File name:

vm3dservice.exe

Full analysis: https://app.any.run/tasks/d6dbaa7b-274c-46f4-8ac5-29a009f97ca4
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: July 17, 2024, 13:30:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
dcrat
rat
netreactor
remote
darkcrystal
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

9C2C2F7FD7977E87EA31D04D80A06ACC

SHA1:

DD49CADD94CD222DFFDA60CA7CB6F111936D1700

SHA256:

BAF0264D7001F4816A9DC03D5EF31F996961BE78F2E3A249722C583ADA725E5B

SSDEEP:

49152:OsNybzriERGyyVEaDPiIQb7oSeBFsKHZNtTo/LJrPGHhPHyvCx7HPsYZo31gUZ9N:I2EMy0Nat7oSUsW/CPGVSv07UY+31gUz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • vm3dservice.exe (PID: 3220)

    • DcRAT is detected

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)

    • DCRAT has been detected (YARA)

      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)

    • Connects to the CnC server

      • MusNotifyIcon.exe (PID: 6996)

    • Actions looks like stealing of personal data

      • MusNotifyIcon.exe (PID: 6996)

    • DARKCRYSTAL has been detected (SURICATA)

      • MusNotifyIcon.exe (PID: 6996)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • vm3dservice.exe (PID: 3220)

    • Executable content was dropped or overwritten

      • vm3dservice.exe (PID: 3220)

    • Reads security settings of Internet Explorer

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)

    • Reads the date of Windows installation

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)

    • Executing commands from a ".bat" file

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)

    • Starts CMD.EXE for commands execution

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6340)
      • cmd.exe (PID: 5220)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6340)
      • cmd.exe (PID: 5220)

  • INFO

    • Create files in a temporary directory

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)

    • Reads the machine GUID from the registry

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)

    • Reads the computer name

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)

    • Checks supported languages

      • vm3dservice.exe (PID: 3220)
      • chcp.com (PID: 6408)
      • MusNotifyIcon.exe (PID: 6240)
      • chcp.com (PID: 2340)
      • MusNotifyIcon.exe (PID: 6996)

    • Reads Environment values

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)

    • Creates files in the program directory

      • vm3dservice.exe (PID: 3220)

    • Failed to create an executable file in Windows directory

      • vm3dservice.exe (PID: 3220)

    • Process checks computer location settings

      • vm3dservice.exe (PID: 3220)
      • MusNotifyIcon.exe (PID: 6240)

    • Disables trace logs

      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)

    • Checks proxy server information

      • MusNotifyIcon.exe (PID: 6996)
      • MusNotifyIcon.exe (PID: 6240)

    • .NET Reactor protector has been detected

      • MusNotifyIcon.exe (PID: 6240)
      • MusNotifyIcon.exe (PID: 6996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(6240) MusNotifyIcon.exe
C2 (1)http://ozero.top/pythonPhp_cpubase
(PID) Process(6996) MusNotifyIcon.exe
C2 (1)http://ozero.top/pythonPhp_cpubase.php
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:10 14:48:19+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1645056
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x1938ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.7.1277
ProductVersionNumber: 1.2.7.1277
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: -
FileDescription: -
FileVersion: 1.2.7.1277
InternalName: SpotifyStartupTask
LegalCopyright: Copyright (c) 2023, Spotify Ltd
OriginalFileName: SpotifyStartupTask.exe
ProductName: -
ProductVersion: 1.2.7.1277
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DCRAT vm3dservice.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT musnotifyicon.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT musnotifyicon.exe

Process information

PID
CMD
Path
Indicators
Parent process
2340chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3220"C:\Users\admin\AppData\Local\Temp\vm3dservice.exe" C:\Users\admin\AppData\Local\Temp\vm3dservice.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\users\admin\appdata\local\temp\vm3dservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5220C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\xqZ3vPYigC.bat" "C:\Windows\System32\cmd.exe—MusNotifyIcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
5912\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6240"C:\Users\All Users\MusNotifyIcon.exe" C:\ProgramData\MusNotifyIcon.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\programdata\musnotifyicon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
DcRat
(PID) Process(6240) MusNotifyIcon.exe
C2 (1)http://ozero.top/pythonPhp_cpubase
6340C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\zbWYaKMLcL.bat" "C:\Windows\System32\cmd.exe—vm3dservice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
6352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6408chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
6432ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
6904ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
Total events
10 692
Read events
10 661
Write events
31
Delete events
0

Modification events

(PID) Process:(3220) vm3dservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\90a3f1fec9b4b9019dc66f985f33c7d9c6027065
Operation:writeName:8a3a1930e9ba7ba2004a4499f09ae08abf671a1a
Value:
H4sIAAAAAAAEAH2PSwvCMBCE/0rpWbx481YsiNCKoD25HmKy0UCSLXnZ/ntTERR83HY/ZnZmj+VqCdB5dB5gF89acYCaeDRoQ0btWLTRT1CSDcKlK/kwxwHL2buz0rp4jlm+paDkuOFkP5VMGGVzlOIhOsxgzxKK4rVL5VDS8Ddj13RrgIYuefbqe6UaJYs6TN/crCYmMou95D8rVX1fs8Cmu5xpgAOaHiCZhciypDg+nKc70AVqpDIBAAA=
(PID) Process:(3220) vm3dservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3220) vm3dservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3220) vm3dservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3220) vm3dservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6240) MusNotifyIcon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MusNotifyIcon_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6240) MusNotifyIcon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MusNotifyIcon_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6240) MusNotifyIcon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MusNotifyIcon_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6240) MusNotifyIcon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MusNotifyIcon_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6240) MusNotifyIcon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MusNotifyIcon_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
5
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3220vm3dservice.exeC:\Users\admin\Pictures\Saved Pictures\firefox.exeexecutable
MD5:9C2C2F7FD7977E87EA31D04D80A06ACC
SHA256:BAF0264D7001F4816A9DC03D5EF31F996961BE78F2E3A249722C583ADA725E5B
3220vm3dservice.exeC:\Users\admin\AppData\Local\Temp\8602abcb7646eatext
MD5:23235AF4CB0178D91E44CAF43D79EC6A
SHA256:18B2890BA406AF20FDC817001A94F2506E7A5E9FAB076DD6F4269795E8CCA264
3220vm3dservice.exeC:\Users\Default\Downloads\upfc.exeexecutable
MD5:9C2C2F7FD7977E87EA31D04D80A06ACC
SHA256:BAF0264D7001F4816A9DC03D5EF31F996961BE78F2E3A249722C583ADA725E5B
3220vm3dservice.exeC:\Users\admin\AppData\Local\Temp\HUg2Wewn6Wtext
MD5:992399F617877F9CFCFE16691F3B9132
SHA256:BB4659A1D59CA1A623EF75F3093C7DD9DA9519A5A7CE1845CC5195DB5DF90EF4
6240MusNotifyIcon.exeC:\Users\admin\AppData\Local\Temp\xqZ3vPYigC.battext
MD5:6D16F636AE295F288E31B67DD060DD8A
SHA256:71D748CA7E174787D02F2CE4661D83BB2A656F9B5FB929E0F7022E05083AFC2B
6240MusNotifyIcon.exeC:\Users\admin\AppData\Local\Temp\M3OQbPCp7ntext
MD5:8DB28512930AFCD3F162FF056132C384
SHA256:721698C718F35DEFD161A0E38ED335E6AE81D2C02F890BCCF80AD536B363A627
3220vm3dservice.exeC:\Users\Public\Music\5b884080fd4f94text
MD5:F0BBC79362C0525831A27AE3C9F3A3CF
SHA256:205CDC0DBC4700DF712F7C8D5D5D3277B2F42836EB8F390676A1142EE1D40510
3220vm3dservice.exeC:\ProgramData\bb88a2b99e529ftext
MD5:8228AA0B7D3661DEBAD3CBFEA4CABCBB
SHA256:E00484721AC90505B242657617DB8DC2F494FD0A10845A90342806BCC0A23A9F
3220vm3dservice.exeC:\Users\admin\Pictures\Saved Pictures\0fc223bdacedc3text
MD5:6B6D867B3DF7739E7D15A88EEFEA1C67
SHA256:689B40B512E42C2D7327FCECA20584FCBB00DC168246BA9CBA13581AB5AD236B
3220vm3dservice.exeC:\Users\Public\Music\fontdrvhost.exeexecutable
MD5:9C2C2F7FD7977E87EA31D04D80A06ACC
SHA256:BAF0264D7001F4816A9DC03D5EF31F996961BE78F2E3A249722C583ADA725E5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
69
DNS requests
17
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
900
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
900
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3748
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1236
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6996
MusNotifyIcon.exe
POST
—
77.105.135.87:80
http://ozero.top/pythonPhp_cpubase.php
unknown
—
—
unknown
6996
MusNotifyIcon.exe
POST
200
77.105.135.87:80
http://ozero.top/pythonPhp_cpubase.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1928
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
900
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
900
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4656
SearchApp.exe
104.126.37.146:443
www.bing.com
Akamai International B.V.
DE
unknown
3040
OfficeClickToRun.exe
52.111.229.19:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.110
whitelisted
www.bing.com
  • 104.126.37.146
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.123
  • 104.126.37.155
  • 104.126.37.160
  • 104.126.37.162
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.22
whitelisted
ozero.top
  • 77.105.135.87
unknown

Threats

PID
Process
Class
Message
2168
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
6240
MusNotifyIcon.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6240
MusNotifyIcon.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 8
6996
MusNotifyIcon.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6996
MusNotifyIcon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
6996
MusNotifyIcon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
6996
MusNotifyIcon.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6996
MusNotifyIcon.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible DarkCrystal Rat Encrypted Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vm3dservice.exe