File name:

RDPAccessorV4.exe

Full analysis: https://app.any.run/tasks/f0c39580-85b7-4a02-9b06-a18dbdaa0c8d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 20, 2024, 15:22:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
stealer
telegram
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

56A579CB88EB4BB93A45B163AB9825D8

SHA1:

5C47A2FBA8F9CA7AA9490C76E291A9B2E54C011E

SHA256:

C477B037E8FE3AB68B4C1DA6F9BFE01E9EA818A5B4F94ED9E2757E25035BE06D

SSDEEP:

98304:sQI0Qwo+UmrVkoMFhtRJ90BaZi/f11Osg1I9NL0wpGgSoE1F01IcHm28RbAHkQ8r:+Jf8qEsy03ml4TxiDC1SqOCjTsZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • RDPAccessorV4.exe (PID: 3424)
      • msiexec.exe (PID: 2696)
      • HTTPDebuggerSvc.exe (PID: 2252)

    • Steals credentials from Web Browsers

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Steals credentials

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Actions looks like stealing of personal data

      • Stepasha.exe (PID: 3252)
      • HTTPDebuggerSvc.exe (PID: 2252)
      • certutil.exe (PID: 3272)
      • Stepasha.exe (PID: 3512)

    • Creates a writable file in the system directory

      • HTTPDebuggerSvc.exe (PID: 2252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RDPAccessorV4.exe (PID: 3424)
      • HTTPDebuggerSvc.exe (PID: 2252)

    • Reads security settings of Internet Explorer

      • RDPAccessorV4.exe (PID: 3424)
      • msiexec.exe (PID: 3268)
      • HTTPDebuggerUI.exe (PID: 444)

    • Reads the Internet Settings

      • RDPAccessorV4.exe (PID: 3424)
      • Stepasha.exe (PID: 3252)
      • msiexec.exe (PID: 3268)
      • HTTPDebuggerUI.exe (PID: 444)
      • Stepasha.exe (PID: 3512)

    • Reads browser cookies

      • Stepasha.exe (PID: 3252)

    • Loads DLL from Mozilla Firefox

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Reads settings of System Certificates

      • Stepasha.exe (PID: 3252)
      • HTTPDebuggerUI.exe (PID: 444)
      • Stepasha.exe (PID: 3512)

    • Checks for external IP

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3220)
      • HTTPDebuggerSvc.exe (PID: 2252)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2696)
      • HTTPDebuggerUI.exe (PID: 444)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2696)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 2696)
      • HTTPDebuggerSvc.exe (PID: 2252)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 2696)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 1164)

    • Creates files in the driver directory

      • HTTPDebuggerSvc.exe (PID: 2252)

    • Creates or modifies Windows services

      • HTTPDebuggerSvc.exe (PID: 2252)

    • Reads Microsoft Outlook installation path

      • HTTPDebuggerUI.exe (PID: 444)

    • Reads Internet Explorer settings

      • HTTPDebuggerUI.exe (PID: 444)

    • Adds/modifies Windows certificates

      • HTTPDebuggerSvc.exe (PID: 2252)

  • INFO

    • Checks supported languages

      • RDPAccessorV4.exe (PID: 3424)
      • Stepasha.exe (PID: 3252)
      • MotherRussia.exe (PID: 3308)
      • wmpnscfg.exe (PID: 3144)
      • msiexec.exe (PID: 2696)
      • msiexec.exe (PID: 3268)
      • msiexec.exe (PID: 2008)
      • HTTPDebuggerSvc.exe (PID: 2252)
      • HTTPDebuggerSvc.exe (PID: 1228)
      • HTTPDebuggerUI.exe (PID: 444)
      • certutil.exe (PID: 3272)
      • Stepasha.exe (PID: 3512)

    • Reads the computer name

      • RDPAccessorV4.exe (PID: 3424)
      • Stepasha.exe (PID: 3252)
      • MotherRussia.exe (PID: 3308)
      • wmpnscfg.exe (PID: 3144)
      • msiexec.exe (PID: 2696)
      • msiexec.exe (PID: 3268)
      • msiexec.exe (PID: 2008)
      • HTTPDebuggerSvc.exe (PID: 2252)
      • HTTPDebuggerSvc.exe (PID: 1228)
      • HTTPDebuggerUI.exe (PID: 444)
      • certutil.exe (PID: 3272)
      • Stepasha.exe (PID: 3512)

