File name:

b2c04bb4-1039-4836-bca6-bd4211df1190

Full analysis: https://app.any.run/tasks/12ed1d30-7f22-4237-a16f-03b7f85d560b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: December 04, 2024, 21:35:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
discord
exfiltration
stealer
nanocore
rat
remote
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

81FFDDF2C1D7905204A67F6577E2DC68

SHA1:

A89C37A3E12A46AC714887D509A1849791B4B244

SHA256:

5713DF54AE15A1A47A87436D1C7DDC06338F9C31276880D6D2AE29D2655313E7

SSDEEP:

24576:Ez0kjsOoacJzMuoorM9MKQjwmDSTyenTLBNjZTBdvarJt294aK5jKBEI:Ez0kjsOoacJzdoorM9MxjVD8yYPBNjZT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Attempting to use instant messaging service

      • injection.exe (PID: 4136)

    • Stealers network behavior

      • injection.exe (PID: 4136)

    • Connects to the CnC server

      • 111111111111111111111111111111111111.exe (PID: 4164)

    • NANOCORE has been detected (YARA)

      • 111111111111111111111111111111111111.exe (PID: 4164)
      • wlanext.exe (PID: 3172)

    • NANOCORE has been detected (SURICATA)

      • 111111111111111111111111111111111111.exe (PID: 4164)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)

    • Executable content was dropped or overwritten

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)
      • injection.exe (PID: 4136)

    • Reads security settings of Internet Explorer

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • injection.exe (PID: 4136)

    • The process connected to a server suspected of theft

      • injection.exe (PID: 4136)

    • The process executes via Task Scheduler

      • wlanext.exe (PID: 3172)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • wlanext.exe (PID: 3172)

    • Connects to unusual port

      • 111111111111111111111111111111111111.exe (PID: 4164)

    • Contacting a server suspected of hosting an CnC

      • 111111111111111111111111111111111111.exe (PID: 4164)

  • INFO

    • Reads the computer name

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)
      • injection.exe (PID: 4136)
      • Setup.exe (PID: 5252)
      • 111111111111111111111111111111111111.exe (PID: 4164)
      • wlanext.exe (PID: 3172)

    • Reads the machine GUID from the registry

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)
      • injection.exe (PID: 4136)
      • 111111111111111111111111111111111111.exe (PID: 4164)
      • wlanext.exe (PID: 3172)

    • Checks supported languages

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)
      • 111111111111111111111111111111111111.exe (PID: 4164)
      • injection.exe (PID: 4136)
      • Setup.exe (PID: 5252)
      • wlanext.exe (PID: 3172)

    • Create files in a temporary directory

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)

    • The process uses the downloaded file

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)
      • 111111111111111111111111111111111111.exe (PID: 4164)
      • wlanext.exe (PID: 3172)

    • Process checks computer location settings

      • b2c04bb4-1039-4836-bca6-bd4211df1190.exe (PID: 1616)

    • Reads Environment values

      • injection.exe (PID: 4136)
      • 111111111111111111111111111111111111.exe (PID: 4164)

    • Disables trace logs

      • injection.exe (PID: 4136)

    • Checks proxy server information

      • injection.exe (PID: 4136)

    • Reads the software policy settings

      • injection.exe (PID: 4136)

    • Creates files or folders in the user directory

      • 111111111111111111111111111111111111.exe (PID: 4164)
      • injection.exe (PID: 4136)

    • Process checks whether UAC notifications are on

      • 111111111111111111111111111111111111.exe (PID: 4164)
      • wlanext.exe (PID: 3172)

    • Attempting to use instant messaging service

      • injection.exe (PID: 4136)
      • svchost.exe (PID: 2192)

    • Reads product name

      • 111111111111111111111111111111111111.exe (PID: 4164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Nanocore

