File name:

Marvel Rivals Executor.exe

Full analysis: https://app.any.run/tasks/05822a4e-514e-44fa-bbf6-352b7837e26d
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: January 19, 2025, 23:54:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
dcrat
remote
darkcrystal
stealer
exfiltration
netreactor
wmi-base64
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

B01F60EB9F3D1BB4E0E7674C95FBBC53

SHA1:

44DD0FDC5B2A1A9FBA9208EFF91296B6C1555F15

SHA256:

9787C91D7F8732CEBADC7047BC6775ABC062260E456E00BF95B6FD4D37D4A068

SSDEEP:

98304:0yi3eaYRaDqp4+aEc7xPFPHlt8YOesmZ9tWDp9XZy2QG82UpxLgHczYm:SRZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2160)

    • Connects to the CnC server

      • StartMenuExperienceHost.exe (PID: 5472)

    • DCRAT has been detected (YARA)

      • StartMenuExperienceHost.exe (PID: 5472)

    • Steals credentials from Web Browsers

      • StartMenuExperienceHost.exe (PID: 5472)

    • DARKCRYSTAL has been detected (SURICATA)

      • StartMenuExperienceHost.exe (PID: 5472)

    • Actions looks like stealing of personal data

      • StartMenuExperienceHost.exe (PID: 5472)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2160)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2160)
      • SessionCrtmonitor.exe (PID: 3524)

    • Executable content was dropped or overwritten

      • SessionCrtmonitor.exe (PID: 3524)
      • Marvel Rivals Executor.exe (PID: 3364)
      • StartMenuExperienceHost.exe (PID: 5472)

    • The process creates files with name similar to system file names

      • SessionCrtmonitor.exe (PID: 3524)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2160)
      • SessionCrtmonitor.exe (PID: 3524)

    • Reads the date of Windows installation

      • SessionCrtmonitor.exe (PID: 3524)

    • Reads security settings of Internet Explorer

      • SessionCrtmonitor.exe (PID: 3524)
      • Marvel Rivals Executor.exe (PID: 3364)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2220)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2220)

    • The executable file from the user directory is run by the CMD process

      • StartMenuExperienceHost.exe (PID: 5472)

    • Loads DLL from Mozilla Firefox

      • StartMenuExperienceHost.exe (PID: 5472)

    • Connects to the server without a host name

      • StartMenuExperienceHost.exe (PID: 5472)

  • INFO

    • Reads the computer name

      • Marvel Rivals Executor.exe (PID: 3364)
      • SessionCrtmonitor.exe (PID: 3524)
      • StartMenuExperienceHost.exe (PID: 5472)

    • Checks supported languages

      • Marvel Rivals Executor.exe (PID: 3364)
      • StartMenuExperienceHost.exe (PID: 5472)
      • SessionCrtmonitor.exe (PID: 3524)
      • chcp.com (PID: 4968)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • Marvel Rivals Executor.exe (PID: 3364)
      • wscript.exe (PID: 2160)
      • StartMenuExperienceHost.exe (PID: 5472)

    • The process uses the downloaded file

      • Marvel Rivals Executor.exe (PID: 3364)
      • wscript.exe (PID: 2160)
      • SessionCrtmonitor.exe (PID: 3524)

    • Process checks computer location settings

      • Marvel Rivals Executor.exe (PID: 3364)
      • SessionCrtmonitor.exe (PID: 3524)

    • Reads Environment values

      • SessionCrtmonitor.exe (PID: 3524)
      • StartMenuExperienceHost.exe (PID: 5472)

    • Failed to create an executable file in Windows directory

      • SessionCrtmonitor.exe (PID: 3524)

    • Reads the machine GUID from the registry

      • SessionCrtmonitor.exe (PID: 3524)
      • StartMenuExperienceHost.exe (PID: 5472)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2220)

    • Create files in a temporary directory

      • SessionCrtmonitor.exe (PID: 3524)
      • StartMenuExperienceHost.exe (PID: 5472)

    • Checks proxy server information

      • StartMenuExperienceHost.exe (PID: 5472)

    • Disables trace logs

      • StartMenuExperienceHost.exe (PID: 5472)

    • .NET Reactor protector has been detected

      • StartMenuExperienceHost.exe (PID: 5472)

    • Found Base64 encoded reference to AntiVirus WMI classes (YARA)

      • StartMenuExperienceHost.exe (PID: 5472)

    • Found Base64 encoded reference to WMI classes (YARA)

      • StartMenuExperienceHost.exe (PID: 5472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(5472) StartMenuExperienceHost.exe
C2 (1)http://176.123.1.211/dbDatalifeprivatecdn
Options
Version5.0.4
PluginsTVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 488960
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start marvel rivals executor.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs sessioncrtmonitor.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT startmenuexperiencehost.exe

Process information

PID
CMD
Path
Indicators
Parent process
716C:\WINDOWS\system32\cmd.exe /c ""C:\BlockAgentProviderInto\9gPeLytJW1s8p3jUCK.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2160"C:\WINDOWS\System32\WScript.exe" "C:\BlockAgentProviderInto\PjnstjcvPY7Lzl6nvMIVWIEKqqKpxghO5JeSx3djwQLOxG0mHAk0HXCLi6.vbe" C:\Windows\SysWOW64\wscript.exe—Marvel Rivals Executor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2220C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\sIJ5NC4AB5.bat" "C:\Windows\System32\cmd.exe—SessionCrtmonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2292w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
3364"C:\Users\admin\AppData\Local\Temp\Marvel Rivals Executor.exe" C:\Users\admin\AppData\Local\Temp\Marvel Rivals Executor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\marvel rivals executor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
3524"C:\BlockAgentProviderInto/SessionCrtmonitor.exe"C:\BlockAgentProviderInto\SessionCrtmonitor.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
16.10.31418.88
Modules
Images
c:\blockagentproviderinto\sessioncrtmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4968chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
5472"C:\Users\admin\.ms-ad\StartMenuExperienceHost.exe" C:\Users\admin\.ms-ad\StartMenuExperienceHost.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
16.10.31418.88
Modules
Images
c:\users\admin\.ms-ad\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
DcRat
(PID) Process(5472) StartMenuExperienceHost.exe
C2 (1)http://176.123.1.211/dbDatalifeprivatecdn
Options
Version5.0.4
PluginsTVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
Total events
4 063
Read events
4 046
Write events
17
Delete events
0

