File name:

file

Full analysis: https://app.any.run/tasks/ab5c258e-5a2f-4b3f-86bb-9a6f1606ac80
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: December 03, 2023, 01:26:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
evasion
opendir
gcleaner
loader
onlylogger
stealer
grmsk
socks5systemz
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

130C14DAA325CD18D05426FDF6014CB5

SHA1:

067874F1C4B1318A299F10F090311C6BDDA949C0

SHA256:

894D4384548BA2E383A7568B57E5FCFD18D36DAB8552142DD7F8C02457B9E4AA

SSDEEP:

49152:t9tQIY7Z4SqvRGVtr2ZjVPVzigMKZiuIJBBheZNzJ8Dm7VFM9uIJ7oLIxX0VSX6t:R7P9i1KZaheLllTE8cxK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • file.exe (PID: 2604)

    • Create files in the Startup directory

      • CasPol.exe (PID: 2796)

    • Drops the executable file immediately after the start

      • CasPol.exe (PID: 2796)
      • tBbzU4Y7Ah6W6NToKIBR9zL1.exe (PID: 116)
      • nzBHUUyM6tN9qVnSJ6ZECoPe.exe (PID: 2040)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • APUz0Rpat3gzo6wepIfTOL3V.exe (PID: 2596)
      • APUz0Rpat3gzo6wepIfTOL3V.exe (PID: 2212)
      • SupportCD.exe (PID: 684)
      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)

    • GCLEANER has been detected (SURICATA)

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)

    • ONLYLOGGER has been detected (YARA)

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)

    • GRMSK has been detected (SURICATA)

      • 6990215683.exe (PID: 2964)

    • Uses Task Scheduler to run other applications

      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)

    • Actions looks like stealing of personal data

      • 6990215683.exe (PID: 2964)

    • Steals credentials

      • 6990215683.exe (PID: 2964)

    • Starts CMD.EXE for self-deleting

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)

    • SOCKS5SYSTEMZ has been detected (YARA)

      • SupportCD.exe (PID: 996)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • file.exe (PID: 2604)

    • Script adds exclusion path to Windows Defender

      • file.exe (PID: 2604)

    • Reads the Internet Settings

      • file.exe (PID: 2604)
      • CasPol.exe (PID: 2796)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • 6990215683.exe (PID: 2964)

    • Reads settings of System Certificates

      • CasPol.exe (PID: 2796)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)

    • Connects to the server without a host name

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • CasPol.exe (PID: 2796)
      • 6990215683.exe (PID: 2964)

    • Starts CMD.EXE for commands execution

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)

    • Process requests binary or script from the Internet

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • CasPol.exe (PID: 2796)

    • Reads the Windows owner or organization settings

      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)

    • Process drops legitimate windows executable

      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)

    • Process drops SQLite DLL files

      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)

    • Drops 7-zip archiver for unpacking

      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1268)

  • INFO

    • Reads the computer name

      • file.exe (PID: 2604)
      • CasPol.exe (PID: 2796)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • tBbzU4Y7Ah6W6NToKIBR9zL1.exe (PID: 116)
      • Broom.exe (PID: 2272)
      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1296)
      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)
      • 6990215683.exe (PID: 2964)
      • SupportCD.exe (PID: 684)
      • W3RRvB6nidi0Kar6rNy5ibp7.exe (PID: 2324)

    • Reads the machine GUID from the registry

      • file.exe (PID: 2604)
      • CasPol.exe (PID: 2796)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • 6990215683.exe (PID: 2964)
      • W3RRvB6nidi0Kar6rNy5ibp7.exe (PID: 2324)

    • Checks supported languages

      • file.exe (PID: 2604)
      • CasPol.exe (PID: 2796)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • tBbzU4Y7Ah6W6NToKIBR9zL1.exe (PID: 116)
      • nzBHUUyM6tN9qVnSJ6ZECoPe.exe (PID: 2040)
      • Broom.exe (PID: 2272)
      • W3RRvB6nidi0Kar6rNy5ibp7.exe (PID: 2324)
      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1296)
      • APUz0Rpat3gzo6wepIfTOL3V.exe (PID: 2212)
      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)
      • 6990215683.exe (PID: 2964)
      • APUz0Rpat3gzo6wepIfTOL3V.exe (PID: 2596)
      • SupportCD.exe (PID: 684)
      • SupportCD.exe (PID: 996)

