File name:

zjrtdbt3.txt

Full analysis: https://app.any.run/tasks/d79372d4-4dbc-4dc7-b531-3f25fc1681da
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 20, 2024, 07:49:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ims-api
generic
stealer
loader
python
discord
exfiltration
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

707B311CCF5B3F5D49E422E447C4336B

SHA1:

157B280BF0E4D55118221DA9CBE9D5739204E050

SHA256:

D2605D6C7DF64C9CC45FB58CEFEB196489812E8E7E607556D4817AECB61681FD

SSDEEP:

24576:Fmpho4dv4YNuWKKfbj80usKPk7J8ZV4qQj76KMQnNyMxHiHcKVKJD0fSKz1WzKcX:Fmpho4dv4YNTKKDj80usKPk7JWV9Qj7V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • tkstt.exe (PID: 4392)
      • bsrtt.exe (PID: 5616)
      • zjrtdbt3.txt.exe (PID: 3652)

    • Actions looks like stealing of personal data

      • tkstt.exe (PID: 4392)
      • bsrtt.exe (PID: 5616)
      • zjrtdbt3.txt.exe (PID: 3652)

  • SUSPICIOUS

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • zjrtdbt3.txt.exe (PID: 3652)

    • Reads security settings of Internet Explorer

      • zjrtdbt3.txt.exe (PID: 3652)

    • Executable content was dropped or overwritten

      • zjrtdbt3.txt.exe (PID: 3652)
      • tkstt.exe (PID: 5496)

    • Process drops python dynamic module

      • tkstt.exe (PID: 5496)

    • The process drops C-runtime libraries

      • tkstt.exe (PID: 5496)

    • Process drops legitimate windows executable

      • tkstt.exe (PID: 5496)

    • Loads Python modules

      • tkstt.exe (PID: 4392)

    • Starts CMD.EXE for commands execution

      • zjrtdbt3.txt.exe (PID: 3652)

    • Get information on the list of running processes

      • zjrtdbt3.txt.exe (PID: 3652)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 5916)

    • Application launched itself

      • tkstt.exe (PID: 5496)

    • The process connected to a server suspected of theft

      • zjrtdbt3.txt.exe (PID: 3652)

  • INFO

    • Reads the computer name

      • zjrtdbt3.txt.exe (PID: 3652)
      • tkstt.exe (PID: 5496)
      • bsrtt.exe (PID: 5616)

    • Reads the software policy settings

      • zjrtdbt3.txt.exe (PID: 3652)

    • Creates files or folders in the user directory

      • zjrtdbt3.txt.exe (PID: 3652)

    • Checks supported languages

      • zjrtdbt3.txt.exe (PID: 3652)
      • tkstt.exe (PID: 5496)
      • tkstt.exe (PID: 4392)

    • Reads the machine GUID from the registry

      • zjrtdbt3.txt.exe (PID: 3652)

    • The process uses the downloaded file

      • zjrtdbt3.txt.exe (PID: 3652)

    • Process checks computer location settings

      • zjrtdbt3.txt.exe (PID: 3652)

    • Create files in a temporary directory

      • zjrtdbt3.txt.exe (PID: 3652)
      • tkstt.exe (PID: 5496)
      • tkstt.exe (PID: 4392)
      • bsrtt.exe (PID: 5616)