    • Reads the machine GUID from the registry

      • RDPAccessorV4.exe (PID: 3424)
      • Stepasha.exe (PID: 3252)
      • MotherRussia.exe (PID: 3308)
      • msiexec.exe (PID: 2696)
      • msiexec.exe (PID: 3268)
      • HTTPDebuggerSvc.exe (PID: 2252)
      • msiexec.exe (PID: 2008)
      • HTTPDebuggerSvc.exe (PID: 1228)
      • HTTPDebuggerUI.exe (PID: 444)
      • Stepasha.exe (PID: 3512)

    • Create files in a temporary directory

      • RDPAccessorV4.exe (PID: 3424)
      • Stepasha.exe (PID: 3252)
      • msiexec.exe (PID: 2696)
      • Stepasha.exe (PID: 3512)

    • Reads Environment values

      • Stepasha.exe (PID: 3252)
      • HTTPDebuggerSvc.exe (PID: 2252)
      • HTTPDebuggerSvc.exe (PID: 1228)
      • Stepasha.exe (PID: 3512)

    • Disables trace logs

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Creates files or folders in the user directory

      • Stepasha.exe (PID: 3252)
      • HTTPDebuggerUI.exe (PID: 444)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3144)
      • explorer.exe (PID: 3160)
      • chrome.exe (PID: 2420)
      • Stepasha.exe (PID: 3512)

    • The process uses the downloaded file

      • chrome.exe (PID: 2420)
      • chrome.exe (PID: 2792)

    • Reads CPU info

      • Stepasha.exe (PID: 3252)
      • Stepasha.exe (PID: 3512)

    • Reads the software policy settings

      • Stepasha.exe (PID: 3252)
      • msiexec.exe (PID: 2696)
      • msiexec.exe (PID: 3744)
      • HTTPDebuggerUI.exe (PID: 444)
      • Stepasha.exe (PID: 3512)

    • Application launched itself

      • chrome.exe (PID: 2420)
      • msiexec.exe (PID: 2696)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3744)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3744)
      • msiexec.exe (PID: 2696)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 2420)
      • msiexec.exe (PID: 3744)

    • Reads product name

      • HTTPDebuggerSvc.exe (PID: 2252)
      • HTTPDebuggerSvc.exe (PID: 1228)

    • Creates files in the program directory

      • HTTPDebuggerSvc.exe (PID: 2252)

    • Checks proxy server information

      • HTTPDebuggerUI.exe (PID: 444)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:08 13:28:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 9217024
InitializedDataSize: 174592
UninitializedDataSize: -
EntryPoint: 0x8cc21e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: payload.exe
LegalCopyright:
OriginalFileName: payload.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
32
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rdpaccessorv4.exe stepasha.exe motherrussia.exe no specs wmpnscfg.exe no specs explorer.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs httpdebuggersvc.exe httpdebuggersvc.exe no specs httpdebuggerui.exe certutil.exe stepasha.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files\HTTPDebuggerPro\HTTPDebuggerUI.exe" C:\Program Files\HTTPDebuggerPro\HTTPDebuggerUI.exe
msiexec.exe
User:
admin
Company:
HttpDebugger.com
Integrity Level:
MEDIUM
Description:
HTTP Debugger
Version:
9.0.0.12
Modules
Images
c:\program files\httpdebuggerpro\httpdebuggerui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
764"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2116 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
972"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=2328 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1164"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3716 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1164"C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\HTTPDebuggerPro\HTTPDebuggerBrowser.dll"C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1168"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3828 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1228"C:\Program Files\HTTPDebuggerPro\HTTPDebuggerSvc.exe" /installC:\Program Files\HTTPDebuggerPro\HTTPDebuggerSvc.exe—msiexec.exe
User:
admin
Company:
HttpDebugger.com
Integrity Level:
MEDIUM
Description:
HTTP Debugger Windows Service
Exit code:
0
Version:
9.0.0.12
Modules
Images
c:\program files\httpdebuggerpro\httpdebuggersvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\version.dll
1324"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=2296 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2140 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1804"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=2316 --field-trial-handle=1132,i,470374200201923411,1738199392551986685,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
44 256
Read events
43 696
Write events
536
Delete events
24

Modification events

(PID) Process:(3424) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3424) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3424) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3424) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3252) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3252) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3252) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3252) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3252) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3252) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
32
Suspicious files
103
Text files
41
Unknown types
10

Dropped files

PID
Process
Filename
Type
3252Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpE03A.tmp.tmpdb —
MD5:—
SHA256:—
3424RDPAccessorV4.exeC:\Users\admin\AppData\Local\Temp\MotherRussia.exeexecutable
MD5:08C3CB87AA0BF981A3503C116A952B04
SHA256:AE25ED76F7AA901495537C2600BF149F6A56A42F28DC8FC9C6ED6C802CE0422E
3424RDPAccessorV4.exeC:\Users\admin\AppData\Local\Temp\Stepasha.exeexecutable
MD5:365BF209A1D5EB01EB38586C51F47817
SHA256:BB72A4C76034BD0B757B6A1E0C8265868563D11271A22D4AE26CB9FE3584A07D
2420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF4f4ad.TMP —
MD5:—
SHA256:—
2420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3252Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpE109.tmp.tmpdbsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
3252Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpE179.tmp.datsqlite
MD5:03EF1C0012EE77CDA2C2CB36DFBDA123
SHA256:800D734016D8FBCDE263D8CD2411167406C544FC090A5DCBD2D374CABF918B86
3252Stepasha.exeC:\Users\admin\AppData\Local\44_23\Passwords.txttext
MD5:A37DD22710F86F9D5C6809086C5A4AB6
SHA256:185E064F80DD71863EE5E1B224ECC21EC30B9CFBF0BC24891AFDB1CB8A05A29B
3252Stepasha.exeC:\Users\Public\qldyz51w.default\logins.jsonbinary
MD5:E7CE898AADD69F4E4280010B7808116E
SHA256:C9214BB54F10242AA254F0758372A440C8D8F49934021F8F08B6DF9FB377EB02
3252Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpE18A.tmp.datsqlite
MD5:0F653EDF207BB943166A7EED331F14AD
SHA256:E4D518E335DF25562B0570F4F3FC6F39BF63F7D84805AECD485C5798671EA3D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
46
DNS requests
55
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3252
Stepasha.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml/
unknown
—
—
unknown
1372
svchost.exe
GET
304
95.100.181.153:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
444
HTTPDebuggerUI.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.220.255.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
95.100.181.153:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0525de81435a98bf
unknown
—
—
unknown
444
HTTPDebuggerUI.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
—
—
unknown
1372
svchost.exe
GET
200
96.16.26.27:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3512
Stepasha.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml/
unknown
—
—
unknown
844
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pcexe23cbpdsyxil3k3azbydzu_20240429.634529504.14/obedbbhbpmojnkanicioggnmelmoomoc_20240429.634529504.14_all_ENUS500000_jtpqgijs6dadhfri2u4vxcrx3e.crx3
unknown
—
—
unknown
844
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pcexe23cbpdsyxil3k3azbydzu_20240429.634529504.14/obedbbhbpmojnkanicioggnmelmoomoc_20240429.634529504.14_all_ENUS500000_jtpqgijs6dadhfri2u4vxcrx3e.crx3
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3252
Stepasha.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3252
Stepasha.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown
3068
chrome.exe
142.250.185.163:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
2420
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
3068
chrome.exe
108.177.127.84:443
accounts.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
api.telegram.org
  • 149.154.167.220
shared
clientservices.googleapis.com
  • 142.250.185.163
whitelisted
accounts.google.com
  • 108.177.127.84
shared
www.google.com
  • 142.250.185.132
whitelisted
update.googleapis.com
  • 172.217.16.131
  • 216.58.206.67
whitelisted
www.httpdebugger.com
  • 188.114.97.3
  • 188.114.96.3
unknown
www.googletagmanager.com
  • 142.250.185.200
whitelisted
fonts.googleapis.com
  • 142.250.185.234
whitelisted
cdn.amplitude.com
  • 18.245.86.111
  • 18.245.86.4
  • 18.245.86.69
  • 18.245.86.101
whitelisted

Threats

PID
Process
Class
Message
3252
Stepasha.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1060
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
3252
Stepasha.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
3252
Stepasha.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
3512
Stepasha.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1060
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
3512
Stepasha.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
3512
Stepasha.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RDPAccessorV4.exe