File name:

MSIUpdaterV131.exe

Full analysis: https://app.any.run/tasks/8cafcbf7-22f2-4d9f-b98b-9f2d2db655de
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 01, 2024, 20:31:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
risepro
stealer
evasion
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

938CEA8B20B1B3D096003BB96881D505

SHA1:

F4ED707CC710662647CB3209FC2AD3AD0DFB7C62

SHA256:

6E8F4042439B1C6E23EF01E741965AC918A360CEAB67E16BA746A10EC199668D

SSDEEP:

98304:/IRSJSCWvElscbFa4aPkVFSANEBX80WBpWpsSADyt4ebYhh0q04p+3vSoGZ36IaY:/Wg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • MSIUpdaterV131.exe (PID: 2844)

    • RISEPRO has been detected (YARA)

      • MSIUpdaterV131.exe (PID: 2844)

    • Changes the autorun value in the registry

      • MSIUpdaterV131.exe (PID: 2844)

    • Drops the executable file immediately after the start

      • MSIUpdaterV131.exe (PID: 2844)

    • Uses Task Scheduler to autorun other applications

      • MSIUpdaterV131.exe (PID: 2844)

    • RISEPRO has been detected (SURICATA)

      • MSIUpdaterV131.exe (PID: 2844)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Connects to the CnC server

      • MSIUpdaterV131.exe (PID: 2844)

    • Create files in the Startup directory

      • MSIUpdaterV131.exe (PID: 2844)

    • Steals credentials

      • MSIUpdaterV131.exe (PID: 2844)

    • Actions looks like stealing of personal data

      • MSIUpdaterV131.exe (PID: 2844)

  • SUSPICIOUS

    • Reads the BIOS version

      • MSIUpdaterV131.exe (PID: 2844)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Executable content was dropped or overwritten

      • MSIUpdaterV131.exe (PID: 2844)

    • Connects to unusual port

      • MSIUpdaterV131.exe (PID: 2844)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Reads settings of System Certificates

      • MSIUpdaterV131.exe (PID: 2844)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)

    • Adds/modifies Windows certificates

      • MSIUpdaterV131.exe (PID: 2844)

    • Reads the Internet Settings

      • MSIUpdaterV131.exe (PID: 2844)

    • Checks for external IP

      • MSIUpdaterV131.exe (PID: 2844)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Process drops legitimate windows executable

      • MSIUpdaterV131.exe (PID: 2844)

    • Reads browser cookies

      • MSIUpdaterV131.exe (PID: 2844)

    • Accesses Microsoft Outlook profiles

      • MSIUpdaterV131.exe (PID: 2844)

    • Searches for installed software

      • MSIUpdaterV131.exe (PID: 2844)

    • Reads security settings of Internet Explorer

      • MSIUpdaterV131.exe (PID: 2844)

    • Starts a Microsoft application from unusual location

      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)

    • Connects to the server without a host name

      • MSIUpdaterV131.exe (PID: 2844)

    • Process requests binary or script from the Internet

      • MSIUpdaterV131.exe (PID: 2844)

  • INFO

    • Checks supported languages

      • MSIUpdaterV131.exe (PID: 2844)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)

    • Reads the computer name

      • MSIUpdaterV131.exe (PID: 2844)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Creates files in the program directory

      • MSIUpdaterV131.exe (PID: 2844)

    • Creates files or folders in the user directory

      • MSIUpdaterV131.exe (PID: 2844)

    • Reads the machine GUID from the registry

      • MSIUpdaterV131.exe (PID: 2844)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Create files in a temporary directory

      • MSIUpdaterV131.exe (PID: 2844)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)

    • Reads the software policy settings

      • MSIUpdaterV131.exe (PID: 2844)
      • QlXVU2Fwhv7Zy_mIGPro.exe (PID: 1484)
      • h1iE6COkp2t7KUXoWc9C.exe (PID: 680)

    • Manual execution by a user

      • explorer.exe (PID: 2908)

    • Reads Environment values

      • MSIUpdaterV131.exe (PID: 2844)

    • Reads product name

      • MSIUpdaterV131.exe (PID: 2844)

    • Checks proxy server information

      • MSIUpdaterV131.exe (PID: 2844)

    • Reads CPU info

      • MSIUpdaterV131.exe (PID: 2844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:01 11:29:07+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.34
CodeSize: 1089024
InitializedDataSize: 218624
UninitializedDataSize: -
EntryPoint: 0x5af000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 12.6.0.6783
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: HeidiSQL 12.6.0.6783 32 Bit
FileVersion: 12.6.0.6783
InternalName: heidisql.exe
LegalCopyright: Ansgar Becker, see gpl.txt
OriginalFileName: heidisql.exe
ProductName: HeidiSQL
ProductVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RISEPRO msiupdaterv131.exe schtasks.exe no specs schtasks.exe no specs explorer.exe no specs #RISEPRO h1ie6cokp2t7kuxowc9c.exe schtasks.exe no specs schtasks.exe no specs #RISEPRO qlxvu2fwhv7zy_migpro.exe Shell Security Editor no specs msiupdaterv131.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680"C:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\h1iE6COkp2t7KUXoWc9C.exe" C:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\h1iE6COkp2t7KUXoWc9C.exe
MSIUpdaterV131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
MSBuild.exe
Exit code:
0
Version:
2.0.50727.9149
Modules
Images
c:\users\admin\appdata\local\temp\joba6qpwbnas7rhfmq\h1ie6cokp2t7kuxowc9c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1484"C:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\QlXVU2Fwhv7Zy_mIGPro.exe" C:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\QlXVU2Fwhv7Zy_mIGPro.exe
MSIUpdaterV131.exe
User:
admin
Integrity Level:
HIGH
Description:
HeidiSQL 12.6.0.6783 32 Bit
Exit code:
0
Version:
12.6.0.6783
Modules
Images
c:\users\admin\appdata\local\temp\joba6qpwbnas7rhfmq\qlxvu2fwhv7zy_migpro.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
1624schtasks /create /f /RU "admin" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHESTC:\Windows\System32\schtasks.exe—MSIUpdaterV131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2040schtasks /create /f /RU "admin" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\System32\schtasks.exe—MSIUpdaterV131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2844"C:\Users\admin\AppData\Local\Temp\MSIUpdaterV131.exe" C:\Users\admin\AppData\Local\Temp\MSIUpdaterV131.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
HeidiSQL 12.6.0.6783 32 Bit
Exit code:
0
Version:
12.6.0.6783
Modules
Images
c:\users\admin\appdata\local\temp\msiupdaterv131.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
2856schtasks /create /f /RU "admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\System32\schtasks.exe—MSIUpdaterV131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2908"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3700"C:\Users\admin\AppData\Local\Temp\MSIUpdaterV131.exe" C:\Users\admin\AppData\Local\Temp\MSIUpdaterV131.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HeidiSQL 12.6.0.6783 32 Bit
Exit code:
3221226540
Version:
12.6.0.6783
Modules
Images
c:\users\admin\appdata\local\temp\msiupdaterv131.exe
c:\windows\system32\ntdll.dll
3956schtasks /create /f /RU "admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHESTC:\Windows\System32\schtasks.exe—MSIUpdaterV131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
14 668
Read events
14 588
Write events
69
Delete events
11

Modification events

(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RageMP131
Value:
C:\Users\admin\AppData\Local\RageMP131\RageMP131.exe
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB60F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D8200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:CABD2A79A1076A31F21D253635CB039D4329A5E8
Value:
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
0400000001000000100000000CD2F9E0DA1773E9ED864DA5E370E74E0F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F63030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E809000000010000000C000000300A06082B060105050703011D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E0B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C61900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
5C0000000100000004000000001000001900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA662000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C60B000000010000001A0000004900530052004700200052006F006F007400200058003100000014000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E1D000000010000001000000073B6876195F5D18E048510422AEF04E309000000010000000C000000300A06082B06010505070301030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E80F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F630400000001000000100000000CD2F9E0DA1773E9ED864DA5E370E74E20000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB61400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D7200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2844) MSIUpdaterV131.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
11
Suspicious files
37
Text files
10
Unknown types
5