    • The sample compiled with english language support

      • tkstt.exe (PID: 5496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(3652) zjrtdbt3.txt.exe
Discord-Webhook-Tokens (1)1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Discord-Info-Links
1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Get Webhook Infohttps://discord.com/api/webhooks/1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Discord-Webhook-Tokens (2)1292195400656359544/C-X2wtpR466HQbx4XydySc3E1GFw9xUEb5Plenh1PA8yU2CiS0652QbntrLDiEqAWysv
1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Discord-Info-Links
1292195400656359544/C-X2wtpR466HQbx4XydySc3E1GFw9xUEb5Plenh1PA8yU2CiS0652QbntrLDiEqAWysv
Get Webhook Infohttps://discord.com/api/webhooks/1292195400656359544/C-X2wtpR466HQbx4XydySc3E1GFw9xUEb5Plenh1PA8yU2CiS0652QbntrLDiEqAWysv
1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Get Webhook Infohttps://discord.com/api/webhooks/1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2104:06:29 15:16:28+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 822784
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xcad9e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ConsoleApp1
FileVersion: 1.0.0.0
InternalName: ConsoleApp1.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: ConsoleApp1.exe
ProductName: ConsoleApp1
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zjrtdbt3.txt.exe tkstt.exe tkstt.exe bsrtt.exe conhost.exe no specs tasklist.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2548netsh wlan show profileC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—bsrtt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3652"C:\Users\admin\Desktop\zjrtdbt3.txt.exe" C:\Users\admin\Desktop\zjrtdbt3.txt.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ConsoleApp1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\zjrtdbt3.txt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(3652) zjrtdbt3.txt.exe
Discord-Webhook-Tokens (1)1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Discord-Info-Links
1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Get Webhook Infohttps://discord.com/api/webhooks/1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
(PID) Process(3652) zjrtdbt3.txt.exe
Discord-Webhook-Tokens (2)1292195400656359544/C-X2wtpR466HQbx4XydySc3E1GFw9xUEb5Plenh1PA8yU2CiS0652QbntrLDiEqAWysv
1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Discord-Info-Links
1292195400656359544/C-X2wtpR466HQbx4XydySc3E1GFw9xUEb5Plenh1PA8yU2CiS0652QbntrLDiEqAWysv
Get Webhook Infohttps://discord.com/api/webhooks/1292195400656359544/C-X2wtpR466HQbx4XydySc3E1GFw9xUEb5Plenh1PA8yU2CiS0652QbntrLDiEqAWysv
1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
Get Webhook Infohttps://discord.com/api/webhooks/1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
4320"tasklist"C:\Windows\SysWOW64\tasklist.exe—zjrtdbt3.txt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4392"C:\Users\admin\AppData\Local\Temp\tkstt.exe" C:\Users\admin\AppData\Local\Temp\tkstt.exe
tkstt.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tkstt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5496"C:\Users\admin\AppData\Local\Temp\tkstt.exe" C:\Users\admin\AppData\Local\Temp\tkstt.exe
zjrtdbt3.txt.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tkstt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5588\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5616"C:\Users\admin\AppData\Local\Temp\bsrtt.exe" -b all -f json --dir browsersC:\Users\admin\AppData\Local\Temp\bsrtt.exe
zjrtdbt3.txt.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bsrtt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
5916"cmd.exe" /C netsh wlan show profileC:\Windows\SysWOW64\cmd.exe—zjrtdbt3.txt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tasklist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 001
Read events
5 987
Write events
14
Delete events
0

Modification events

(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3652) zjrtdbt3.txt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\zjrtdbt3_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
86
Suspicious files
53
Text files
51
Unknown types
0

