File name:

8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample

Full analysis: https://app.any.run/tasks/7a8f902f-256c-4fbd-8c1c-0326bcd0e36a
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 18:18:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
dcrat
rat
remote
darkcrystal
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

C8228B107DFAD48C1A7DE8147FA1F6E4

SHA1:

7F6D1D3C48D891CCCC4B0DD57504DB216AC681A8

SHA256:

8D0C8954ABEAA3C75C922544E9798171DE09868A3A1F9300E07465672ADA3DA4

SSDEEP:

98304:wejdruhJbuBaFJ5w8aKq6fXVivHUb7ooytsbjK9L6WB0vaC02KvEzhKdZ4/bVufk:EAy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RAT has been found (auto)

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2996)

    • DCRAT mutex has been found

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • Adds path to the Windows Defender exclusion list

      • agentFont.exe (PID: 6336)

    • DARKCRYSTAL has been detected (SURICATA)

      • csrss.exe (PID: 1412)

    • Connects to the CnC server

      • csrss.exe (PID: 1412)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Executable content was dropped or overwritten

      • f5Mb10zb.exe (PID: 5916)
      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • Process drops legitimate windows executable

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2996)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2996)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2996)
      • agentFont.exe (PID: 6336)

    • Reads the date of Windows installation

      • agentFont.exe (PID: 3812)

    • Reads security settings of Internet Explorer

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • The process creates files with name similar to system file names

      • agentFont.exe (PID: 6336)

    • Executed via WMI

      • schtasks.exe (PID: 6620)
      • schtasks.exe (PID: 6588)
      • schtasks.exe (PID: 6648)
      • schtasks.exe (PID: 6680)
      • schtasks.exe (PID: 6708)
      • schtasks.exe (PID: 6736)
      • schtasks.exe (PID: 6796)
      • schtasks.exe (PID: 6764)
      • schtasks.exe (PID: 6852)
      • schtasks.exe (PID: 6916)
      • schtasks.exe (PID: 6828)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7032)
      • schtasks.exe (PID: 7096)
      • schtasks.exe (PID: 7004)
      • schtasks.exe (PID: 6880)
      • schtasks.exe (PID: 7068)
      • schtasks.exe (PID: 6980)

    • Starts POWERSHELL.EXE for commands execution

      • agentFont.exe (PID: 6336)

    • Script adds exclusion path to Windows Defender

      • agentFont.exe (PID: 6336)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6468)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 6468)

  • INFO

    • Reads the computer name

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)
      • f5Mb10zb.exe (PID: 5916)
      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Checks supported languages

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)
      • agentFont.exe (PID: 3812)
      • f5Mb10zb.exe (PID: 5916)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • The sample compiled with english language support

      • 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe (PID: 6060)

    • Reads the machine GUID from the registry

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)
      • csrss.exe (PID: 1412)

    • Reads Environment values

      • agentFont.exe (PID: 3812)
      • agentFont.exe (PID: 6336)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • wscript.exe (PID: 2996)

    • The process uses the downloaded file

      • agentFont.exe (PID: 3812)

    • Process checks computer location settings

      • agentFont.exe (PID: 3812)

    • Creates files in the program directory

      • agentFont.exe (PID: 6336)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6468)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1856)
      • powershell.exe (PID: 7164)
      • powershell.exe (PID: 6172)
      • powershell.exe (PID: 7148)
      • powershell.exe (PID: 7128)
      • powershell.exe (PID: 7120)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1856)
      • powershell.exe (PID: 7128)
      • powershell.exe (PID: 6172)
      • powershell.exe (PID: 7164)
      • powershell.exe (PID: 7148)
      • powershell.exe (PID: 7120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:24 09:42:13+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 287744
InitializedDataSize: 171520
UninitializedDataSize: -
EntryPoint: 0x327e0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
45
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe f5mb10zb.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs #DCRAT agentfont.exe cmd.exe conhost.exe no specs #DCRAT agentfont.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT csrss.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
448\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1412"C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe" C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Version:
1.2.7.1277
Modules
Images
c:\program files (x86)\windows multimedia platform\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1856"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—agentFont.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2280C:\WINDOWS\system32\cmd.exe /c ""C:\mshypercomponentSavesdll\1fgSUpJ8Uk5BF.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2996"C:\WINDOWS\System32\WScript.exe" "C:\mshypercomponentSavesdll\kNSe5xQ3wI9ft6pWJZ9EeFYPDfgbdbVMsQk13JHxpBJ7xdPC40.vbe" C:\Windows\SysWOW64\wscript.exe—f5Mb10zb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3812"C:\mshypercomponentSavesdll/agentFont.exe"C:\mshypercomponentSavesdll\agentFont.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\mshypercomponentsavesdll\agentfont.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
37 525
Read events
37 506
Write events
19
Delete events
0

