File name:

Zagreus Builder.exe

Full analysis: https://app.any.run/tasks/082fcedb-a4c8-44af-9fa2-cd4077daa7c0
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 00:17:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
neshta
confuser
telegram
ims-api
generic
discordgrabber
autorun-download
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

88CD6943FC236ACFD406B339FFACBE46

SHA1:

0F736349C4FD9189F9235AA38B064838FF283636

SHA256:

5E0F46628ECEC878ED244BCCEAA2981B947DB254CF34DFC0B7F4A8D5C211A842

SSDEEP:

49152:oUpLxivo6RKPQS6r7vwNYR8nU/NX+dwZPVqXPbVwuDk/kTsxPSc1lLr2f29UNlkL:6rRyQJnoNYR8eNuWPIPSuDNTZ2N8GP20

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NESHTA mutex has been found

      • ZagreuS Builder.exe (PID: 6044)
      • Zagreus Builder.exe (PID: 9012)
      • ZagreuS Builder.exe (PID: 9056)
      • ZagreuS Builder.exe (PID: 2088)
      • ZagreuS Builder.exe (PID: 7208)
      • ZagreuS Builder.exe (PID: 7236)
      • ZagreuS Builder.exe (PID: 7184)
      • ZagreuS Builder.exe (PID: 8360)
      • ZagreuS Builder.exe (PID: 6620)
      • ZagreuS Builder.exe (PID: 8912)
      • ZagreuS Builder.exe (PID: 8268)
      • ZagreuS Builder.exe (PID: 7984)
      • ZagreuS Builder.exe (PID: 7968)
      • ZagreuS Builder.exe (PID: 7868)
      • ZagreuS Builder.exe (PID: 9116)
      • ZagreuS Builder.exe (PID: 6040)
      • ZagreuS Builder.exe (PID: 5072)
      • ZagreuS Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 8152)
      • ZagreuS Builder.exe (PID: 5280)
      • ZagreuS Builder.exe (PID: 6136)

    • Steals credentials from Web Browsers

      • Cicada.exe (PID: 4776)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 8428)

    • Actions looks like stealing of personal data

      • Cicada.exe (PID: 4776)
      • ZagreuS Builder.exe (PID: 6044)
      • HTTPDebuggerSvc.exe (PID: 5512)
      • certutil.exe (PID: 7588)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Executing a file with an untrusted certificate

      • FileCoAuth.exe (PID: 5400)

    • DISCORDGRABBER has been detected (YARA)

      • Cicada.exe (PID: 4776)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Zagreus Builder.exe (PID: 680)
      • ZagreuS Builder.exe (PID: 6044)
      • msiexec.exe (PID: 8796)
      • HTTPDebuggerUI.exe (PID: 8536)
      • Zagreus Builder.exe (PID: 9012)
      • Zagreus Builder.exe (PID: 7888)
      • ZagreuS Builder.exe (PID: 9056)
      • Zagreus Builder.exe (PID: 5968)
      • ZagreuS Builder.exe (PID: 2088)
      • Zagreus Builder.exe (PID: 7332)
      • ZagreuS Builder.exe (PID: 7208)
      • ZagreuS Builder.exe (PID: 7236)
      • Zagreus Builder.exe (PID: 7172)
      • Zagreus Builder.exe (PID: 7252)
      • Zagreus Builder.exe (PID: 3156)
      • ZagreuS Builder.exe (PID: 8360)
      • ZagreuS Builder.exe (PID: 7184)
      • Zagreus Builder.exe (PID: 2384)
      • ZagreuS Builder.exe (PID: 6620)
      • ZagreuS Builder.exe (PID: 8912)
      • Zagreus Builder.exe (PID: 8040)
      • ZagreuS Builder.exe (PID: 8268)
      • Zagreus Builder.exe (PID: 7660)
      • Zagreus Builder.exe (PID: 8476)
      • ZagreuS Builder.exe (PID: 7984)
      • Zagreus Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 7968)
      • Zagreus Builder.exe (PID: 5508)
      • ZagreuS Builder.exe (PID: 7868)
      • Zagreus Builder.exe (PID: 5796)
      • ZagreuS Builder.exe (PID: 9116)
      • Zagreus Builder.exe (PID: 9008)
      • ZagreuS Builder.exe (PID: 6040)
      • Zagreus Builder.exe (PID: 7840)
      • Zagreus Builder.exe (PID: 4724)
      • ZagreuS Builder.exe (PID: 5072)
      • Zagreus Builder.exe (PID: 8948)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 5328)
      • Zagreus Builder.exe (PID: 7760)
      • ZagreuS Builder.exe (PID: 5280)
      • ZagreuS Builder.exe (PID: 8152)
      • Zagreus Builder.exe (PID: 9156)
      • ZagreuS Builder.exe (PID: 7396)
      • Zagreus Builder.exe (PID: 8420)
      • ZagreuS Builder.exe (PID: 7528)
      • ZagreuS Builder.exe (PID: 7316)
      • ZagreuS Builder.exe (PID: 6136)
      • Zagreus Builder.exe (PID: 8560)
      • Zagreus Builder.exe (PID: 7400)
      • ZagreuS Builder.exe (PID: 2692)
      • ZagreuS Builder.exe (PID: 5428)
      • Zagreus Builder.exe (PID: 7840)
      • ZagreuS Builder.exe (PID: 8160)
      • Zagreus Builder.exe (PID: 2776)
      • Zagreus Builder.exe (PID: 7408)
      • Zagreus Builder.exe (PID: 6644)
      • ZagreuS Builder.exe (PID: 9136)
      • ZagreuS Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 9072)
      • Zagreus Builder.exe (PID: 2104)
      • Zagreus Builder.exe (PID: 9028)
      • ZagreuS Builder.exe (PID: 8884)
      • Zagreus Builder.exe (PID: 8364)
      • ZagreuS Builder.exe (PID: 6372)
      • ZagreuS Builder.exe (PID: 2384)
      • Zagreus Builder.exe (PID: 6872)
      • Zagreus Builder.exe (PID: 8320)
      • ZagreuS Builder.exe (PID: 6904)
      • Zagreus Builder.exe (PID: 4728)
      • Zagreus Builder.exe (PID: 7580)
      • ZagreuS Builder.exe (PID: 8664)
      • ZagreuS Builder.exe (PID: 6660)
      • Zagreus Builder.exe (PID: 5720)
      • Zagreus Builder.exe (PID: 8604)
      • ZagreuS Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 7228)
      • Zagreus Builder.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 2656)
      • ZagreuS Builder.exe (PID: 9184)
      • ZagreuS Builder.exe (PID: 8884)
      • ZagreuS Builder.exe (PID: 6388)
      • Zagreus Builder.exe (PID: 5112)
      • Zagreus Builder.exe (PID: 8500)
      • ZagreuS Builder.exe (PID: 4528)
      • Zagreus Builder.exe (PID: 4728)
      • ZagreuS Builder.exe (PID: 8824)
      • Zagreus Builder.exe (PID: 8948)
      • ZagreuS Builder.exe (PID: 6572)
      • Zagreus Builder.exe (PID: 5328)
      • ZagreuS Builder.exe (PID: 7648)
      • Zagreus Builder.exe (PID: 7896)
      • Zagreus Builder.exe (PID: 300)
      • ZagreuS Builder.exe (PID: 8256)
      • ZagreuS Builder.exe (PID: 8744)

    • Executable content was dropped or overwritten

      • Zagreus Builder.exe (PID: 680)
      • ZagreuS Builder.exe (PID: 6044)
      • HTTPDebuggerSvc.exe (PID: 5512)
      • Zagreus Builder.exe (PID: 9012)
      • ZagreuS Builder.exe (PID: 8256)

    • Reads the date of Windows installation

      • Zagreus Builder.exe (PID: 680)
      • Zagreus Builder.exe (PID: 7888)
      • Zagreus Builder.exe (PID: 5968)
      • Zagreus Builder.exe (PID: 7332)
      • Zagreus Builder.exe (PID: 7172)
      • Zagreus Builder.exe (PID: 7252)
      • Zagreus Builder.exe (PID: 3156)
      • Zagreus Builder.exe (PID: 2384)
      • Zagreus Builder.exe (PID: 8040)
      • Zagreus Builder.exe (PID: 8476)
      • Zagreus Builder.exe (PID: 7660)
      • Zagreus Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 5508)
      • Zagreus Builder.exe (PID: 5796)
      • Zagreus Builder.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 7840)
      • Zagreus Builder.exe (PID: 4724)
      • Zagreus Builder.exe (PID: 8948)
      • Zagreus Builder.exe (PID: 5328)
      • Zagreus Builder.exe (PID: 7760)
      • Zagreus Builder.exe (PID: 9156)
      • Zagreus Builder.exe (PID: 8560)
      • Zagreus Builder.exe (PID: 7400)
      • Zagreus Builder.exe (PID: 7840)
      • Zagreus Builder.exe (PID: 7408)
      • Zagreus Builder.exe (PID: 2776)
      • Zagreus Builder.exe (PID: 6644)
      • Zagreus Builder.exe (PID: 2104)
      • Zagreus Builder.exe (PID: 8420)
      • Zagreus Builder.exe (PID: 9028)
      • Zagreus Builder.exe (PID: 8364)
      • Zagreus Builder.exe (PID: 8320)
      • Zagreus Builder.exe (PID: 6872)
      • Zagreus Builder.exe (PID: 4728)
      • Zagreus Builder.exe (PID: 7580)
      • Zagreus Builder.exe (PID: 5720)
      • Zagreus Builder.exe (PID: 8604)
      • Zagreus Builder.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 2656)
      • Zagreus Builder.exe (PID: 5112)
      • Zagreus Builder.exe (PID: 8500)
      • Zagreus Builder.exe (PID: 4728)
      • Zagreus Builder.exe (PID: 8948)
      • Zagreus Builder.exe (PID: 5328)
      • Zagreus Builder.exe (PID: 7896)
      • Zagreus Builder.exe (PID: 300)

    • Mutex name with non-standard characters

      • ZagreuS Builder.exe (PID: 6044)
      • Zagreus Builder.exe (PID: 9012)
      • ZagreuS Builder.exe (PID: 9056)
      • ZagreuS Builder.exe (PID: 2088)
      • ZagreuS Builder.exe (PID: 7208)
      • ZagreuS Builder.exe (PID: 7236)
      • ZagreuS Builder.exe (PID: 7184)
      • ZagreuS Builder.exe (PID: 6620)
      • ZagreuS Builder.exe (PID: 8360)
      • ZagreuS Builder.exe (PID: 8912)
      • ZagreuS Builder.exe (PID: 8268)
      • ZagreuS Builder.exe (PID: 7984)
      • ZagreuS Builder.exe (PID: 7968)
      • ZagreuS Builder.exe (PID: 7868)
      • ZagreuS Builder.exe (PID: 9116)
      • ZagreuS Builder.exe (PID: 6040)
      • ZagreuS Builder.exe (PID: 5072)
      • ZagreuS Builder.exe (PID: 6136)
      • ZagreuS Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 8152)
      • ZagreuS Builder.exe (PID: 5280)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Cicada.exe (PID: 4776)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Cicada.exe (PID: 4776)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • There is functionality for taking screenshot (YARA)

      • ZagreuS Builder.exe (PID: 6044)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Cicada.exe (PID: 4776)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Cicada.exe (PID: 4776)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Starts a Microsoft application from unusual location

      • FileCoAuth.exe (PID: 5400)

    • Executes as Windows Service

      • VSSVC.exe (PID: 8220)
      • HTTPDebuggerSvc.exe (PID: 5512)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7740)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7740)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7740)
      • HTTPDebuggerSvc.exe (PID: 5512)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 1280)

    • Creates files in the driver directory

      • HTTPDebuggerSvc.exe (PID: 5512)

    • Reads Microsoft Outlook installation path

      • HTTPDebuggerUI.exe (PID: 8536)

    • Reads Internet Explorer settings

      • HTTPDebuggerUI.exe (PID: 8536)

    • Adds/modifies Windows certificates

      • HTTPDebuggerSvc.exe (PID: 5512)