Modification events

(PID) Process:(3364) Marvel Rivals Executor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(3524) SessionCrtmonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\dc755e20c3956ce10dc5d57983d393828798e0c2
Operation:writeName:6ce49301ab1c54f5abffd003b557929649d95134
Value:
H4sIAAAAAAAEAI2OwQrCQAxEf0V61n6AN62CPVSF4sl4qN2gi7uJJKm0f+/ag9BbLwMZ5mXmmhVrgIuiKEDjoieAPOqqcQC1NWIVUrfv3ygeqcUDq+XYY7YcuW3g9rV5INlZ+OMdSknGABpVZ8RcCM/pw+mQHbddTFRyToRHNlz85M78SlY1/K+0dVDDOKOzdAFnxGpU9UyFWGTyxjIyty8J4IPCLwEAAA==
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5472) StartMenuExperienceHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StartMenuExperienceHost_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
12
Suspicious files
24
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
3524SessionCrtmonitor.exeC:\BlockAgentProviderInto\smss.exeexecutable
MD5:3008B3A2D8FA96CD7B26B6DEEE1E3CED
SHA256:B6608D50DDCC1DBEDA65F37E65D9AB565DA1511292D0EC26CF9C63C45D75C9C5
3364Marvel Rivals Executor.exeC:\BlockAgentProviderInto\9gPeLytJW1s8p3jUCK.battext
MD5:8C3BF6186F713EE49D532A73CCB90E3F
SHA256:77ED1C1EBAF014D5F0D8857215E7DF2531F6DBF8C9ABCB4AFCBE6307BE24CF39
3524SessionCrtmonitor.exeC:\Users\admin\.ms-ad\55b276f4edf653text
MD5:058C82C83790B9EB09AB1ED16BB78E13
SHA256:AC544A1B5855440C2D908B42E5C3EC1F9123A08DAA8423AB2EFFE77F9CA34433
3524SessionCrtmonitor.exeC:\BlockAgentProviderInto\dllhost.exeexecutable
MD5:3008B3A2D8FA96CD7B26B6DEEE1E3CED
SHA256:B6608D50DDCC1DBEDA65F37E65D9AB565DA1511292D0EC26CF9C63C45D75C9C5
3524SessionCrtmonitor.exeC:\Users\admin\Desktop\TJLHkYkm.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
3524SessionCrtmonitor.exeC:\Users\admin\Desktop\SEAhkpvm.logexecutable
MD5:2D6975FD1CC3774916D8FF75C449EE7B
SHA256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
3524SessionCrtmonitor.exeC:\BlockAgentProviderInto\Idle.exeexecutable
MD5:3008B3A2D8FA96CD7B26B6DEEE1E3CED
SHA256:B6608D50DDCC1DBEDA65F37E65D9AB565DA1511292D0EC26CF9C63C45D75C9C5
3524SessionCrtmonitor.exeC:\BlockAgentProviderInto\5940a34987c991text
MD5:C5A8AB29DF494815C3BA0208E1ED347A
SHA256:4BF3899CE05A4751BEA3AC07CAB7CDE00303D69746404B2015C393E1D26C1761
3524SessionCrtmonitor.exeC:\Users\admin\.ms-ad\StartMenuExperienceHost.exeexecutable
MD5:3008B3A2D8FA96CD7B26B6DEEE1E3CED
SHA256:B6608D50DDCC1DBEDA65F37E65D9AB565DA1511292D0EC26CF9C63C45D75C9C5
3364Marvel Rivals Executor.exeC:\BlockAgentProviderInto\PjnstjcvPY7Lzl6nvMIVWIEKqqKpxghO5JeSx3djwQLOxG0mHAk0HXCLi6.vbebinary
MD5:D87DEB22F708BEDB00EF3D8EC13E99C9
SHA256:C262F37A9599F8D97B352BDD622E9446B0AF66C141A894E5ABCF7A8275C1BB96
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
139
TCP/UDP connections
28
DNS requests
12
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5788
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5788
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5472
StartMenuExperienceHost.exe
POST
200
176.123.1.211:80
http://176.123.1.211/dbDatalifeprivatecdn.php
unknown
—
—
malicious
5472
StartMenuExperienceHost.exe
POST
200
176.123.1.211:80
http://176.123.1.211/dbDatalifeprivatecdn.php
unknown
—
—
malicious
5560
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5472
StartMenuExperienceHost.exe
POST
200
176.123.1.211:80
http://176.123.1.211/dbDatalifeprivatecdn.php
unknown
—
—
malicious
5472
StartMenuExperienceHost.exe
POST
200
176.123.1.211:80
http://176.123.1.211/dbDatalifeprivatecdn.php
unknown
—
—
malicious
5472
StartMenuExperienceHost.exe
POST
200
176.123.1.211:80
http://176.123.1.211/dbDatalifeprivatecdn.php
unknown
—
—
malicious
5472
StartMenuExperienceHost.exe
POST
200
176.123.1.211:80
http://176.123.1.211/dbDatalifeprivatecdn.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.227.215:443
—
Ooredoo Q.S.C.
QA
unknown
3884
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1176
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1076
svchost.exe
184.30.18.9:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5788
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5788
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 184.30.131.245
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.0
  • 20.190.159.75
  • 20.190.159.71
  • 40.126.31.69
  • 40.126.31.73
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
self.events.data.microsoft.com
  • 51.105.71.136
whitelisted

Threats

PID
Process
Class
Message
5472
StartMenuExperienceHost.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5472
StartMenuExperienceHost.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5472
StartMenuExperienceHost.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
5472
StartMenuExperienceHost.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
5472
StartMenuExperienceHost.exe
A suspicious string was detected
SUSPICIOUS [ANY.RUN] Sending an HTTP request body with a Base64 encoded ZIP file
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Marvel Rivals Executor.exe