File name:

Ultima MultiHack.rar

Full analysis: https://app.any.run/tasks/6a7f975b-a4a8-4b08-8723-b8fec1852914
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Malware Trends Tracker     >>>
Analysis date: July 21, 2024, 18:34:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
rat
darkcomet
njrat
bladabindi
remote
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A09A8CABB50E56464134342B7F592BC9

SHA1:

B27265D1AD48A2FA0755EF858D448A0CE1D7A79F

SHA256:

D024F9D679126FDDB8ACB96726F0B1745FC5DFBD56319B9B8197D59A24FDA952

SSDEEP:

49152:ugYEFbCNYC1j+43tBBmQ9BabS3bCOouM2jPvgpW2+uc71bOM1Giw9QO/1WW1C9PF:dsx1j+ouQ9obyeOXg02hc7ltKr/1N1Cr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6800)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTICHEATS.EXE (PID: 7792)
      • ULTINJ.EXE (PID: 6032)
      • csrss.exe (PID: 7588)

    • Disables Windows Defender

      • reg.exe (PID: 7132)
      • reg.exe (PID: 6036)
      • reg.exe (PID: 5784)
      • reg.exe (PID: 7212)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6396)
      • cmd.exe (PID: 5228)

    • Changes the login/logoff helper path in the registry

      • ULTICHEATS.EXE (PID: 7792)

    • Changes the autorun value in the registry

      • ULTICHEATS.EXE (PID: 7792)
      • csrss.exe (PID: 6288)
      • csrss.exe (PID: 7588)

    • NjRAT is detected

      • ULTINJ.EXE (PID: 6032)
      • csrss.exe (PID: 7588)

    • Create files in the Startup directory

      • csrss.exe (PID: 7588)

    • NJRAT has been detected (YARA)

      • csrss.exe (PID: 7588)

    • Connects to the CnC server

      • csrss.exe (PID: 7588)

    • NJRAT has been detected (SURICATA)

      • csrss.exe (PID: 7588)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ULTIMA FIXER.exe (PID: 7300)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTICHEATS.EXE (PID: 7792)
      • ULTINJ.EXE (PID: 6032)
      • ULTIMA FIXER.exe (PID: 7476)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6396)
      • cmd.exe (PID: 5228)

    • Executing commands from a ".bat" file

      • ULTIMA FIXER.exe (PID: 7300)
      • ULTIMA FIXER.exe (PID: 7476)

    • Starts CMD.EXE for commands execution

      • ULTIMA FIXER.exe (PID: 7300)
      • ULTICHEATS.EXE (PID: 7792)
      • ULTIMA FIXER.exe (PID: 7476)

    • Reads security settings of Internet Explorer

      • ULTIMA FIXER.exe (PID: 7300)
      • SecHealthUI.exe (PID: 6872)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTICHEATS.EXE (PID: 7792)
      • ULTINJ.EXE (PID: 6032)
      • ULTIMA FIXER.exe (PID: 7476)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6396)
      • cmd.exe (PID: 5228)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6396)
      • cmd.exe (PID: 5228)

    • Request a resource from the Internet using PowerShell's cmdlet

      • cmd.exe (PID: 6396)
      • cmd.exe (PID: 5228)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6396)
      • cmd.exe (PID: 5228)

    • Downloads file from URI

      • powershell.exe (PID: 7936)
      • powershell.exe (PID: 8028)

    • Starts itself from another location

      • ULTICHEATS.EXE (PID: 7792)
      • ULTINJ.EXE (PID: 6032)

    • The process creates files with name similar to system file names

      • ULTICHEATS.EXE (PID: 7792)
      • ULTINJ.EXE (PID: 6032)

    • Executable content was dropped or overwritten

      • ULTICHEATS.EXE (PID: 7792)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTINJ.EXE (PID: 6032)
      • csrss.exe (PID: 7588)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 6104)
      • cmd.exe (PID: 4508)

    • Start notepad (likely ransomware note)

      • csrss.exe (PID: 6288)

    • Reads Internet Explorer settings

      • ULTIMAMULTI2024.EXE (PID: 6280)

    • Connects to unusual port

      • csrss.exe (PID: 6288)
      • csrss.exe (PID: 7588)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • csrss.exe (PID: 7588)

    • Contacting a server suspected of hosting an CnC

      • csrss.exe (PID: 7588)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6800)

    • Manual execution by a user

      • ULTIMA FIXER.exe (PID: 2328)
      • ULTIMA FIXER.exe (PID: 7300)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTIMA FIXER.exe (PID: 7476)

    • Checks supported languages

      • ULTIMA FIXER.exe (PID: 7300)
      • SecHealthUI.exe (PID: 6872)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTIMAMULTI2024.EXE (PID: 6280)
      • ULTINJ.EXE (PID: 6032)
      • ULTICHEATS.EXE (PID: 7792)
      • csrss.exe (PID: 7588)
      • csrss.exe (PID: 6288)
      • ULTIMA FIXER.exe (PID: 7476)

    • Reads the computer name

      • ULTIMA FIXER.exe (PID: 7300)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • SecHealthUI.exe (PID: 6872)
      • ULTICHEATS.EXE (PID: 7792)
      • ULTIMAMULTI2024.EXE (PID: 6280)
      • csrss.exe (PID: 6288)
      • ULTINJ.EXE (PID: 6032)
      • ULTIMA FIXER.exe (PID: 7476)
      • csrss.exe (PID: 7588)

    • Process checks computer location settings

      • ULTIMA FIXER.exe (PID: 7300)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTICHEATS.EXE (PID: 7792)
      • ULTINJ.EXE (PID: 6032)
      • ULTIMA FIXER.exe (PID: 7476)

    • Create files in a temporary directory

      • ULTIMA FIXER.exe (PID: 7300)
      • Ultima Multihack V2.4.exe (PID: 6112)
      • ULTIMA FIXER.exe (PID: 7476)

    • UPX packer has been detected

      • ULTIMA FIXER.exe (PID: 7300)

    • Disables trace logs

      • powershell.exe (PID: 7936)
      • powershell.exe (PID: 8028)

    • Checks proxy server information

      • powershell.exe (PID: 7936)
      • powershell.exe (PID: 8028)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7936)
      • powershell.exe (PID: 8028)

    • Reads the machine GUID from the registry

      • ULTIMAMULTI2024.EXE (PID: 6280)
      • csrss.exe (PID: 7588)

    • Creates files or folders in the user directory

      • ULTINJ.EXE (PID: 6032)
      • csrss.exe (PID: 7588)

    • Reads Environment values

      • csrss.exe (PID: 7588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(7588) csrss.exe
C2jvjv2044duck33.duckdns.org
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\0ce256616b847d6ba32935097dcc5537
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
51
Malicious processes
8
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs slui.exe no specs ultima fixer.exe no specs THREAT ultima fixer.exe cmd.exe no specs conhost.exe no specs cacls.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs powershell.exe sechealthui.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs ultima multihack v2.4.exe ulticheats.exe ultimamulti2024.exe no specs #NJRAT ultinj.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs csrss.exe notepad.exe no specs #NJRAT csrss.exe netsh.exe no specs conhost.exe no specs ultima fixer.exe cmd.exe no specs conhost.exe no specs cacls.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
764reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2072C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2328"C:\Users\admin\Desktop\Ultima MultiHack\ULTIMA FIXER.exe" C:\Users\admin\Desktop\Ultima MultiHack\ULTIMA FIXER.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\ultima multihack\ultima fixer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2360reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2408netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\csrss.exe" "csrss.exe" ENABLEC:\Windows\SysWOW64\netsh.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2632C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3400C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -EmbeddingC:\Windows\System32\SecurityHealthHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Host
Exit code:
0
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securityhealthhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
4024notepadC:\Windows\SysWOW64\notepad.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
4164C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -EmbeddingC:\Windows\System32\SecurityHealthHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Host
Exit code:
0
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securityhealthhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
Total events
33 278
Read events
32 967
Write events
311
Delete events
0