    • Searches for installed software

      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

  • INFO

    • Checks supported languages

      • Zagreus Builder.exe (PID: 680)
      • Cicada.exe (PID: 4776)
      • ZagreuS Builder.exe (PID: 6436)
      • ZagreuS Builder.exe (PID: 6044)
      • msiexec.exe (PID: 8796)
      • FileCoAuth.exe (PID: 5400)
      • msiexec.exe (PID: 5972)
      • HTTPDebuggerSvc.exe (PID: 5512)
      • HTTPDebuggerSvc.exe (PID: 8076)
      • HTTPDebuggerUI.exe (PID: 8536)
      • certutil.exe (PID: 7588)
      • HTTPDebuggerUI.exe (PID: 7780)
      • Zagreus Builder.exe (PID: 9012)
      • Zagreus Builder.exe (PID: 7888)
      • ZagreuS Builder.exe (PID: 9056)
      • msiexec.exe (PID: 7740)
      • Cicada.exe (PID: 9180)
      • Zagreus Builder.exe (PID: 5968)
      • ZagreuS Builder.exe (PID: 2088)
      • Zagreus Builder.exe (PID: 7332)
      • Cicada.exe (PID: 7400)
      • Zagreus Builder.exe (PID: 7252)
      • Cicada.exe (PID: 7376)
      • ZagreuS Builder.exe (PID: 7208)
      • ZagreuS Builder.exe (PID: 7236)
      • Cicada.exe (PID: 7480)
      • ZagreuS Builder.exe (PID: 7184)
      • Zagreus Builder.exe (PID: 7172)
      • Cicada.exe (PID: 3968)
      • Zagreus Builder.exe (PID: 3156)
      • ZagreuS Builder.exe (PID: 8360)
      • Cicada.exe (PID: 4268)
      • Zagreus Builder.exe (PID: 2384)
      • Cicada.exe (PID: 8068)
      • ZagreuS Builder.exe (PID: 6620)
      • ZagreuS Builder.exe (PID: 8912)
      • Zagreus Builder.exe (PID: 8040)
      • Zagreus Builder.exe (PID: 8476)
      • Cicada.exe (PID: 8916)
      • Cicada.exe (PID: 7920)
      • ZagreuS Builder.exe (PID: 8268)
      • Zagreus Builder.exe (PID: 7660)
      • ZagreuS Builder.exe (PID: 7984)
      • Cicada.exe (PID: 8288)
      • Zagreus Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 7968)
      • Cicada.exe (PID: 2780)
      • Zagreus Builder.exe (PID: 5508)
      • ZagreuS Builder.exe (PID: 7868)
      • Cicada.exe (PID: 7780)
      • Zagreus Builder.exe (PID: 5796)
      • Cicada.exe (PID: 9028)
      • ZagreuS Builder.exe (PID: 9116)
      • Zagreus Builder.exe (PID: 9008)
      • ZagreuS Builder.exe (PID: 6040)
      • Cicada.exe (PID: 7824)
      • Zagreus Builder.exe (PID: 7840)
      • ZagreuS Builder.exe (PID: 5072)
      • Cicada.exe (PID: 904)
      • ZagreuS Builder.exe (PID: 6136)
      • Zagreus Builder.exe (PID: 4724)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 8948)
      • Cicada.exe (PID: 7644)
      • Zagreus Builder.exe (PID: 5328)
      • ZagreuS Builder.exe (PID: 8152)
      • Cicada.exe (PID: 736)
      • ZagreuS Builder.exe (PID: 5280)
      • Zagreus Builder.exe (PID: 7760)
      • Cicada.exe (PID: 5936)
      • Cicada.exe (PID: 7336)
      • ZagreuS Builder.exe (PID: 7396)
      • Zagreus Builder.exe (PID: 9156)
      • Zagreus Builder.exe (PID: 8420)
      • Cicada.exe (PID: 8456)
      • ZagreuS Builder.exe (PID: 7528)
      • ZagreuS Builder.exe (PID: 7316)
      • Cicada.exe (PID: 5384)
      • Zagreus Builder.exe (PID: 7400)
      • Zagreus Builder.exe (PID: 8560)
      • ZagreuS Builder.exe (PID: 2692)
      • Cicada.exe (PID: 8416)
      • Zagreus Builder.exe (PID: 7840)
      • Cicada.exe (PID: 8896)
      • ZagreuS Builder.exe (PID: 8160)
      • ZagreuS Builder.exe (PID: 5428)
      • Cicada.exe (PID: 8204)
      • Zagreus Builder.exe (PID: 7408)
      • Zagreus Builder.exe (PID: 2776)
      • Cicada.exe (PID: 8864)
      • ZagreuS Builder.exe (PID: 4376)
      • Cicada.exe (PID: 7968)
      • ZagreuS Builder.exe (PID: 9136)
      • Cicada.exe (PID: 9208)
      • Zagreus Builder.exe (PID: 6644)
      • Cicada.exe (PID: 9016)
      • Zagreus Builder.exe (PID: 2104)
      • ZagreuS Builder.exe (PID: 9072)
      • Zagreus Builder.exe (PID: 9028)
      • ZagreuS Builder.exe (PID: 8884)
      • Cicada.exe (PID: 540)
      • Zagreus Builder.exe (PID: 8364)
      • ZagreuS Builder.exe (PID: 6372)
      • Cicada.exe (PID: 8660)
      • Zagreus Builder.exe (PID: 8320)
      • ZagreuS Builder.exe (PID: 2384)
      • Cicada.exe (PID: 6620)
      • Zagreus Builder.exe (PID: 6872)
      • ZagreuS Builder.exe (PID: 6904)
      • Zagreus Builder.exe (PID: 4728)
      • Cicada.exe (PID: 8880)
      • ZagreuS Builder.exe (PID: 6660)
      • Zagreus Builder.exe (PID: 7580)
      • Cicada.exe (PID: 5084)
      • ZagreuS Builder.exe (PID: 8664)
      • Zagreus Builder.exe (PID: 5720)
      • Cicada.exe (PID: 1452)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 8604)
      • Cicada.exe (PID: 7644)
      • Cicada.exe (PID: 3620)
      • ZagreuS Builder.exe (PID: 7228)
      • Zagreus Builder.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 2656)
      • Cicada.exe (PID: 9120)
      • ZagreuS Builder.exe (PID: 8884)
      • Cicada.exe (PID: 300)
      • Zagreus Builder.exe (PID: 5112)
      • ZagreuS Builder.exe (PID: 6388)
      • Cicada.exe (PID: 8428)
      • Zagreus Builder.exe (PID: 8500)
      • ZagreuS Builder.exe (PID: 9184)
      • Cicada.exe (PID: 8288)
      • ZagreuS Builder.exe (PID: 4528)
      • Zagreus Builder.exe (PID: 4728)
      • Cicada.exe (PID: 7144)
      • ZagreuS Builder.exe (PID: 8824)
      • Zagreus Builder.exe (PID: 8948)
      • ZagreuS Builder.exe (PID: 6572)
      • Cicada.exe (PID: 5720)
      • Zagreus Builder.exe (PID: 5328)
      • ZagreuS Builder.exe (PID: 7648)
      • Cicada.exe (PID: 9144)
      • Zagreus Builder.exe (PID: 7896)
      • Cicada.exe (PID: 9008)
      • ZagreuS Builder.exe (PID: 8744)
      • Zagreus Builder.exe (PID: 300)
      • ZagreuS Builder.exe (PID: 8256)
      • Cicada.exe (PID: 840)
      • ZagreuS Builder.exe (PID: 8416)

