| File name: | cargo detail.exe |
| Full analysis: | https://app.any.run/tasks/3b5f48be-5685-4283-870f-7bdc991314b3 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | July 30, 2024, 10:57:59 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows |
| MD5: | F28864A14B1FFB7CC15BCF8C7D92A5AF |
| SHA1: | A172CE0E5F87F2119CBFDFC7DF70A0369BDE05D0 |
| SHA256: | 5EC7B5F926B67E6387884E41BD48A9423791D44EBF312BCA358D6B6D3F73D097 |
| SSDEEP: | 49152:98x0D0PZkdGvSyDFFpiKitakfWEsgXrFMxQZ+GTu6UJhTbbN:98x0DGvHFpUtakzs4rF8QZzTupJhfbN |
MALICIOUS
SNAKE has been detected (YARA)
- MSBuild.exe (PID: 4436)
Scans artifacts that could help determine the target
- MSBuild.exe (PID: 4436)
Actions looks like stealing of personal data
- MSBuild.exe (PID: 4436)
SNAKEKEYLOGGER has been detected (SURICATA)
- MSBuild.exe (PID: 4436)
Steals credentials from Web Browsers
- MSBuild.exe (PID: 4436)
SUSPICIOUS
Executes application which crashes
- cargo detail.exe (PID: 5616)
Checks for external IP
- svchost.exe (PID: 2284)
- MSBuild.exe (PID: 4436)
The process verifies whether the antivirus software is installed
- MSBuild.exe (PID: 4436)
INFO
Checks supported languages
- cargo detail.exe (PID: 5616)
- MSBuild.exe (PID: 4436)
Reads the computer name
- cargo detail.exe (PID: 5616)
- MSBuild.exe (PID: 4436)
Reads the machine GUID from the registry
- cargo detail.exe (PID: 5616)
- MSBuild.exe (PID: 4436)
Reads Environment values
- MSBuild.exe (PID: 4436)
Reads Microsoft Office registry keys
- MSBuild.exe (PID: 4436)
Checks proxy server information
- MSBuild.exe (PID: 4436)
- slui.exe (PID: 4476)
- WerFault.exe (PID: 6388)
Creates files or folders in the user directory
- WerFault.exe (PID: 6388)
Reads the software policy settings
- MSBuild.exe (PID: 4436)
- slui.exe (PID: 4476)
Disables trace logs
- MSBuild.exe (PID: 4436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
SnakeKeylogger
(PID) Process(4436) MSBuild.exe
Keys
DES6fc98cd6
Options
Telegram Bot Token6867349972:AAGrg2mnfJnNfRQ_XdcpcdezwbkgWsg0Two
Telegram Chat ID2135869667
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:07:26 22:23:35+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 48 |
| CodeSize: | 19338 |
| InitializedDataSize: | 2560 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x0000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 5.82.829.64 |
| ProductVersionNumber: | 5.82.829.64 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Uqirinitu |
| ProductName: | Utikowo |
| FileDescription: | Erebiyiq Enilawajaqasikag Odukatigeqeco Izipozaxukuzunivaf Isokiququxasipubetir Arolaxamuyulaf. |
| FileVersion: | 5.82.829.64 |
| ProductVersion: | 5.82.829.64 |
| OriginalFileName: | Uvacezamezexasotiwus |
| InternalName: | Otaqafebuqumoduzufaq |
| LegalCopyright: | © 2027 Uqirinitu |
Total processes
149
Monitored processes
6
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2284 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4388 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cargo detail.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4436 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | cargo detail.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
SnakeKeylogger(PID) Process(4436) MSBuild.exe Keys DES6fc98cd6 Options Telegram Bot Token6867349972:AAGrg2mnfJnNfRQ_XdcpcdezwbkgWsg0Two Telegram Chat ID2135869667 | |||||||||||||||
| 4476 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5616 | "C:\Users\admin\AppData\Local\Temp\cargo detail.exe" | C:\Users\admin\AppData\Local\Temp\cargo detail.exe | explorer.exe | ||||||||||||
User: admin Company: Uqirinitu Integrity Level: MEDIUM Description: Erebiyiq Enilawajaqasikag Odukatigeqeco Izipozaxukuzunivaf Isokiququxasipubetir Arolaxamuyulaf. Exit code: 3762504530 Version: 5.82.829.64 Modules
| |||||||||||||||
| 6388 | C:\WINDOWS\system32\WerFault.exe -u -p 5616 -s 1176 | C:\Windows\System32\WerFault.exe | cargo detail.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 042
Read events
7 023
Write events
19
Delete events
0
Modification events
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4436) MSBuild.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
Executable files
0
Suspicious files
1
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6388 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cargo detail.exe_6917b956102431e775de3a35e6a948c130760_2caa5f89_1f9e42aa-a2c4-4b6d-8bb8-763726490b48\Report.wer | — | |
MD5:— | SHA256:— | |||
| 6388 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\cargo detail.exe.5616.dmp | — | |
MD5:— | SHA256:— | |||
| 6388 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER5686.tmp.xml | xml | |
MD5:803FAAEDB58240234D4721E404889DCD | SHA256:CE37F02A0672980669CB8975359F30AB69B511BE27ABE7E86CA6FF47604033FE | |||
| 6388 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F6F.tmp.dmp | binary | |
MD5:AA3D3DF920DD225E57B2C943486CBF85 | SHA256:9F5D91E31E9DB7487A37D8AAF2120A12F5ECCD4CE2BF640EFC2DA4762140ACC6 | |||
| 6388 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER557B.tmp.WERInternalMetadata.xml | xml | |
MD5:30F9289AF630BA9A6C9D597093DA189F | SHA256:EB948CF40AF57AAE02F273C5A2B8F2796D1B1758324EB91A42B1630D5EF060F1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
55
DNS requests
30
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4424 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4132 | OfficeClickToRun.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
4436 | MSBuild.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
5368 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
3676 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
3524 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4436 | MSBuild.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
4436 | MSBuild.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
4436 | MSBuild.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
4436 | MSBuild.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3952 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3688 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1108 | slui.exe | 40.91.76.224:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4236 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6012 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 131.253.33.254:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
— | — | 92.123.104.7:443 | www.bing.com | Akamai International B.V. | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5692 | slui.exe | 40.91.76.224:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
checkip.dyndns.org |
| shared |
watson.events.data.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
licensing.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2284 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
2284 | svchost.exe | Misc activity | ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org) |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
4436 | MSBuild.exe | Misc activity | ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
4436 | MSBuild.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |