File name:

8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample

Full analysis: https://app.any.run/tasks/7a8f902f-256c-4fbd-8c1c-0326bcd0e36a
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 18:18:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
dcrat
rat
remote
darkcrystal
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

C8228B107DFAD48C1A7DE8147FA1F6E4

SHA1:

7F6D1D3C48D891CCCC4B0DD57504DB216AC681A8

SHA256:

8D0C8954ABEAA3C75C922544E9798171DE09868A3A1F9300E07465672ADA3DA4

SSDEEP:

98304:wejdruhJbuBaFJ5w8aKq6fXVivHUb7ooytsbjK9L6WB0vaC02KvEzhKdZ4/bVufk:EAy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RAT has been found (auto)

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2996)

    • DCRAT mutex has been found

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • Adds path to the Windows Defender exclusion list

      • agentFont.exe (PID: 6336)

    • Connects to the CnC server

      • csrss.exe (PID: 1412)

    • DARKCRYSTAL has been detected (SURICATA)

      • csrss.exe (PID: 1412)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)
      • f5Mb10zb.exe (PID: 5916)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • Process drops legitimate windows executable

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • The process drops C-runtime libraries

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2996)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2996)
      • agentFont.exe (PID: 6336)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2996)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Reads the date of Windows installation

      • agentFont.exe (PID: 3812)

    • Reads security settings of Internet Explorer

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Executed via WMI

      • schtasks.exe (PID: 6588)
      • schtasks.exe (PID: 6680)
      • schtasks.exe (PID: 6828)
      • schtasks.exe (PID: 6764)
      • schtasks.exe (PID: 6852)
      • schtasks.exe (PID: 6880)
      • schtasks.exe (PID: 6736)
      • schtasks.exe (PID: 6648)
      • schtasks.exe (PID: 6796)
      • schtasks.exe (PID: 6708)
      • schtasks.exe (PID: 6620)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 6916)
      • schtasks.exe (PID: 6980)
      • schtasks.exe (PID: 7096)
      • schtasks.exe (PID: 7004)
      • schtasks.exe (PID: 7032)
      • schtasks.exe (PID: 7068)

    • The process creates files with name similar to system file names

      • agentFont.exe (PID: 6336)

    • Script adds exclusion path to Windows Defender

      • agentFont.exe (PID: 6336)

    • Starts POWERSHELL.EXE for commands execution

      • agentFont.exe (PID: 6336)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6468)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 6468)

  • INFO

    • Reads the computer name

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)
      • f5Mb10zb.exe (PID: 5916)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Checks supported languages

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)
      • f5Mb10zb.exe (PID: 5916)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • The sample compiled with english language support

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • wscript.exe (PID: 2996)

    • Reads the machine GUID from the registry

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • The process uses the downloaded file

      • agentFont.exe (PID: 3812)

    • Reads Environment values

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Process checks computer location settings

      • agentFont.exe (PID: 3812)

    • Creates files in the program directory

      • agentFont.exe (PID: 6336)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6468)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1856)
      • powershell.exe (PID: 6172)
      • powershell.exe (PID: 7128)
      • powershell.exe (PID: 7164)
      • powershell.exe (PID: 7120)
      • powershell.exe (PID: 7148)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7128)
      • powershell.exe (PID: 7164)
      • powershell.exe (PID: 6172)
      • powershell.exe (PID: 7120)
      • powershell.exe (PID: 7148)
      • powershell.exe (PID: 1856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.2
ImageVersion: -
OSVersion: 5.2
EntryPoint: 0x327e0
UninitializedDataSize: -
InitializedDataSize: 171520
CodeSize: 287744
LinkerVersion: 14.41
PEType: PE32+
ImageFileCharacteristics: Executable, Large address aware
TimeStamp: 2024:12:24 09:42:13+00:00
MachineType: AMD AMD64
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
45
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe f5mb10zb.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs #DCRAT agentfont.exe cmd.exe conhost.exe no specs #DCRAT agentfont.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT csrss.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
6060"C:\Users\admin\AppData\Local\Temp\8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe" C:\Users\admin\AppData\Local\Temp\8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5916"C:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\f5Mb10zb.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\f5Mb10zb.exe
8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\cneeds\cdata\o4e4cli\f5mb10zb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2996"C:\WINDOWS\System32\WScript.exe" "C:\mshypercomponentSavesdll\kNSe5xQ3wI9ft6pWJZ9EeFYPDfgbdbVMsQk13JHxpBJ7xdPC40.vbe" C:\Windows\SysWOW64\wscript.exe—f5Mb10zb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2280C:\WINDOWS\system32\cmd.exe /c ""C:\mshypercomponentSavesdll\1fgSUpJ8Uk5BF.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3812"C:\mshypercomponentSavesdll/agentFont.exe"C:\mshypercomponentSavesdll\agentFont.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\mshypercomponentsavesdll\agentfont.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6212"C:\Windows\System32\cmd.exe" /c "C:\mshypercomponentSavesdll\agentFont.exe"C:\Windows\System32\cmd.exe
agentFont.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6336C:\mshypercomponentSavesdll\agentFont.exeC:\mshypercomponentSavesdll\agentFont.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\mshypercomponentsavesdll\agentfont.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6588schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\wininit.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
37 525
Read events
37 506
Write events
19
Delete events
0

Modification events

(PID) Process:(5916) f5Mb10zb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(6336) agentFont.exeKey:HKEY_CURRENT_USER\SOFTWARE\000e8114dab6badcc03fe652fd99762cd2a8cffa
Operation:writeName:fd3d709e264a2408002fc055ad4465fa3c0a85b0
Value:
H4sIAAAAAAAEAI2PTQvCMAyG/0rxpCBjXkS8iaCXCYMhHoyHssYt2DbSdFP/vcUvdvT0voE85MlxtF4CHMgbvglAGbgnIfbkG4AbpaSY4R1H09fimTtvsjzPAQyFlLOsbi8A1UMiugpjTKAMACft44qhZndljz5Wukcx1n6RwepeMCSFlbXqU8tivwUouEk9MS3L0CW5NkE7tSGLosb3xXzy+0TtOhvJoSGtSqvjmYMDqCXIf3K6SeOG/fve6QnLXvwUJgEAAA==
(PID) Process:(6336) agentFont.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(6336) agentFont.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
17
Suspicious files
2
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
5916f5Mb10zb.exeC:\mshypercomponentSavesdll\kNSe5xQ3wI9ft6pWJZ9EeFYPDfgbdbVMsQk13JHxpBJ7xdPC40.vbebinary
MD5:06FA0952379DC4DB1439AF29A13D89BE
SHA256:CFE1D4E4F8C609281567BCBA5CC5117FA957D53721B817F979092DEC7FC44852
5916f5Mb10zb.exeC:\mshypercomponentSavesdll\1fgSUpJ8Uk5BF.battext
MD5:7318BE9B65C2BF66CB3E8FF640112F84
SHA256:946525ADEA7B1163EF9801B9CED0AF00096159E968C3CCCF3FE9F85003994B2B
60608d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\f5Mb10zb.exeexecutable
MD5:FEB773E3FB046E0D1F39450C703492CA
SHA256:6F91BDCD3C2805D9D4A8577E58E6C5B4B09C05316FB2D30DA531DD2422A7CAE1
6336agentFont.exeC:\found.000\dir0001.chk\9e60a5f7a3bd80text
MD5:E38D92C85450C1738964D59C9C6621CF
SHA256:A7511A035D01D19839A0826C5A9962EE5EE13932C7D746F57F95B0B46789BB85
6336agentFont.exeC:\Users\admin\Desktop\gUvWtVBF.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
3812agentFont.exeC:\Users\admin\Desktop\XcEHZHdb.logexecutable
MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
5916f5Mb10zb.exeC:\mshypercomponentSavesdll\agentFont.exeexecutable
MD5:0D30B2D3FD8DB7AE5EDC0455DA8DC8E9
SHA256:23DFBD08FCA53DCB25B0F76B6D24ABF02EB2349BC43C975BACD3776B52241FAF
3812agentFont.exeC:\Users\admin\Desktop\FzVjqPOJ.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
3812agentFont.exeC:\Users\admin\Desktop\fGMwIAsI.logexecutable
MD5:BBDE7073BAAC996447F749992D65FFBA
SHA256:1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
6336agentFont.exeC:\mshypercomponentSavesdll\27d1bcfc3c54e0text
MD5:197CE29E8EC98AA712883E8E62A48B1A
SHA256:45B3DD5904372D006DFD20A30EE9C3FDD5A9A5DA4FEB0652E0CE51FD1B7E8F83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
34
DNS requests
15
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1412
csrss.exe
POST
200
37.44.238.250:80
http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php
unknown
—
—
malicious
1412
csrss.exe
POST
200
37.44.238.250:80
http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php
unknown
—
—
malicious
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1412
csrss.exe
POST
200
37.44.238.250:80
http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php
unknown
—
—
malicious
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.193
  • 23.48.23.194
  • 23.48.23.159
  • 23.48.23.139
  • 23.48.23.167
  • 23.48.23.158
  • 23.48.23.143
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
487997cm.renyash.top
  • 37.44.238.250
malicious
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
—
—
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample