File name:

file

Full analysis: https://app.any.run/tasks/dd19b033-aa96-463f-9b25-f876302e1af2
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: October 19, 2024, 17:57:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

B55B503A690229F094EC6C9017145104

SHA1:

1E0FFEFDCFF18410C5221C96ED17CC42D9D37F85

SHA256:

A7CD1AC259DAB063AC93ED0E9DC533BD90D1A2A26D8D0FBEC0823BB073747B01

SSDEEP:

98304:BPhE87AIoiOkCnFH+khhaY/IrsNqHKRZNN9NG9h79WG7s+f84qTJH35E46N3KqJk:Bv9nPu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 2432)

    • Actions looks like stealing of personal data

      • Rzu_channel_debug.exe (PID: 3740)

    • Steals credentials from Web Browsers

      • Rzu_channel_debug.exe (PID: 3740)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • file.exe (PID: 5220)
      • ManyCam.exe (PID: 5084)

    • Executable content was dropped or overwritten

      • file.exe (PID: 5220)
      • ManyCam.exe (PID: 5084)
      • cmd.exe (PID: 3648)

    • Reads the date of Windows installation

      • file.exe (PID: 5220)
      • Rzu_channel_debug.exe (PID: 3740)

    • Detected use of alternative data streams (AltDS)

      • pcaui.exe (PID: 1440)
      • pcaui.exe (PID: 3848)
      • pcaui.exe (PID: 948)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 5220)

    • Starts itself from another location

      • ManyCam.exe (PID: 5084)

    • Starts CMD.EXE for commands execution

      • ManyCam.exe (PID: 5652)
      • ManyCam.exe (PID: 6752)

    • The executable file from the user directory is run by the CMD process

      • Rzu_channel_debug.exe (PID: 3740)

  • INFO

    • Reads the computer name

      • file.exe (PID: 5220)
      • ManyCam.exe (PID: 5084)
      • ManyCam.exe (PID: 6752)
      • ManyCam.exe (PID: 5652)
      • Rzu_channel_debug.exe (PID: 3740)

    • Creates files or folders in the user directory

      • ManyCam.exe (PID: 5084)

    • Process checks computer location settings

      • file.exe (PID: 5220)

    • Checks supported languages

      • ManyCam.exe (PID: 5084)
      • ManyCam.exe (PID: 6752)
      • file.exe (PID: 5220)
      • ManyCam.exe (PID: 5652)
      • Rzu_channel_debug.exe (PID: 3740)

    • The process uses the downloaded file

      • file.exe (PID: 5220)
      • dllhost.exe (PID: 2432)

    • Reads CPU info

      • ManyCam.exe (PID: 5084)
      • ManyCam.exe (PID: 6752)
      • ManyCam.exe (PID: 5652)

    • Create files in a temporary directory

      • file.exe (PID: 5220)
      • ManyCam.exe (PID: 6752)
      • ManyCam.exe (PID: 5652)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2432)

    • Reads the machine GUID from the registry

      • Rzu_channel_debug.exe (PID: 3740)

    • Checks proxy server information

      • Rzu_channel_debug.exe (PID: 3740)

    • Reads the software policy settings

      • Rzu_channel_debug.exe (PID: 3740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:10:03 07:51:22+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 238080
InitializedDataSize: 294400
UninitializedDataSize: -
EntryPoint: 0x27180
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
13
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start file.exe manycam.exe pcaui.exe no specs manycam.exe no specs pcaui.exe no specs cmd.exe no specs conhost.exe no specs CMSTPLUA manycam.exe no specs pcaui.exe no specs cmd.exe conhost.exe no specs rzu_channel_debug.exe

Process information

PID
CMD
Path
Indicators
Parent process
948"C:\WINDOWS\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\admin\AppData\Roaming\EH_Monitor_test\ManyCam.exe"C:\Windows\System32\pcaui.exe—ManyCam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Program Compatibility Assistant User Interface
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcaui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1440"C:\WINDOWS\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\admin\AppData\Local\Temp\RarSFX0\ManyCam.exe"C:\Windows\System32\pcaui.exe—ManyCam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant User Interface
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcaui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1580C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—ManyCam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1784\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2432C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
3648C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe
ManyCam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3740C:\Users\admin\AppData\Local\Temp\Rzu_channel_debug.exeC:\Users\admin\AppData\Local\Temp\Rzu_channel_debug.exe
cmd.exe
User:
admin
Company:
Nenad Hrg (SoftwareOK.com)
Integrity Level:
HIGH
Description:
Q-Dir
Exit code:
0
Version:
11,4,4,0
Modules
Images
c:\users\admin\appdata\local\temp\ifro
c:\users\admin\appdata\local\temp\rzu_channel_debug.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3848"C:\WINDOWS\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\admin\AppData\Roaming\EH_Monitor_test\ManyCam.exe"C:\Windows\System32\pcaui.exe—ManyCam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant User Interface
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcaui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5084"C:\Users\admin\AppData\Local\Temp\RarSFX0\ManyCam.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\ManyCam.exe
file.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\manycam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
Total events
2 160
Read events
2 160
Write events
0
Delete events
0

Modification events

No data
Executable files
15
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6752ManyCam.exeC:\Users\admin\AppData\Local\Temp\7a5c8607 —
MD5:—
SHA256:—
5652ManyCam.exeC:\Users\admin\AppData\Local\Temp\7c8825bf —
MD5:—
SHA256:—
3648cmd.exeC:\Users\admin\AppData\Local\Temp\ifro —
MD5:—
SHA256:—
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\highgui099.dllexecutable
MD5:A354C42FCB37A50ECAD8DDE250F6119E
SHA256:89DB6973F4EC5859792BCD8A50CD10DB6B847613F2CEA5ADEF740EEC141673B2
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\ithbinary
MD5:535E6BAA0579A8B19BED5857D49BDD0D
SHA256:8DAFB1E5373A0CC2CE18D7DBC4A51A127D104B9E7E3B95670F0DB2A9D7952D8F
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\cximagecrt.dllexecutable
MD5:C36F6E088C6457A43ADB7EDCD17803F3
SHA256:8E1243454A29998CC7DC89CAECFADC0D29E00E5776A8B5777633238B8CD66F72
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\dbghelp.dllexecutable
MD5:C481103724F456CB422834F633B221D9
SHA256:652E514BE96A6AE38D61628B825B95A3F18189F97551B328D12BD4E0CB67F46F
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\cv099.dllexecutable
MD5:2A8B33FEE2F84490D52A3A7C75254971
SHA256:FAFF6A0745E1720413A028F77583FFF013C3F4682756DC717A0549F1BE3FEFC2
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\jlfxbinary
MD5:CB4C2B33CC5CC6025B4F3B373CFCBE97
SHA256:DAB9A7C4310FAC43CC21B924FE8899071E6884CD142F992C1FBAF5140C998268
5220file.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\ManyCam.exeexecutable
MD5:BA699791249C311883BAA8CE3432703B
SHA256:7C4EB51A737A81C163F95B50EC54518B82FCF91389D0560E855F3E26CEC07282
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
57
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.158:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5232
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6800
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4380
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4380
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6908
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.158:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
92.123.104.46:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.158
  • 23.48.23.159
  • 23.48.23.180
  • 23.48.23.173
  • 23.48.23.194
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.167
  • 23.48.23.164
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 88.221.169.152
whitelisted
www.bing.com
  • 92.123.104.46
  • 92.123.104.34
  • 92.123.104.43
  • 92.123.104.7
  • 92.123.104.47
  • 92.123.104.53
  • 92.123.104.67
  • 92.123.104.59
  • 92.123.104.9
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 216.58.212.174
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.14
whitelisted
th.bing.com
  • 92.123.104.47
  • 92.123.104.18
  • 92.123.104.11
  • 92.123.104.64
  • 92.123.104.59
  • 92.123.104.9
  • 92.123.104.7
  • 92.123.104.53
  • 92.123.104.65
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info