(PID) Process(4164) 111111111111111111111111111111111111.exe
BuildTime2024-12-02 17:51:11.142600
Version1.2.2.0
Mutexd516db18-d565-4fff-a872-0ad0fd1f18ca
DefaultGroupDefault
PrimaryConnectionHost
BackupConnectionHostoriginal-financial.gl.at.ply.gg
ConnectionPort28916
RunOnStartupFalse
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
(PID) Process(3172) wlanext.exe
BuildTime2024-12-02 17:51:11.142600
Version1.2.2.0
Mutexd516db18-d565-4fff-a872-0ad0fd1f18ca
DefaultGroupDefault
PrimaryConnectionHost
BackupConnectionHostoriginal-financial.gl.at.ply.gg
ConnectionPort28916
RunOnStartupFalse
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4

ims-api

(PID) Process(3172) wlanext.exe
Discord-Webhook-Tokens (1)1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
Discord-Info-Links
1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
Get Webhook Infohttps://discord.com/api/webhooks/1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:02 18:11:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 511488
InitializedDataSize: 25088
UninitializedDataSize: -
EntryPoint: 0x7ec1e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: XBinderOutput.exe
LegalCopyright:
OriginalFileName: XBinderOutput.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start b2c04bb4-1039-4836-bca6-bd4211df1190.exe #NANOCORE 111111111111111111111111111111111111.exe injection.exe setup.exe no specs setup.exe svchost.exe #NANOCORE wlanext.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1616"C:\Users\admin\Desktop\b2c04bb4-1039-4836-bca6-bd4211df1190.exe" C:\Users\admin\Desktop\b2c04bb4-1039-4836-bca6-bd4211df1190.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\b2c04bb4-1039-4836-bca6-bd4211df1190.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3172"C:\Users\admin\AppData\Roaming\wlanext.exe"C:\Users\admin\AppData\Roaming\wlanext.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\wlanext.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
ims-api
(PID) Process(3172) wlanext.exe
Discord-Webhook-Tokens (1)1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
Discord-Info-Links
1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
Get Webhook Infohttps://discord.com/api/webhooks/1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
Nanocore
(PID) Process(3172) wlanext.exe
BuildTime2024-12-02 17:51:11.142600
Version1.2.2.0
Mutexd516db18-d565-4fff-a872-0ad0fd1f18ca
DefaultGroupDefault
PrimaryConnectionHost
BackupConnectionHostoriginal-financial.gl.at.ply.gg
ConnectionPort28916
RunOnStartupFalse
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
3696"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe—b2c04bb4-1039-4836-bca6-bd4211df1190.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
MEDIUM
Description:
DemoShield Multi-CD Launch
Exit code:
3221226540
Version:
7.01, 100, 1027
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4136"C:\Users\admin\AppData\Local\Temp\injection.exe" C:\Users\admin\AppData\Local\Temp\injection.exe
b2c04bb4-1039-4836-bca6-bd4211df1190.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\injection.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4164"C:\Users\admin\AppData\Local\Temp\111111111111111111111111111111111111.exe" C:\Users\admin\AppData\Local\Temp\111111111111111111111111111111111111.exe
b2c04bb4-1039-4836-bca6-bd4211df1190.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\111111111111111111111111111111111111.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Nanocore
(PID) Process(4164) 111111111111111111111111111111111111.exe
BuildTime2024-12-02 17:51:11.142600
Version1.2.2.0
Mutexd516db18-d565-4fff-a872-0ad0fd1f18ca
DefaultGroupDefault
PrimaryConnectionHost
BackupConnectionHostoriginal-financial.gl.at.ply.gg
ConnectionPort28916
RunOnStartupFalse
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
5252"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
b2c04bb4-1039-4836-bca6-bd4211df1190.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
DemoShield Multi-CD Launch
Exit code:
0
Version:
7.01, 100, 1027
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
5 142
Read events
5 128
Write events
14
Delete events
0

Modification events

(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4136) injection.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\injection_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
4
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1616b2c04bb4-1039-4836-bca6-bd4211df1190.exeC:\Users\admin\AppData\Local\Temp\111111111111111111111111111111111111.exeexecutable
MD5:9258D024EE6FBFE283978E89E25CBC50
SHA256:392A00E29A7305EAD657C6C10D80B446F8B6BFE25A171E63E43439695F40410A
4164111111111111111111111111111111111111.exeC:\Users\admin\AppData\Roaming\BB926E54-E3CA-40FD-AE90-2764341E7792\storage.datbinary
MD5:7F0642B40D7F2EE4CF9D08601762F280
SHA256:E6A52CF6101CD8A5B0B276BA0507AB1FA3203267B842C4534F28F37ADA40C02A
4136injection.exeC:\Users\admin\AppData\Roaming\wlanext.exeexecutable
MD5:153DEB0E0FFC0B476D5BBA8A69778DDE
SHA256:4BA3120B20DADB2BA430CA2BB5CB492BF0ADBB4A6685C4C757086E6F46D5D607
4164111111111111111111111111111111111111.exeC:\Users\admin\AppData\Roaming\BB926E54-E3CA-40FD-AE90-2764341E7792\catalog.datbinary
MD5:061E700FE27D852034A5A44BF5985CCF
SHA256:4BBB88AF530693EB4A710B0591D4BAF585837242C5690F5A821BF2FC9CC587CD
4164111111111111111111111111111111111111.exeC:\Users\admin\AppData\Roaming\BB926E54-E3CA-40FD-AE90-2764341E7792\settings.binbinary
MD5:AE0F5E6CE7122AF264EC533C6B15A27B
SHA256:73B0B92179C61C26589B47E9732CE418B07EDEE3860EE5A2A5FB06F3B8AA9B26
1616b2c04bb4-1039-4836-bca6-bd4211df1190.exeC:\Users\admin\AppData\Local\Temp\injection.exeexecutable
MD5:153DEB0E0FFC0B476D5BBA8A69778DDE
SHA256:4BA3120B20DADB2BA430CA2BB5CB492BF0ADBB4A6685C4C757086E6F46D5D607
4164111111111111111111111111111111111111.exeC:\Users\admin\AppData\Roaming\BB926E54-E3CA-40FD-AE90-2764341E7792\run.datbinary
MD5:5266500A5643D0DCA67B850F0323D5F8
SHA256:534B57DD23534585F89FCC109E6E370C389136EF1351ACA84D4590AC597AF974
1616b2c04bb4-1039-4836-bca6-bd4211df1190.exeC:\Users\admin\AppData\Local\Temp\Setup.exeexecutable
MD5:FB47CB26A0C7480148A8D0C8F8E01BE1
SHA256:255472E23F31EEBE810F217212BF9CAA39A30CAC423DBE9893B554308DA7DB4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
24
DNS requests
21
Threats
85

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4136
injection.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv/?fields=status,query
unknown
—
—
shared
4712
MoUsoCoreWorker.exe
GET
200
23.195.249.173:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
404
162.159.135.232:443
https://discord.com/api/webhooks/1309139150745767976/HQCehpMu-KtqFAfY5A9H8ltBqh_UTqjI4T4_keZiaZg4sYn-QeNjnUc6uMmugqGcqCJE
unknown
binary
45 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.212.110.162:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4136
injection.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
shared
4712
MoUsoCoreWorker.exe
23.195.249.173:80
www.microsoft.com
AKAMAI-AS
CZ
whitelisted
4136
injection.exe
162.159.137.232:443
discord.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 23.212.110.162
  • 23.212.110.171
  • 23.212.110.161
  • 23.212.110.200
  • 23.212.110.176
  • 23.212.110.163
  • 23.212.110.153
  • 23.212.110.201
  • 23.212.110.185
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.176
  • 23.48.23.143
whitelisted
ip-api.com
  • 208.95.112.1
shared
www.microsoft.com
  • 23.195.249.173
whitelisted
discord.com
  • 162.159.137.232
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.135.232
whitelisted
original-financial.gl.at.ply.gg
  • 147.185.221.23
unknown
self.events.data.microsoft.com
  • 20.42.65.88
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4136
injection.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
4136
injection.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2192
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
4136
injection.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
4164
111111111111111111111111111111111111.exe
Misc activity
ET INFO Tunneling Service in DNS Lookup (* .ply .gg)
4164
111111111111111111111111111111111111.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
4164
111111111111111111111111111111111111.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
4164
111111111111111111111111111111111111.exe
Misc activity
ET INFO Tunneling Service in DNS Lookup (* .ply .gg)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b2c04bb4-1039-4836-bca6-bd4211df1190