    • Reads the computer name

      • Zagreus Builder.exe (PID: 680)
      • Cicada.exe (PID: 4776)
      • ZagreuS Builder.exe (PID: 6044)
      • ZagreuS Builder.exe (PID: 6436)
      • msiexec.exe (PID: 7740)
      • FileCoAuth.exe (PID: 5400)
      • msiexec.exe (PID: 8796)
      • msiexec.exe (PID: 5972)
      • HTTPDebuggerSvc.exe (PID: 5512)
      • HTTPDebuggerSvc.exe (PID: 8076)
      • HTTPDebuggerUI.exe (PID: 8536)
      • certutil.exe (PID: 7588)
      • HTTPDebuggerUI.exe (PID: 7780)
      • Zagreus Builder.exe (PID: 9012)
      • Zagreus Builder.exe (PID: 7888)
      • ZagreuS Builder.exe (PID: 9056)
      • Zagreus Builder.exe (PID: 5968)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 7400)
      • ZagreuS Builder.exe (PID: 2088)
      • Cicada.exe (PID: 7376)
      • ZagreuS Builder.exe (PID: 7208)
      • Zagreus Builder.exe (PID: 7252)
      • Zagreus Builder.exe (PID: 7332)
      • Cicada.exe (PID: 7480)
      • ZagreuS Builder.exe (PID: 7236)
      • Zagreus Builder.exe (PID: 7172)
      • Cicada.exe (PID: 3968)
      • ZagreuS Builder.exe (PID: 7184)
      • Zagreus Builder.exe (PID: 3156)
      • Cicada.exe (PID: 4268)
      • ZagreuS Builder.exe (PID: 8360)
      • Zagreus Builder.exe (PID: 2384)
      • ZagreuS Builder.exe (PID: 6620)
      • Cicada.exe (PID: 8068)
      • Zagreus Builder.exe (PID: 8040)
      • Cicada.exe (PID: 8916)
      • ZagreuS Builder.exe (PID: 8912)
      • Zagreus Builder.exe (PID: 8476)
      • Cicada.exe (PID: 7920)
      • Zagreus Builder.exe (PID: 7660)
      • ZagreuS Builder.exe (PID: 8268)
      • Cicada.exe (PID: 8288)
      • ZagreuS Builder.exe (PID: 7984)
      • Zagreus Builder.exe (PID: 4376)
      • Cicada.exe (PID: 2780)
      • ZagreuS Builder.exe (PID: 7968)
      • Zagreus Builder.exe (PID: 5508)
      • ZagreuS Builder.exe (PID: 7868)
      • Cicada.exe (PID: 7780)
      • Zagreus Builder.exe (PID: 5796)
      • Cicada.exe (PID: 9028)
      • ZagreuS Builder.exe (PID: 9116)
      • Zagreus Builder.exe (PID: 9008)
      • Cicada.exe (PID: 7824)
      • ZagreuS Builder.exe (PID: 6040)
      • Zagreus Builder.exe (PID: 7840)
      • Cicada.exe (PID: 904)
      • ZagreuS Builder.exe (PID: 5072)
      • Cicada.exe (PID: 8896)
      • Zagreus Builder.exe (PID: 4724)
      • Zagreus Builder.exe (PID: 8948)
      • ZagreuS Builder.exe (PID: 6136)
      • Zagreus Builder.exe (PID: 5328)
      • Cicada.exe (PID: 736)
      • ZagreuS Builder.exe (PID: 8152)
      • Cicada.exe (PID: 7644)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 7760)
      • Cicada.exe (PID: 5936)
      • ZagreuS Builder.exe (PID: 5280)
      • Zagreus Builder.exe (PID: 9156)
      • Cicada.exe (PID: 7336)
      • ZagreuS Builder.exe (PID: 7396)
      • Cicada.exe (PID: 8456)
      • ZagreuS Builder.exe (PID: 7528)
      • Zagreus Builder.exe (PID: 8420)
      • Cicada.exe (PID: 5384)
      • ZagreuS Builder.exe (PID: 7316)
      • Zagreus Builder.exe (PID: 8560)
      • Zagreus Builder.exe (PID: 7840)
      • Cicada.exe (PID: 8416)
      • ZagreuS Builder.exe (PID: 2692)
      • Zagreus Builder.exe (PID: 7400)
      • ZagreuS Builder.exe (PID: 5428)
      • Cicada.exe (PID: 8204)
      • Zagreus Builder.exe (PID: 7408)
      • Cicada.exe (PID: 8864)
      • ZagreuS Builder.exe (PID: 8160)
      • Zagreus Builder.exe (PID: 2776)
      • Zagreus Builder.exe (PID: 6644)
      • Cicada.exe (PID: 9208)
      • ZagreuS Builder.exe (PID: 9136)
      • Cicada.exe (PID: 7968)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 2104)
      • Cicada.exe (PID: 9016)
      • ZagreuS Builder.exe (PID: 9072)
      • Zagreus Builder.exe (PID: 9028)
      • Cicada.exe (PID: 540)
      • ZagreuS Builder.exe (PID: 8884)
      • Zagreus Builder.exe (PID: 8364)
      • Cicada.exe (PID: 8660)
      • ZagreuS Builder.exe (PID: 6372)
      • Zagreus Builder.exe (PID: 8320)
      • ZagreuS Builder.exe (PID: 2384)
      • Zagreus Builder.exe (PID: 6872)
      • Cicada.exe (PID: 6620)
      • ZagreuS Builder.exe (PID: 6904)
      • Zagreus Builder.exe (PID: 4728)
      • ZagreuS Builder.exe (PID: 6660)
      • Cicada.exe (PID: 1452)
      • Cicada.exe (PID: 8880)
      • Zagreus Builder.exe (PID: 7580)
      • Cicada.exe (PID: 5084)
      • ZagreuS Builder.exe (PID: 8664)
      • Cicada.exe (PID: 7644)
      • Zagreus Builder.exe (PID: 8604)
      • Zagreus Builder.exe (PID: 5720)
      • Cicada.exe (PID: 3620)
      • Zagreus Builder.exe (PID: 9008)
      • Cicada.exe (PID: 300)
      • ZagreuS Builder.exe (PID: 7228)
      • Zagreus Builder.exe (PID: 2656)
      • ZagreuS Builder.exe (PID: 9184)
      • Cicada.exe (PID: 9120)
      • ZagreuS Builder.exe (PID: 8884)
      • Zagreus Builder.exe (PID: 5112)
      • Cicada.exe (PID: 8428)
      • ZagreuS Builder.exe (PID: 6388)
      • Zagreus Builder.exe (PID: 8500)
      • Cicada.exe (PID: 8288)
      • ZagreuS Builder.exe (PID: 4528)
      • Zagreus Builder.exe (PID: 4728)
      • Cicada.exe (PID: 7144)
      • ZagreuS Builder.exe (PID: 8824)
      • Zagreus Builder.exe (PID: 8948)
      • Cicada.exe (PID: 5720)
      • ZagreuS Builder.exe (PID: 6572)
      • Zagreus Builder.exe (PID: 5328)
      • ZagreuS Builder.exe (PID: 7648)
      • ZagreuS Builder.exe (PID: 8744)
      • Cicada.exe (PID: 9144)
      • Zagreus Builder.exe (PID: 7896)
      • Cicada.exe (PID: 9008)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 300)
      • Cicada.exe (PID: 840)
      • ZagreuS Builder.exe (PID: 8256)
      • ZagreuS Builder.exe (PID: 8416)

    • Process checks computer location settings

      • Zagreus Builder.exe (PID: 680)
      • ZagreuS Builder.exe (PID: 6044)
      • msiexec.exe (PID: 8796)
      • Zagreus Builder.exe (PID: 9012)
      • Zagreus Builder.exe (PID: 7888)
      • ZagreuS Builder.exe (PID: 9056)
      • Zagreus Builder.exe (PID: 5968)
      • ZagreuS Builder.exe (PID: 2088)
      • Zagreus Builder.exe (PID: 7332)
      • ZagreuS Builder.exe (PID: 7208)
      • Zagreus Builder.exe (PID: 7252)
      • ZagreuS Builder.exe (PID: 7236)
      • Zagreus Builder.exe (PID: 7172)
      • Zagreus Builder.exe (PID: 3156)
      • ZagreuS Builder.exe (PID: 7184)
      • Zagreus Builder.exe (PID: 2384)
      • ZagreuS Builder.exe (PID: 6620)
      • ZagreuS Builder.exe (PID: 8360)
      • ZagreuS Builder.exe (PID: 8912)
      • Zagreus Builder.exe (PID: 8040)
      • Zagreus Builder.exe (PID: 8476)
      • ZagreuS Builder.exe (PID: 8268)
      • Zagreus Builder.exe (PID: 7660)
      • ZagreuS Builder.exe (PID: 7984)
      • Zagreus Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 7968)
      • Zagreus Builder.exe (PID: 5508)
      • ZagreuS Builder.exe (PID: 7868)
      • Zagreus Builder.exe (PID: 5796)
      • ZagreuS Builder.exe (PID: 9116)
      • Zagreus Builder.exe (PID: 9008)
      • ZagreuS Builder.exe (PID: 6040)
      • Zagreus Builder.exe (PID: 7840)
      • ZagreuS Builder.exe (PID: 5072)
      • Zagreus Builder.exe (PID: 4724)
      • ZagreuS Builder.exe (PID: 6136)
      • Zagreus Builder.exe (PID: 8948)
      • ZagreuS Builder.exe (PID: 4376)
      • Zagreus Builder.exe (PID: 5328)
      • Zagreus Builder.exe (PID: 7760)
      • ZagreuS Builder.exe (PID: 5280)
      • ZagreuS Builder.exe (PID: 8152)
      • ZagreuS Builder.exe (PID: 7396)
      • Zagreus Builder.exe (PID: 9156)
      • Zagreus Builder.exe (PID: 8420)
      • ZagreuS Builder.exe (PID: 7528)
      • Zagreus Builder.exe (PID: 8560)
      • ZagreuS Builder.exe (PID: 7316)
      • Zagreus Builder.exe (PID: 7400)
      • ZagreuS Builder.exe (PID: 2692)
      • ZagreuS Builder.exe (PID: 5428)
      • Zagreus Builder.exe (PID: 7408)
      • Zagreus Builder.exe (PID: 7840)
      • ZagreuS Builder.exe (PID: 8160)
      • Zagreus Builder.exe (PID: 2776)
      • Zagreus Builder.exe (PID: 6644)
      • ZagreuS Builder.exe (PID: 9136)
      • ZagreuS Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 9072)
      • Zagreus Builder.exe (PID: 2104)
      • Zagreus Builder.exe (PID: 9028)
      • Zagreus Builder.exe (PID: 8364)
      • ZagreuS Builder.exe (PID: 6372)
      • ZagreuS Builder.exe (PID: 8884)
      • ZagreuS Builder.exe (PID: 2384)
      • Zagreus Builder.exe (PID: 8320)
      • Zagreus Builder.exe (PID: 4728)
      • Zagreus Builder.exe (PID: 6872)
      • ZagreuS Builder.exe (PID: 6904)
      • Zagreus Builder.exe (PID: 7580)
      • ZagreuS Builder.exe (PID: 8664)
      • ZagreuS Builder.exe (PID: 6660)
      • Zagreus Builder.exe (PID: 5720)
      • ZagreuS Builder.exe (PID: 4376)
      • ZagreuS Builder.exe (PID: 7228)
      • Zagreus Builder.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 8604)
      • Zagreus Builder.exe (PID: 2656)
      • ZagreuS Builder.exe (PID: 9184)
      • ZagreuS Builder.exe (PID: 8884)
      • Zagreus Builder.exe (PID: 5112)
      • ZagreuS Builder.exe (PID: 6388)
      • Zagreus Builder.exe (PID: 8500)
      • ZagreuS Builder.exe (PID: 4528)
      • Zagreus Builder.exe (PID: 4728)
      • ZagreuS Builder.exe (PID: 8824)
      • Zagreus Builder.exe (PID: 8948)
      • ZagreuS Builder.exe (PID: 6572)
      • Zagreus Builder.exe (PID: 5328)
      • ZagreuS Builder.exe (PID: 7648)
      • Zagreus Builder.exe (PID: 7896)
      • ZagreuS Builder.exe (PID: 8744)
      • Zagreus Builder.exe (PID: 300)
      • ZagreuS Builder.exe (PID: 8256)