Dropped files

PID
Process
Filename
Type
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\RageMP131\RageMP131.exeexecutable
MD5:938CEA8B20B1B3D096003BB96881D505
SHA256:6E8F4042439B1C6E23EF01E741965AC918A360CEAB67E16BA746A10EC199668D
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\D87fZN3R3jFeWeb Datasqlite
MD5:F47EB60CDF981C17722D0CE740129927
SHA256:0210071DF12CA42D70DCB679926668AE072264705AC139A24F94BBC5A129DD8F
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\Temp\rage131MP.tmptext
MD5:9CD1360630DE6F3E132D848B65F4F01D
SHA256:9CB1033533E1B7B2200B91752BE1AB43BE4A82DCF245BD41CA84A572E599B345
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\Temp\Tar81EE.tmpcat
MD5:DD73CEAD4B93366CF3465C8CD32E2796
SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22
2844MSIUpdaterV131.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:6145D600C062960C4461CE31D43206A8
SHA256:6C0498B241846C6C2E03BF16182984F8A474CD1D578CEEBC08CFFCCE0B8B4AF0
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\KvHrxJ77cmUgplaces.sqlite —
MD5:—
SHA256:—
2844MSIUpdaterV131.exeC:\ProgramData\MPGPH131\MPGPH131.exeexecutable
MD5:938CEA8B20B1B3D096003BB96881D505
SHA256:6E8F4042439B1C6E23EF01E741965AC918A360CEAB67E16BA746A10EC199668D
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\UPG2LoPXwc7Oplaces.sqlite —
MD5:—
SHA256:—
2844MSIUpdaterV131.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
2844MSIUpdaterV131.exeC:\Users\admin\AppData\Local\Temp\jobA6QPwbNas7RhfMq\Ei8DrAmaYu9Kkey4.dbsqlite
MD5:F62D8E993EA9C3B3A89DA19E4012638D
SHA256:0971230A77EE2C3531E8B97E14954692713D5F7C8684788F4A823BBC05AD377A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
19
DNS requests
4
Threats
43

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2844
MSIUpdaterV131.exe
GET
200
23.215.0.17:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?523fabe079d7213a
unknown
compressed
67.5 Kb
unknown
2844
MSIUpdaterV131.exe
HEAD
200
185.215.113.46:80
http://185.215.113.46/mine/plaza.exe
unknown
—
—
unknown
2844
MSIUpdaterV131.exe
GET
200
185.215.113.46:80
http://185.215.113.46/mine/plaza.exe
unknown
executable
2.92 Mb
unknown
2844
MSIUpdaterV131.exe
GET
200
185.215.113.46:80
http://185.215.113.46/cost/ladas.exe
unknown
executable
2.21 Mb
unknown
2844
MSIUpdaterV131.exe
HEAD
200
185.215.113.46:80
http://185.215.113.46/cost/ladas.exe
unknown
executable
2.92 Mb
unknown
2844
MSIUpdaterV131.exe
GET
—
193.233.132.62:57893
http://193.233.132.62:57893/hera/amadka.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2844
MSIUpdaterV131.exe
193.233.132.62:50500
—
ATT-INTERNET4
US
malicious
2844
MSIUpdaterV131.exe
34.117.186.192:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
unknown
2844
MSIUpdaterV131.exe
23.215.0.17:80
ctldl.windowsupdate.com
Akamai International B.V.
US
unknown
2844
MSIUpdaterV131.exe
104.26.5.15:443
db-ip.com
CLOUDFLARENET
US
unknown
2844
MSIUpdaterV131.exe
185.215.113.46:80
—
1337team Limited
SC
malicious
2844
MSIUpdaterV131.exe
193.233.132.62:80
—
ATT-INTERNET4
US
malicious
680
h1iE6COkp2t7KUXoWc9C.exe
193.233.132.62:50500
—
ATT-INTERNET4
US
malicious

DNS requests

Domain
IP
Reputation
ipinfo.io
  • 34.117.186.192
shared
ctldl.windowsupdate.com
  • 23.215.0.17
  • 23.215.0.6
whitelisted
db-ip.com
  • 104.26.5.15
  • 104.26.4.15
  • 172.67.75.166
whitelisted

Threats

PID
Process
Class
Message
2844
MSIUpdaterV131.exe
A Network Trojan was detected
ET MALWARE RisePro TCP Heartbeat Packet
2844
MSIUpdaterV131.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RisePro TCP (Token)
2844
MSIUpdaterV131.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (Token)
2844
MSIUpdaterV131.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2844
MSIUpdaterV131.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
2844
MSIUpdaterV131.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RisePro TCP (Activity)
2844
MSIUpdaterV131.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (activity)
2844
MSIUpdaterV131.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] RisePro TCP (get_settings)
2844
MSIUpdaterV131.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration)
2844
MSIUpdaterV131.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] RisePro TCP (exfiltration)
Process
Message
MSIUpdaterV131.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
MSIUpdaterV131.exe
DevBug OPS
MSIUpdaterV131.exe
Mysql request to pentagon
QlXVU2Fwhv7Zy_mIGPro.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
h1iE6COkp2t7KUXoWc9C.exe
gert4634
QlXVU2Fwhv7Zy_mIGPro.exe
DevBug OPS
h1iE6COkp2t7KUXoWc9C.exe
ret34634734g dfyh y rtdyrtyrty
QlXVU2Fwhv7Zy_mIGPro.exe
HeidiSQL 12.6.3873
MSIUpdaterV131.exe
HeidiSQL 12.6.3873
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MSIUpdaterV131.exe