Modification events

(PID) Process:(5916) f5Mb10zb.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(6336) agentFont.exeKey:HKEY_CURRENT_USER\SOFTWARE\000e8114dab6badcc03fe652fd99762cd2a8cffa
Operation:writeName:fd3d709e264a2408002fc055ad4465fa3c0a85b0
Value:
H4sIAAAAAAAEAI2PTQvCMAyG/0rxpCBjXkS8iaCXCYMhHoyHssYt2DbSdFP/vcUvdvT0voE85MlxtF4CHMgbvglAGbgnIfbkG4AbpaSY4R1H09fimTtvsjzPAQyFlLOsbi8A1UMiugpjTKAMACft44qhZndljz5Wukcx1n6RwepeMCSFlbXqU8tivwUouEk9MS3L0CW5NkE7tSGLosb3xXzy+0TtOhvJoSGtSqvjmYMDqCXIf3K6SeOG/fve6QnLXvwUJgEAAA==
(PID) Process:(6336) agentFont.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(6336) agentFont.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1412) csrss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
17
Suspicious files
2
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
60608d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\f5Mb10zb.exeexecutable
MD5:FEB773E3FB046E0D1F39450C703492CA
SHA256:6F91BDCD3C2805D9D4A8577E58E6C5B4B09C05316FB2D30DA531DD2422A7CAE1
5916f5Mb10zb.exeC:\mshypercomponentSavesdll\kNSe5xQ3wI9ft6pWJZ9EeFYPDfgbdbVMsQk13JHxpBJ7xdPC40.vbebinary
MD5:06FA0952379DC4DB1439AF29A13D89BE
SHA256:CFE1D4E4F8C609281567BCBA5CC5117FA957D53721B817F979092DEC7FC44852
60608d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\mf04Loader.dllexecutable
MD5:943FC74C2E39FE803D828CCFA7E62409
SHA256:DA72E6677BD1BCD01C453C1998AAA19AEAF6659F4774CF6848409DA8232A95B2
5916f5Mb10zb.exeC:\mshypercomponentSavesdll\agentFont.exeexecutable
MD5:0D30B2D3FD8DB7AE5EDC0455DA8DC8E9
SHA256:23DFBD08FCA53DCB25B0F76B6D24ABF02EB2349BC43C975BACD3776B52241FAF
3812agentFont.exeC:\Users\admin\Desktop\FzVjqPOJ.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
3812agentFont.exeC:\Users\admin\Desktop\XcEHZHdb.logexecutable
MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
5916f5Mb10zb.exeC:\mshypercomponentSavesdll\1fgSUpJ8Uk5BF.battext
MD5:7318BE9B65C2BF66CB3E8FF640112F84
SHA256:946525ADEA7B1163EF9801B9CED0AF00096159E968C3CCCF3FE9F85003994B2B
6336agentFont.exeC:\Program Files (x86)\Windows Multimedia Platform\886983d96e3d3etext
MD5:15654E93F9801EDE51E4C8F643A21AF7
SHA256:9E69A76DD65C53E22016151AADAA44127BACE53589CE4697450900CCAE980599
6336agentFont.exeC:\Program Files (x86)\Windows Multimedia Platform\csrss.exeexecutable
MD5:0D30B2D3FD8DB7AE5EDC0455DA8DC8E9
SHA256:23DFBD08FCA53DCB25B0F76B6D24ABF02EB2349BC43C975BACD3776B52241FAF
6336agentFont.exeC:\Users\admin\Desktop\gUvWtVBF.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
34
DNS requests
15
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1412
csrss.exe
POST
200
37.44.238.250:80
http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php
unknown
—
—
malicious
—
—
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1412
csrss.exe
POST
200
37.44.238.250:80
http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php
unknown
—
—
malicious
1412
csrss.exe
POST
200
37.44.238.250:80
http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.193
  • 23.48.23.194
  • 23.48.23.159
  • 23.48.23.139
  • 23.48.23.167
  • 23.48.23.158
  • 23.48.23.143
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
487997cm.renyash.top
  • 37.44.238.250
malicious
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
1412
csrss.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1412
csrss.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
1412
csrss.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
1412
csrss.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample