
SELECT * FROM Win32_Processor
Name
NumberOfCores
root\CIMV2
SELECT * FROM Win32_VideoController
AdapterRAM
ROWindowsServiceOT\SecurityCenteWindowsServicer2
ROWindowsServiceOT\SecurWindowsServiceityCenter
AntqueiresivirusProdqueiresuct
AntqueiresiSpyqueiresWareProdqueiresuct
FiqueiresrewallProqueiresduct
WindowsService
SELECT * FROM
queires
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELECT * FROM Win32_DiskDrive
SerialNumber
'
ExecutablePath
[
]
0 Mb or 0
SELECT * FROM Win32_OperatingSystem
TotalVisibleMemorySize
{0} MB or {1}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[

AsyncRat

(PID) Process(1980) svchost.exe
Botnet11/15/24INJECT
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRuntrue
Mutex561465416dfg14reg14t43684436t8453434
InstallFolder%Temp%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureFo3plUdWTy0e3DDEO+dDf2szbEljhNVt5CbORPgstTpEt0vJURqB8ekOHamfTbTeojAP80/AiqMbSA2ZFLZ7Uw/XqBo025+8vjcCtmvlFcSUmR7WwHsH4y9M7hkLJgNU0AoCgWR8lIytglqp6IHQn33zV2fZxbrnL4FQF4xuRo8=
Keys
AES9bd11fb052243b53bc8c203d939e7cc94ba6f50185697243281327da89744bda
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2097:08:15 01:34:58+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 95232
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1933e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: Implosions.exe
LegalCopyright:
OriginalFileName: Implosions.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REDLINE 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe winupdate.exe no specs svchost.exe no specs #REDLINE svchost.exe cmd.exe no specs timeout.exe no specs #ASYNCRAT svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296"C:\Users\admin\AppData\Local\Winupdate.exe" C:\Users\admin\AppData\Local\Winupdate.exe—7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\winupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
1980"C:\Users\admin\AppData\Local\Temp\svchost.exe" C:\Users\admin\AppData\Local\Temp\svchost.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
AsyncRat
(PID) Process(1980) svchost.exe
Botnet11/15/24INJECT
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRuntrue
Mutex561465416dfg14reg14t43684436t8453434
InstallFolder%Temp%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureFo3plUdWTy0e3DDEO+dDf2szbEljhNVt5CbORPgstTpEt0vJURqB8ekOHamfTbTeojAP80/AiqMbSA2ZFLZ7Uw/XqBo025+8vjcCtmvlFcSUmR7WwHsH4y9M7hkLJgNU0AoCgWR8lIytglqp6IHQn33zV2fZxbrnL4FQF4xuRo8=
Keys
AES9bd11fb052243b53bc8c203d939e7cc94ba6f50185697243281327da89744bda
SaltVenomRATByVenom
2664"C:\Users\admin\AppData\Local\Temp\svchost.exe" C:\Users\admin\AppData\Local\Temp\svchost.exe
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
4294967295
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
2692timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2704"C:\Users\admin\AppData\Local\Temp\7a51a34ca5ccfe6eb43ef6abc0f92d46.exe" C:\Users\admin\AppData\Local\Temp\7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
RedLine
(PID) Process(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
C2 (1)91.92.241.80:1337
Botnet11/21/23
US (153)
Environment
UNKNOWN
.
1
cmyredmyit_cmyardmys
my
as21
\
Local State
LocalPrefs.json
Host
Port
:
User
Pass
MANGO
%USEWanaLifeRPROFILE%\AppDaWanaLifeta\LWanaLifeocal
WanaLife
Def
Win
String.Replace
String.Remove
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
BCrypt.BCryptImportKey() failed with status code:{0}
BCrypt.BCryptGetProperty() (get size) failed with status code:{0}
BCrypt.BCryptGetProperty() failed with status code:{0}
-
http://
/
|
Yandex\YaAddon
91.92.241.80:1337
11/21/23
,
asf
*wallet*
Armory
\Armory
*.wallet
Atomic
\atomic
*
ibnejdfjmmkpcnlpebklmnkoeoihofec
Tronlink
jbdaocneiiinmjbjlgalhcelgbejmnid
NiftyWallet
nkbihfbeogaeaoehlefnkodbefgpgknn
Metamask
afbcbjpbpfadlkmhmclhkeeodmamcflc
MathWallet
hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase
fhbohimaelbohpjbbldcngcnapndodjp
BinanceChain
odbfpeeihdkbihmopkbjmoonfanlbfcl
BraveWallet
hpglfhgfnhbgpjdenjgmdgoeiappafln
GuardaWallet
blnieiiffboillknjnepogjhkgnoapac
EqualWallet
cjelfplplebdjjenllpjcblmjkfcffne
JaxxxLiberty
fihkakfobkmkjojpchpfgcmhfjnmnfpi
BitAppWallet
kncchdigobghenbbaddojjnnaogfppfj
iWallet
amkmjjmmflddogmhpjloimipbofnfjih
Wombat
UnknownExtension
_
Local Extension Settings
Coinomi
\Coinomi
Profile_
Tel
egram.exe
\Telegram Desktop\tdata
-*.lo--g
1*.1l1d1b
String
Replace
System.UI
File.IO
*.json
string.Replace
Guarda
\Guarda
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPstring.ReplaceROFILE%\Apstring.ReplacepData\Locastring.Replacel
ToString
(
UNIQUE
"
Width
Height
CopyFromScreen
kernel32
user32.dll
GetConsoleWindow
ShowWindow
SELECT * FROM Win32_Processor
Name
NumberOfCores
root\CIMV2
SELECT * FROM Win32_VideoController
AdapterRAM
ROWindowsServiceOT\SecurityCenteWindowsServicer2
ROWindowsServiceOT\SecurWindowsServiceityCenter
AntqueiresivirusProdqueiresuct
AntqueiresiSpyqueiresWareProdqueiresuct
FiqueiresrewallProqueiresduct
WindowsService
SELECT * FROM
queires
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELECT * FROM Win32_DiskDrive
SerialNumber
'
ExecutablePath
[
]
0 Mb or 0
SELECT * FROM Win32_OperatingSystem
TotalVisibleMemorySize
{0} MB or {1}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
2796"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe—7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
2832C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp33F2.tmp.bat""C:\Windows\System32\cmd.exe—Winupdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 896
Read events
2 841
Write events
55
Delete events
0

Modification events

(PID) Process:(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2704) 7a51a34ca5ccfe6eb43ef6abc0f92d46.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1296) Winupdate.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2796) svchost.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1980) svchost.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
4
Suspicious files
34
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC8D4.tmpbinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC8D5.tmpbinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC9AB.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC957.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC979.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC946.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC968.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC978.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC99B.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
27047a51a34ca5ccfe6eb43ef6abc0f92d46.exeC:\Users\admin\AppData\Local\Temp\tmpC9AC.tmpbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
11
DNS requests
2
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
POST
200
91.92.241.80:1337
http://91.92.241.80:1337/
unknown
text
4.63 Kb
unknown
1980
svchost.exe
GET
200
91.92.241.80:80
http://puredns.o7lab.me/
unknown
html
703 b
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
POST
200
91.92.241.80:1337
http://91.92.241.80:1337/
unknown
text
212 b
unknown
1980
svchost.exe
GET
200
91.92.241.80:80
http://puredns.o7lab.me/
unknown
html
703 b
unknown
1980
svchost.exe
GET
200
91.92.241.80:80
http://puredns.o7lab.me/
unknown
html
703 b
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
POST
200
91.92.241.80:1337
http://91.92.241.80:1337/
unknown
text
145 b
unknown
1980
svchost.exe
GET
200
91.92.241.80:80
http://puredns.o7lab.me/
unknown
html
703 b
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
GET
200
91.92.241.80:80
http://91.92.241.80/Update.exe
unknown
executable
74.0 Kb
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
GET
200
91.92.241.80:80
http://91.92.241.80/Update.exe
unknown
executable
74.0 Kb
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
POST
200
91.92.241.80:1337
http://91.92.241.80:1337/
unknown
text
2.91 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
91.92.241.80:1337
puredns.o7lab.me
Natskovi & Sie Ltd.
BG
malicious
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
104.26.12.31:443
api.ip.sb
CLOUDFLARENET
US
unknown
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
91.92.241.80:80
puredns.o7lab.me
Natskovi & Sie Ltd.
BG
malicious
2664
svchost.exe
91.92.241.80:1337
puredns.o7lab.me
Natskovi & Sie Ltd.
BG
malicious
1980
svchost.exe
91.92.241.80:80
puredns.o7lab.me
Natskovi & Sie Ltd.
BG
malicious

DNS requests

Domain
IP
Reputation
api.ip.sb
  • 104.26.12.31
  • 172.67.75.172
  • 104.26.13.31
whitelisted
puredns.o7lab.me
  • 91.92.241.80
malicious

Threats

PID
Process
Class
Message
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
A Network Trojan was detected
ET ATTACK_RESPONSE RedLine Stealer - CheckConnect Response
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
A Network Trojan was detected
ET ATTACK_RESPONSE Win32/LeftHook Stealer Browser Extension Config Inbound
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
A Network Trojan was detected
ET MALWARE Redline Stealer Activity (Response)
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
Successful Credential Theft Detected
SUSPICIOUS [ANY.RUN] Clear Text Password Exfiltration Atempt
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
Successful Credential Theft Detected
SUSPICIOUS [ANY.RUN] Clear Text Password Exfiltration Atempt
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2704
7a51a34ca5ccfe6eb43ef6abc0f92d46.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7a51a34ca5ccfe6eb43ef6abc0f92d46