    • Reads Environment values

      • CasPol.exe (PID: 2796)

    • Checks proxy server information

      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • 6990215683.exe (PID: 2964)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 2796)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)

    • Create files in a temporary directory

      • tBbzU4Y7Ah6W6NToKIBR9zL1.exe (PID: 116)
      • nzBHUUyM6tN9qVnSJ6ZECoPe.exe (PID: 2040)
      • HYXJXEF8lPUPJ5YrzFkStSSt.exe (PID: 588)
      • APUz0Rpat3gzo6wepIfTOL3V.exe (PID: 2596)
      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)
      • APUz0Rpat3gzo6wepIfTOL3V.exe (PID: 2212)
      • SupportCD.exe (PID: 684)
      • 6990215683.exe (PID: 2964)

    • The executable file from the user directory is run by the CMD process

      • 6990215683.exe (PID: 2964)

    • Creates files in the program directory

      • APUz0Rpat3gzo6wepIfTOL3V.tmp (PID: 1680)
      • SupportCD.exe (PID: 684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

OnlyLogger

(PID) Process(588) HYXJXEF8lPUPJ5YrzFkStSSt.exe
C285.209.11.204
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:02 12:52:05+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 1530431
InitializedDataSize: 1534
UninitializedDataSize: -
EntryPoint: 0x177a39
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Material Design NET 4.0
CompanyName: -
FileDescription: MaterialSkin
FileVersion: 1.0.0.0
InternalName: MaterialSkin.exe
LegalCopyright: Copyright © 2014
LegalTrademarks: -
OriginalFileName: MaterialSkin.exe
ProductName: MaterialSkin
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
22
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe powershell.exe no specs caspol.exe #ONLYLOGGER hyxjxef8lpupj5yrzfkstsst.exe tbbzu4y7ah6w6ntokibr9zl1.exe no specs tbbzu4y7ah6w6ntokibr9zl1.exe broom.exe no specs nzbhuuym6tn9qvnsj6zecope.exe no specs w3rrvb6nidi0kar6rny5ibp7.exe no specs cmd.exe no specs #GRMSK 6990215683.exe apuz0rpat3gzo6wepiftol3v.exe no specs apuz0rpat3gzo6wepiftol3v.tmp no specs apuz0rpat3gzo6wepiftol3v.exe apuz0rpat3gzo6wepiftol3v.tmp no specs schtasks.exe no specs supportcd.exe no specs #SOCKS5SYSTEMZ supportcd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Pictures\tBbzU4Y7Ah6W6NToKIBR9zL1.exe" C:\Users\admin\Pictures\tBbzU4Y7Ah6W6NToKIBR9zL1.exe
CasPol.exe
User:
admin
Integrity Level:
HIGH
Description:
Cleaner installer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\pictures\tbbzu4y7ah6w6ntokibr9zl1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
588"C:\Users\admin\Pictures\HYXJXEF8lPUPJ5YrzFkStSSt.exe" C:\Users\admin\Pictures\HYXJXEF8lPUPJ5YrzFkStSSt.exe
CasPol.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\pictures\hyxjxef8lpupj5yrzfkstsst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
OnlyLogger
(PID) Process(588) HYXJXEF8lPUPJ5YrzFkStSSt.exe
C285.209.11.204
684"C:\Program Files (x86)\SupportCD\SupportCD.exe" -iC:\Program Files (x86)\SupportCD\SupportCD.exe—APUz0Rpat3gzo6wepIfTOL3V.tmp
User:
admin
Integrity Level:
HIGH
Description:
Technical support
Exit code:
0
Version:
1, 0, 4, 5
Modules
Images
c:\program files (x86)\supportcd\supportcd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
996"C:\Program Files (x86)\SupportCD\SupportCD.exe" -sC:\Program Files (x86)\SupportCD\SupportCD.exe
APUz0Rpat3gzo6wepIfTOL3V.tmp
User:
admin
Integrity Level:
HIGH
Description:
Technical support
Exit code:
0
Version:
1, 0, 4, 5
Modules
Images
c:\program files (x86)\supportcd\supportcd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1128C:\Windows\system32\net1 helpmsg 2C:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1268"C:\Windows\System32\cmd.exe" /c taskkill /im "HYXJXEF8lPUPJ5YrzFkStSSt.exe" /f & erase "C:\Users\admin\Pictures\HYXJXEF8lPUPJ5YrzFkStSSt.exe" & exitC:\Windows\SysWOW64\cmd.exe—HYXJXEF8lPUPJ5YrzFkStSSt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1296"C:\Users\admin\AppData\Local\Temp\is-9PGB5.tmp\APUz0Rpat3gzo6wepIfTOL3V.tmp" /SL5="$4901BE,7926731,54272,C:\Users\admin\Pictures\APUz0Rpat3gzo6wepIfTOL3V.exe" C:\Users\admin\AppData\Local\Temp\is-9PGB5.tmp\APUz0Rpat3gzo6wepIfTOL3V.tmp—APUz0Rpat3gzo6wepIfTOL3V.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-9pgb5.tmp\apuz0rpat3gzo6wepiftol3v.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1360taskkill /im "HYXJXEF8lPUPJ5YrzFkStSSt.exe" /f C:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1680"C:\Users\admin\AppData\Local\Temp\is-2BD1C.tmp\APUz0Rpat3gzo6wepIfTOL3V.tmp" /SL5="$7037E,7926731,54272,C:\Users\admin\Pictures\APUz0Rpat3gzo6wepIfTOL3V.exe" /SPAWNWND=$7036C /NOTIFYWND=$4901BE C:\Users\admin\AppData\Local\Temp\is-2BD1C.tmp\APUz0Rpat3gzo6wepIfTOL3V.tmp—APUz0Rpat3gzo6wepIfTOL3V.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-2bd1c.tmp\apuz0rpat3gzo6wepiftol3v.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1940"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp\file.exe" -ForceC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
6 897
Read events
6 794
Write events
55
Delete events
48

Modification events

(PID) Process:(2604) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2604) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2604) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2604) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2796) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2796) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2796) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2796) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1940) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2796) CasPol.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
126
Suspicious files
15
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
2796CasPol.exeC:\Users\admin\Pictures\DYrLn7a2iNTZiPhvFwFhr3Ey.exehtml
MD5:5B423612B36CDE7F2745455C5DD82577
SHA256:E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
2796CasPol.exeC:\Users\admin\AppData\Local\KIDzdwdkHTPryOCAe1AdoRkz.exehtml
MD5:5B423612B36CDE7F2745455C5DD82577
SHA256:E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
2796CasPol.exeC:\Users\admin\AppData\Local\OEJSYoQul0KopCyn0olrVNXF.exebinary
MD5:963DA09532E9758ADEDF9745C76EC700
SHA256:8720B9487CEE7DAE6DB3F8F73273BCBBC56377400B830CA0F089473EBC9603F2
1940powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:7075DAAE179AD066E5FFCB18BB0D46EE
SHA256:627746ABD855AB885DF0BBDE80FAA7E55C06840F612F0375CDCC0F2D2D34CC19
2796CasPol.exeC:\Users\admin\Pictures\FCVrS8fGsx6APycRlGYLDnbE.exehtml
MD5:E460D385D25E03BC5BBD9C56B7CAD1E2
SHA256:E183C92AE131494F190053BDBAF731F3F77C0F64A23B58A215C1B1DA305FFDC3
2796CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gENNCWOclRgJ5pn5UV26jvdX.battext
MD5:4FC4F45A7C82DD9495C4CA2ACD25A8BA
SHA256:785982909A93B0264BB2CD35108856ABC8DB36CD1038272FE23994B9D51BE8C0
2796CasPol.exeC:\Users\admin\Pictures\8cqDRXcBqEeRxdFpKAVwFPyt.exebinary
MD5:963DA09532E9758ADEDF9745C76EC700
SHA256:8720B9487CEE7DAE6DB3F8F73273BCBBC56377400B830CA0F089473EBC9603F2
1940powershell.exeC:\Users\admin\AppData\Local\Temp\vagjwfir.mqt.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1940powershell.exeC:\Users\admin\AppData\Local\Temp\swu4qkq0.jql.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2796CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yH0wp6pKT27jyHd37iyrF2GD.battext
MD5:3A09A4D3D01E5B9A123C370C4E86F254
SHA256:619D673123A1C1B511E7159DFDAA1303C01063CB293EE56F262523542CBB3209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
25
DNS requests
12
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2796
CasPol.exe
GET
200
91.92.241.91:80
http://91.92.241.91/files/5.exe
unknown
executable
241 Kb
unknown
2796
CasPol.exe
GET
200
91.92.241.91:80
http://91.92.241.91/files/InstallSetup24.exe
unknown
executable
2.33 Mb
unknown
2796
CasPol.exe
GET
200
188.114.97.3:80
http://gobo30cl.top/build.exe
unknown
html
4.30 Kb
unknown
2796
CasPol.exe
GET
200
188.114.97.3:80
http://stim.graspalace.com/order/tuc4.exe
unknown
executable
7.80 Mb
unknown
2796
CasPol.exe
GET
301
185.26.182.112:80
http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
unknown
html
162 b
unknown
588
HYXJXEF8lPUPJ5YrzFkStSSt.exe
GET
200
85.209.11.204:80
http://85.209.11.204/ip.php
unknown
text
14 b
unknown
588
HYXJXEF8lPUPJ5YrzFkStSSt.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/client/s51
unknown
text
38 b
unknown
588
HYXJXEF8lPUPJ5YrzFkStSSt.exe
GET
200
194.5.249.115:80
http://194.5.249.115/files/BIFPuKaW1X.exe
unknown
executable
414 Kb
unknown
588
HYXJXEF8lPUPJ5YrzFkStSSt.exe
GET
200
194.5.249.115:80
http://194.5.249.115/files/BIFPuKaW1X.exe
unknown
executable
414 Kb
unknown
2964
6990215683.exe
POST
200
144.76.82.108:80
http://144.76.82.108/Up
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2796
CasPol.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
2796
CasPol.exe
104.20.67.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2796
CasPol.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2796
CasPol.exe
91.92.241.91:80
—
Natskovi & Sie Ltd.
BG
unknown
2796
CasPol.exe
188.114.97.3:80
gobo30cl.top
CLOUDFLARENET
NL
unknown
2796
CasPol.exe
172.67.216.81:443
flyawayaero.net
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
dns.msftncsi.com
  • 131.107.255.255
shared
gobo30cl.top
  • 188.114.97.3
  • 188.114.96.3
malicious
stim.graspalace.com
  • 188.114.97.3
  • 188.114.96.3
malicious
flyawayaero.net
  • 172.67.216.81
  • 104.21.93.225
unknown
redirector.pm
  • 194.49.94.85
malicious
net.geo.opera.com
  • 185.26.182.112
  • 185.26.182.111
whitelisted
iplogger.com
  • 104.21.12.138
  • 172.67.194.188
shared
yip.su
  • 188.114.97.3
  • 188.114.96.3
whitelisted
potatogoose.com
  • 104.21.35.235
  • 172.67.180.173
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
324
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (iplogger .com in DNS lookup)
324
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2796
CasPol.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)
2796
CasPol.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2796
CasPol.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2796
CasPol.exe
A Network Trojan was detected
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2796
CasPol.exe
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
2796
CasPol.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2796
CasPol.exe
Potentially Bad Traffic
ET HUNTING Request to .TOP Domain with Minimal Headers
2 ETPRO signatures available at the full report
Process
Message
file.exe
Could not load file or assembly '924160 bytes loaded from Anonymously Hosted DynamicMethods Assembly, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. An attempt was made to load a program with an incorrect format.