    • Create files in a temporary directory

      • Zagreus Builder.exe (PID: 680)
      • ZagreuS Builder.exe (PID: 6044)
      • Cicada.exe (PID: 4776)
      • FileCoAuth.exe (PID: 5400)
      • Cicada.exe (PID: 9180)
      • Zagreus Builder.exe (PID: 7840)
      • Cicada.exe (PID: 904)
      • Zagreus Builder.exe (PID: 9156)
      • Zagreus Builder.exe (PID: 8420)
      • Zagreus Builder.exe (PID: 8560)
      • Zagreus Builder.exe (PID: 7400)
      • Zagreus Builder.exe (PID: 7840)
      • Zagreus Builder.exe (PID: 6644)
      • Zagreus Builder.exe (PID: 2104)
      • Cicada.exe (PID: 9016)
      • Zagreus Builder.exe (PID: 9028)
      • Zagreus Builder.exe (PID: 8364)
      • Zagreus Builder.exe (PID: 8320)
      • Zagreus Builder.exe (PID: 7580)
      • Zagreus Builder.exe (PID: 5720)
      • Zagreus Builder.exe (PID: 8604)
      • Zagreus Builder.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 2656)
      • Zagreus Builder.exe (PID: 5112)
      • Cicada.exe (PID: 8428)
      • Zagreus Builder.exe (PID: 8500)
      • Zagreus Builder.exe (PID: 4728)
      • Zagreus Builder.exe (PID: 8948)
      • Zagreus Builder.exe (PID: 5328)
      • Zagreus Builder.exe (PID: 300)

    • Reads the machine GUID from the registry

      • Zagreus Builder.exe (PID: 680)
      • Cicada.exe (PID: 4776)
      • FileCoAuth.exe (PID: 5400)
      • msiexec.exe (PID: 7740)
      • HTTPDebuggerSvc.exe (PID: 5512)
      • HTTPDebuggerSvc.exe (PID: 8076)
      • HTTPDebuggerUI.exe (PID: 8536)
      • Zagreus Builder.exe (PID: 7888)
      • Cicada.exe (PID: 9180)
      • Zagreus Builder.exe (PID: 5968)
      • Cicada.exe (PID: 7400)
      • Cicada.exe (PID: 7376)
      • Zagreus Builder.exe (PID: 7252)
      • Zagreus Builder.exe (PID: 7332)
      • Cicada.exe (PID: 7480)
      • Zagreus Builder.exe (PID: 7172)
      • Zagreus Builder.exe (PID: 3156)
      • Cicada.exe (PID: 3968)
      • Cicada.exe (PID: 4268)
      • Zagreus Builder.exe (PID: 2384)
      • Cicada.exe (PID: 8068)
      • Zagreus Builder.exe (PID: 8040)
      • Cicada.exe (PID: 8916)
      • Zagreus Builder.exe (PID: 8476)
      • Cicada.exe (PID: 7920)
      • Zagreus Builder.exe (PID: 7660)
      • Cicada.exe (PID: 8288)
      • Zagreus Builder.exe (PID: 4376)
      • Cicada.exe (PID: 2780)
      • Zagreus Builder.exe (PID: 5508)
      • Cicada.exe (PID: 7780)
      • Zagreus Builder.exe (PID: 5796)
      • Cicada.exe (PID: 9028)
      • Zagreus Builder.exe (PID: 9008)
      • Cicada.exe (PID: 7824)
      • Zagreus Builder.exe (PID: 7840)
      • Cicada.exe (PID: 904)
      • Zagreus Builder.exe (PID: 4724)
      • Cicada.exe (PID: 8896)
      • Zagreus Builder.exe (PID: 8948)
      • Cicada.exe (PID: 7644)
      • Zagreus Builder.exe (PID: 5328)
      • Cicada.exe (PID: 736)
      • Zagreus Builder.exe (PID: 7760)
      • Cicada.exe (PID: 5936)
      • Zagreus Builder.exe (PID: 9156)
      • Cicada.exe (PID: 7336)
      • Zagreus Builder.exe (PID: 8420)
      • Zagreus Builder.exe (PID: 8560)
      • Cicada.exe (PID: 5384)
      • Cicada.exe (PID: 8456)
      • Zagreus Builder.exe (PID: 7400)
      • Cicada.exe (PID: 8416)
      • Zagreus Builder.exe (PID: 7408)
      • Cicada.exe (PID: 8204)
      • Zagreus Builder.exe (PID: 7840)
      • Cicada.exe (PID: 8864)
      • Zagreus Builder.exe (PID: 2776)
      • Cicada.exe (PID: 7968)
      • Zagreus Builder.exe (PID: 6644)
      • Zagreus Builder.exe (PID: 2104)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 9208)
      • Zagreus Builder.exe (PID: 9028)
      • Cicada.exe (PID: 540)
      • Zagreus Builder.exe (PID: 8364)
      • Cicada.exe (PID: 8660)
      • Cicada.exe (PID: 6620)
      • Zagreus Builder.exe (PID: 6872)
      • Zagreus Builder.exe (PID: 8320)
      • Cicada.exe (PID: 8880)
      • Zagreus Builder.exe (PID: 4728)
      • Zagreus Builder.exe (PID: 7580)
      • Cicada.exe (PID: 5084)
      • Cicada.exe (PID: 1452)
      • Cicada.exe (PID: 7644)
      • Zagreus Builder.exe (PID: 8604)
      • Zagreus Builder.exe (PID: 5720)
      • Cicada.exe (PID: 3620)
      • Zagreus Builder.exe (PID: 9008)
      • Cicada.exe (PID: 300)
      • Zagreus Builder.exe (PID: 2656)
      • Cicada.exe (PID: 9120)
      • Zagreus Builder.exe (PID: 5112)
      • Cicada.exe (PID: 8428)
      • Zagreus Builder.exe (PID: 8500)
      • Cicada.exe (PID: 8288)
      • Zagreus Builder.exe (PID: 4728)
      • Cicada.exe (PID: 7144)
      • Zagreus Builder.exe (PID: 8948)
      • Cicada.exe (PID: 5720)
      • Zagreus Builder.exe (PID: 5328)
      • Cicada.exe (PID: 9144)
      • Zagreus Builder.exe (PID: 7896)
      • Cicada.exe (PID: 9008)
      • Zagreus Builder.exe (PID: 300)
      • Cicada.exe (PID: 840)
      • ZagreuS Builder.exe (PID: 8416)

    • Checks proxy server information

      • Cicada.exe (PID: 4776)
      • explorer.exe (PID: 5492)
      • HTTPDebuggerUI.exe (PID: 8536)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • slui.exe (PID: 7520)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Reads the software policy settings

      • Cicada.exe (PID: 4776)
      • msiexec.exe (PID: 7680)
      • explorer.exe (PID: 5492)
      • msiexec.exe (PID: 7740)
      • HTTPDebuggerUI.exe (PID: 8536)
      • slui.exe (PID: 7576)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • slui.exe (PID: 7520)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)
      • msiexec.exe (PID: 7680)

    • Creates files or folders in the user directory

      • Cicada.exe (PID: 4776)
      • FileCoAuth.exe (PID: 5400)
      • explorer.exe (PID: 5492)
      • HTTPDebuggerUI.exe (PID: 8536)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)

    • Disables trace logs

      • Cicada.exe (PID: 4776)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Manual execution by a user

      • firefox.exe (PID: 920)

    • Application launched itself

      • firefox.exe (PID: 920)
      • firefox.exe (PID: 5640)
      • firefox.exe (PID: 7600)
      • firefox.exe (PID: 7468)

    • Reads CPU info

      • Cicada.exe (PID: 4776)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 904)
      • Cicada.exe (PID: 9016)
      • Cicada.exe (PID: 8428)

    • Confuser has been detected (YARA)

      • Cicada.exe (PID: 4776)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 5492)

    • Autorun file from Downloads

      • firefox.exe (PID: 5640)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7680)
      • msiexec.exe (PID: 7740)
      • HTTPDebuggerSvc.exe (PID: 5512)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7680)
      • msiexec.exe (PID: 7740)

    • Manages system restore points

      • SrTasks.exe (PID: 4152)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7740)

    • Creates files in the program directory

      • HTTPDebuggerSvc.exe (PID: 5512)
      • Cicada.exe (PID: 9180)
      • Cicada.exe (PID: 8428)

    • Local mutex for internet shortcut management

      • explorer.exe (PID: 5492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:02 02:46:12+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1333248
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0x14774e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Zagreus Builder.exe
LegalCopyright:
OriginalFileName: Zagreus Builder.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
333
Monitored processes
189
Malicious processes
39
Suspicious processes
16

Behavior graph

Click at the process to see the details
start zagreus builder.exe #NESHTA zagreus builder.exe #DISCORDGRABBER cicada.exe zagreus builder.exe no specs svchost.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs sppextcomobj.exe no specs slui.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs filecoauth.exe no specs explorer.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs httpdebuggersvc.exe httpdebuggersvc.exe no specs httpdebuggerui.exe slui.exe certutil.exe httpdebuggerui.exe no specs #NESHTA zagreus builder.exe zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs #NESHTA zagreus builder.exe no specs firefox.exe no specs cicada.exe zagreus builder.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs #NESHTA zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs notepad.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs firefox.exe no specs zagreus builder.exe no specs cicada.exe no specs zagreus builder.exe no specs zagreus builder.exe no specs cicada.exe no specs firefox.exe no specs zagreus builder.exe no specs firefox.exe no specs firefox.exe no specs zagreus builder.exe cicada.exe no specs zagreus builder.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Users\admin\AppData\Local\Temp\Cicada.exe" C:\Users\admin\AppData\Local\Temp\Cicada.exe—Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RL
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cicada.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
300"C:\Users\admin\AppData\Local\Temp\3582-490\ZagreuS Builder.exe" C:\Users\admin\AppData\Local\Temp\3582-490\Zagreus Builder.exe—ZagreuS Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\zagreus builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
540"C:\Users\admin\AppData\Local\Temp\Cicada.exe" C:\Users\admin\AppData\Local\Temp\Cicada.exe—Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RL
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cicada.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
680"C:\Users\admin\Desktop\Zagreus Builder.exe" C:\Users\admin\Desktop\Zagreus Builder.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\zagreus builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
736"C:\Users\admin\AppData\Local\Temp\Cicada.exe" C:\Users\admin\AppData\Local\Temp\Cicada.exe—Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RL
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cicada.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
840"C:\Users\admin\AppData\Local\Temp\Cicada.exe" C:\Users\admin\AppData\Local\Temp\Cicada.exe—Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RL
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cicada.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
904"C:\Users\admin\AppData\Local\Temp\Cicada.exe" C:\Users\admin\AppData\Local\Temp\Cicada.exe
Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RL
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cicada.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
920"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\windows\system32\crypt32.dll
920"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 4896 -prefMapHandle 4860 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a2f08c7-47ef-47e3-9377-69d77030bca0} 5640 "\\.\pipe\gecko-crash-server-pipe.5640" 15747f74110 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
920"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2136 -parentBuildID 20240213221259 -prefsHandle 2128 -prefMapHandle 2060 -prefsLen 31073 -prefMapSize 244635 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9b4da0d-b4c4-4efd-a9a7-eee6c6654bb1} 7468 "\\.\pipe\gecko-crash-server-pipe.7468" 17759481d10 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
128 643
Read events
128 212
Write events
402
Delete events
29