Modification events

(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Ultima MultiHack.rar
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C00000000000000010000000083FFFF0083FFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6800) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
10
Suspicious files
1
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6800.21682\Ultima MultiHack\oldfonts\ultiInject.exeexecutable
MD5:0A1C8BDEC0475A012049AE3EB0E7A0EF
SHA256:B58E20B5E2888CC7B0716BB858BE28FF328D35E487F5C64DADC73CF6C3DD5DF8
6800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6800.21682\Ultima MultiHack\ZulaLauncher.dllexecutable
MD5:CADD865A049BFD30D61BCD2533194E88
SHA256:3A0A0B13FD474E805CCB5DD07A39A2F82326EBC36D911114C2346153D5E727C9
6800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6800.21682\Ultima MultiHack\Beni oku.txttext
MD5:57FEE35BC4DDB35BD3F7478B98524DCA
SHA256:AC52417BB488D8A2E01C5F5EF8E1023DFEABFA059A1DA718778AB617FFEE5E2C
6800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6800.21682\Ultima MultiHack\Ultima Multihack V2.4.exeexecutable
MD5:77AF29D119090535B678909637B50A7B
SHA256:6F0B668F7F2BB2D08AEB7ED32AF70496064EBBF527F4A8EDDB94E1B47F4833C7
6112Ultima Multihack V2.4.exeC:\Users\admin\AppData\Local\Temp\ULTICHEATS.EXEexecutable
MD5:402148A510C49D1EC830A76AABA2B1D7
SHA256:291B95BA9F52E4516A86C1C9F1CCD4560A1BF9EC86BAFE8C41ED54E5F2DE563F
6112Ultima Multihack V2.4.exeC:\Users\admin\AppData\Local\Temp\ULTIMAMULTI2024.EXEexecutable
MD5:0A1C8BDEC0475A012049AE3EB0E7A0EF
SHA256:B58E20B5E2888CC7B0716BB858BE28FF328D35E487F5C64DADC73CF6C3DD5DF8
6112Ultima Multihack V2.4.exeC:\Users\admin\AppData\Local\Temp\ULTINJ.EXEexecutable
MD5:FDBDBBDD177068BE5407B463333646BC
SHA256:9D276C5382BD697BF7AE23831ADE6AA6DB48874472865DB34DCFF66BC1108004
7792ULTICHEATS.EXEC:\Users\admin\Documents\MSDCSC\csrss.exeexecutable
MD5:402148A510C49D1EC830A76AABA2B1D7
SHA256:291B95BA9F52E4516A86C1C9F1CCD4560A1BF9EC86BAFE8C41ED54E5F2DE563F
8028powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z03jbizk.d1x.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6032ULTINJ.EXEC:\Users\admin\AppData\Roaming\csrss.exeexecutable
MD5:FDBDBBDD177068BE5407B463333646BC
SHA256:9D276C5382BD697BF7AE23831ADE6AA6DB48874472865DB34DCFF66BC1108004
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
51
DNS requests
26
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5628
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4716
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3656
backgroundTaskHost.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2760
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.32.72
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.185
  • 2.23.209.177
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.189
  • 2.23.209.130
  • 184.86.251.14
  • 184.86.251.19
  • 184.86.251.17
  • 184.86.251.24
  • 184.86.251.29
  • 184.86.251.28
  • 184.86.251.27
  • 184.86.251.25
  • 184.86.251.18
whitelisted
google.com
  • 142.250.185.238
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
download1323.mediafire.com
  • 205.196.123.11
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
www.mediafire.com
  • 104.16.113.74
  • 104.16.114.74
shared
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted

Threats

PID
Process
Class
Message
2168
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
2168
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
2168
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2168
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2168
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2168
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2168
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2168
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
7588
csrss.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2168
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ultima MultiHack.rar