Dropped files

PID
Process
Filename
Type
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_pkcs1_decode.pydexecutable
MD5:1831D77E3247E859A1BD4311637D5D17
SHA256:B04AB30C7AD39D852854AA0CCD9508D213EAA1B1D070B27D3679C1CBB53FAFC6
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_ARC4.pydexecutable
MD5:F3A0DEF1BA9F7CF5DA771F5E7C29CA3F
SHA256:362C42BD62E5751E9B647BD575D483CC510DC862AB6098E6893EDCF3F44A567E
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_chacha20.pydexecutable
MD5:0BE007DD183DAF0F4B65E73CF19EA139
SHA256:F6308DACB781C99D3B962451FC681973808792936690AF6AA7FA5B6DF40F4EAF
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_raw_cast.pydexecutable
MD5:AC98B10064264B49DE13F66E60CD47B5
SHA256:8621AC7A3E09367BB0C529FDD3D178F20EDFA193FE0D19A02DE424A6BBA45229
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_raw_aes.pydexecutable
MD5:E306365BDC8D15B2F477E5AF252D0B59
SHA256:2DCAC73EA3240A008D115BAC0EA4D7C65C8162676AB30BCAF7527C22B98B4929
3652zjrtdbt3.txt.exeC:\Users\admin\AppData\Roaming\imgbbtk.txttext
MD5:C79EA984EAC105AEC988550BE3840538
SHA256:3C5B775B03A90C079124602048A2D57D7B5EB3666C7504F9EB496A7026BDB271
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_raw_aesni.pydexecutable
MD5:973F11DE023C9337F35F9BB55C6154A6
SHA256:483758336267F8842F5432BB83300EA0FCB49C4E0B29962CBD7F27B1C3DFC56A
3652zjrtdbt3.txt.exeC:\Users\admin\AppData\Local\Temp\tkstt.exeexecutable
MD5:5DC53CBB8E11B7B2B4EA4711DF467792
SHA256:403F67DB8D434C6C9D12716139FB281317CA78DD29B5385331B977CD07D9CF4D
3652zjrtdbt3.txt.exeC:\Users\admin\AppData\Local\Temp\[UA]DESKTOP-JGLLJLD_194.44.50.19\screenshot.pngimage
MD5:CEED38C4D3B8132B494A8433E8D27B68
SHA256:99A8683BC063248610794DA7AF6A6B5B87F25C1A4050CB10101502F868296397
5496tkstt.exeC:\Users\admin\AppData\Local\Temp\_MEI54962\Cryptodome\Cipher\_raw_arc2.pydexecutable
MD5:31F8353B80EA438AA705A7986DF24ED3
SHA256:89A51C145166DD24CF83D358ADE292B23F20B94BE783D5FE33A9DA2D7F2C14EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
28
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2164
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2164
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
188.114.96.3:443
https://imgbb.com/json
unknown
binary
1.45 Kb
whitelisted
—
—
GET
200
188.114.97.3:443
https://imgbb.com/
unknown
html
34.2 Kb
whitelisted
—
—
GET
200
188.114.97.3:443
https://ipecho.io/my
unknown
binary
184 b
—
—
—
GET
200
128.204.223.117:443
https://pastebinlol.serv00.net/pastes/wbhlog.txt
unknown
text
250 b
—
—
—
GET
200
198.251.81.242:443
https://pomf2.lain.la/f/tnv6isqr.txt
unknown
executable
9.56 Mb
—
—
—
POST
204
162.159.136.232:443
https://discordapp.com/api/webhooks/1291717044894564362/wNvM997377mt-AkBj75p-nWqWqLR5jiYKyWuYnwRZv6FVXN0j4t-cQhYqQEbPf_163WA
unknown
—
—
whitelisted
—
—
GET
200
198.251.81.32:443
https://pomf2.lain.la/f/weuzoew0.txt
unknown
executable
9.34 Mb
—
—
—
POST
200
198.251.82.91:443
https://pomf.lain.la/upload.php
unknown
binary
277 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2164
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.126.37.162:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3652
zjrtdbt3.txt.exe
188.114.96.3:443
ipecho.io
CLOUDFLARENET
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2164
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3652
zjrtdbt3.txt.exe
128.204.223.117:443
pastebinlol.serv00.net
Atman Sp. z o.o.
PL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.162
  • 104.126.37.170
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.171
  • 104.126.37.163
  • 104.126.37.152
  • 104.126.37.155
  • 104.126.37.153
whitelisted
google.com
  • 142.250.185.174
whitelisted
ipecho.io
  • 188.114.96.3
  • 188.114.97.3
unknown
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
pastebinlol.serv00.net
  • 128.204.223.117
unknown
www.microsoft.com
  • 184.30.21.171
whitelisted
imgbb.com
  • 188.114.96.3
  • 188.114.97.3
whitelisted
pomf2.lain.la
  • 198.251.81.32
  • 198.251.82.65
  • 198.251.82.91
  • 198.251.81.242
unknown
pomf.lain.la
  • 198.251.81.32
  • 198.251.81.242
  • 198.251.82.91
  • 198.251.82.65
unknown

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Free Hosting Service (.serv00 .net)
2192
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (pomf .lain .la)
3652
zjrtdbt3.txt.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (pomf .lain .la)
2192
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3652
zjrtdbt3.txt.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3652
zjrtdbt3.txt.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zjrtdbt3.txt