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010012000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000000D0000000000000053006B007900700065002E006C006E006B003E0020007C000000110000000000000061006300740069006F006E0074006F0070002E0070006E0067003E00200020000000160000000000000065006600660065006300740069007600650074006F006400610079002E007200740066003E0020002000000015000000000000006600750063006B0069006E006700770069007400680069006E002E007200740066003E002000200000001D000000000000006D0061006E00750066006100630074007500720069006E00670070006C0061006E006E0069006E0067002E007200740066003E002000200000000E000000000000006D006100730065006E0064002E007200740066003E0020002000000012000000000000006D0064006E006500740077006F0072006B0073002E007200740066003E0020002000000015000000000000006F0076006500720061006C006C00760061006C006C00650079002E007200740066003E002000200000001E00000000000000700068006F0074006F0067007200610070006800790063006F006D006D0075006E00690074006900650073002E006A00700067003E002000200000001200000000000000770068006500720065007000720069006E0074002E0070006E0067003E0020002000000017000000000000005A0061006700720065007500730020004200750069006C006400650072002E006500780065003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001200000000000000000000000000000000000000803F0000004008000000803F0000404009000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000000000803F0100000000000000004002000000000000004040030000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F0700000000400000A0401100
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconNameVersion
Value:
1
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
11F6E16700000000
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000004028A
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch
Operation:writeName:308046B0AF4A39CB
Value:
15
(PID) Process:(4776) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4776) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4776) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4776) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4776) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
41
Suspicious files
411
Text files
215
Unknown types
0

Dropped files

PID
Process
Filename
Type
4776Cicada.exeC:\Users\admin\AppData\Local\Temp\places.raw —
MD5:—
SHA256:—
680Zagreus Builder.exeC:\Users\admin\AppData\Local\Temp\Cicada.exeexecutable
MD5:9400A5310BB2DE623439B244CBEF49B8
SHA256:3CDEF3A60769CE6B68A9200A4A4BCBBDADD374D8CECE69C14FF24B2B3869F192
680Zagreus Builder.exeC:\Users\admin\AppData\Local\Temp\ZagreuS Builder.exeexecutable
MD5:D7D116EC9489D35220BB884A3F8CDBE1
SHA256:6E55F637030B2F16A872169E7C6B1C70B76C761A5BB34170761FCB2079122577
6044ZagreuS Builder.exeC:\Users\admin\AppData\Local\Temp\3582-490\ZagreuS Builder.exeexecutable
MD5:E538C0DF99242DB4EEBEDB0EAF655CCA
SHA256:38551A319BF73A435F849C42A52818236BFB59C2F73F3658198C0C2F5773D383
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
4776Cicada.exeC:\Users\admin\AppData\Local\DESKTOP-JGLLJLD\InstalledSoftware.txttext
MD5:9FE3E9FBA5C9F39C7C244BD808A9777F
SHA256:6FD5F361A1FEAA428050DA60111432F85E03ED3D7571D5B86CEC3C77296C9D10
4776Cicada.exeC:\Users\admin\AppData\Local\DESKTOP-JGLLJLD\FileGrabber\Desktop\actiontop.pngbinary
MD5:4AD02C0F7581EB228295881EF5285CF8
SHA256:E11467CC59847FE127BFB408A9D46498A2BE830B48730D3CF810C4F3D371E796
4776Cicada.exeC:\Users\admin\AppData\Local\DESKTOP-JGLLJLD\FileGrabber\Desktop\fuckingwithin.rtftext
MD5:78A9BD5C6EDDF19C62093628A5E7329A
SHA256:0B4260E76C19D692D52F99BB4591530FC8244285D0A80CDDC16DE1E2CCDB4182
4776Cicada.exeC:\Users\admin\AppData\Local\Temp\tmpCCF6.tmp.datbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
4776Cicada.exeC:\Users\admin\AppData\Local\DESKTOP-JGLLJLD\FileGrabber\Desktop\masend.rtftext
MD5:E46D2B376CD7D650C4F0DDCBE7FB7FCA
SHA256:223D1130DD9E3D6B743DB0FBDEDA0626B01DFDF0FA3B2DFC199FB8B2EA2EB03E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
83
TCP/UDP connections
319
DNS requests
236
Threats
118

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5640
firefox.exe
POST
200
142.250.186.99:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
5640
firefox.exe
POST
200
142.250.186.99:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5640
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
5640
firefox.exe
POST
200
184.24.77.79:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
5640
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
5640
firefox.exe
POST
200
184.24.77.79:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5640
firefox.exe
POST
200
184.24.77.79:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5640
firefox.exe
POST
200
142.250.186.99:80
http://o.pki.goog/s/wr3/cgo
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4996
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4776
Cicada.exe
162.125.72.15:443
dl.dropboxusercontent.com
DROPBOX
US
whitelisted
4776
Cicada.exe
104.21.32.1:443
freegeoip.app
CLOUDFLARENET
—
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
dl.dropboxusercontent.com
  • 162.125.72.15
  • 162.125.66.15
whitelisted
freegeoip.app
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.48.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.112.1
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.22
  • 20.190.160.64
  • 20.190.160.20
  • 20.190.160.132
  • 40.126.32.68
  • 20.190.160.4
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
ipbase.com
  • 104.21.85.189
  • 172.67.209.71
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Checker Domain (freegeoip .app)
4776
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
4776
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
2196
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com)
4776
Cicada.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)
4776
Cicada.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] SNI External IP Domain Lookup (freegeoip .app)
4776
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
4776
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
4776
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
4776
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zagreus Builder.exe