File name:

file.exe

Full analysis: https://app.any.run/tasks/ff6d3aa9-3aaf-4e2f-bf2d-41cbd63a41dc
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: September 10, 2024, 06:55:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
dcrat
rat
remote
darkcrystal
netreactor
wmi-base64
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

02695C7F7CBCC35F221FB0E577CEDD66

SHA1:

805AC3333CBB5FDC4D8107FCC4B77F63EF70C319

SHA256:

DE1422F5D42EC545B47C30B518BCAC1A40765611EB48453AA31EDAB447347BF3

SSDEEP:

49152:FTasGjiQ4Ghb0AbvftH/6iobJorg+JXddmBvIcYBEOL98f8H6kuPXe0JYSQ8tO3w:C0wvZTg+Ddm69BEOKf8TMn/QAO3VMwU5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DcRAT is detected

      • file.exe (PID: 7052)
      • winlogon.exe (PID: 6508)

    • Changes the autorun value in the registry

      • file.exe (PID: 7052)

    • DARKCRYSTAL has been detected (SURICATA)

      • winlogon.exe (PID: 6508)

    • Actions looks like stealing of personal data

      • winlogon.exe (PID: 6508)

    • Steals credentials from Web Browsers

      • winlogon.exe (PID: 6508)

    • Connects to the CnC server

      • winlogon.exe (PID: 6508)

    • DCRAT has been detected (YARA)

      • winlogon.exe (PID: 6508)

  • SUSPICIOUS

    • Executed via WMI

      • schtasks.exe (PID: 5524)
      • schtasks.exe (PID: 5712)
      • schtasks.exe (PID: 5160)
      • schtasks.exe (PID: 1048)
      • schtasks.exe (PID: 4876)
      • schtasks.exe (PID: 3384)
      • schtasks.exe (PID: 2268)
      • schtasks.exe (PID: 1640)
      • schtasks.exe (PID: 2224)
      • schtasks.exe (PID: 2128)
      • schtasks.exe (PID: 6284)
      • schtasks.exe (PID: 1748)
      • schtasks.exe (PID: 2400)
      • schtasks.exe (PID: 1940)
      • schtasks.exe (PID: 964)
      • schtasks.exe (PID: 6780)
      • schtasks.exe (PID: 1164)
      • schtasks.exe (PID: 6728)

    • Process drops legitimate windows executable

      • file.exe (PID: 7052)

    • The process creates files with name similar to system file names

      • file.exe (PID: 7052)

    • Executable content was dropped or overwritten

      • file.exe (PID: 7052)
      • winlogon.exe (PID: 6508)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 1640)
      • schtasks.exe (PID: 2224)
      • schtasks.exe (PID: 2128)

    • Executing commands from a ".bat" file

      • file.exe (PID: 7052)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1280)

    • Starts CMD.EXE for commands execution

      • file.exe (PID: 7052)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1280)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 7052)

    • Reads the date of Windows installation

      • file.exe (PID: 7052)

    • Loads DLL from Mozilla Firefox

      • winlogon.exe (PID: 6508)

  • INFO

    • Checks supported languages

      • file.exe (PID: 7052)
      • csc.exe (PID: 5556)
      • cvtres.exe (PID: 6660)
      • chcp.com (PID: 6012)
      • winlogon.exe (PID: 6508)

    • Creates files in the program directory

      • file.exe (PID: 7052)

    • Reads the computer name

      • file.exe (PID: 7052)
      • winlogon.exe (PID: 6508)

    • Reads the machine GUID from the registry

      • file.exe (PID: 7052)
      • csc.exe (PID: 5556)
      • winlogon.exe (PID: 6508)

    • Create files in a temporary directory

      • file.exe (PID: 7052)
      • cvtres.exe (PID: 6660)
      • winlogon.exe (PID: 6508)

    • Creates files or folders in the user directory

      • csc.exe (PID: 5556)

    • Reads Environment values

      • file.exe (PID: 7052)
      • winlogon.exe (PID: 6508)

    • Process checks computer location settings

      • file.exe (PID: 7052)

    • Disables trace logs

      • winlogon.exe (PID: 6508)

    • Checks proxy server information

      • winlogon.exe (PID: 6508)

    • The process uses the downloaded file

      • file.exe (PID: 7052)

    • Changes the display of characters in the console

      • cmd.exe (PID: 1280)

    • .NET Reactor protector has been detected

      • winlogon.exe (PID: 6508)

    • Found Base64 encoded reference to WMI classes (YARA)

      • winlogon.exe (PID: 6508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(6508) winlogon.exe
C2 (1)http://strepsils.top/VideoVm_requestMultiTestLocal.php
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7false
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
C2 (1)http://strepsils.top/VideoVm_requestMultiTestLocal.php
Options
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7false
8true
9true
10true
11true
12true
13true
14true
Version5.0.1
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:25 09:23:03+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1885696
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x1ce5de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.7.1277
ProductVersionNumber: 1.2.7.1277
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: -
FileDescription: -
FileVersion: 1.2.7.1277
InternalName: SpotifyStartupTask
LegalCopyright: Copyright (c) 2023, Spotify Ltd
OriginalFileName: SpotifyStartupTask.exe
ProductName: -
ProductVersion: 1.2.7.1277
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
30
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DCRAT file.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe no specs conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT winlogon.exe svchost.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
964schtasks.exe /create /tn "filef" /sc MINUTE /mo 9 /tr "'C:\Users\admin\AppData\Local\Temp\file.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1048schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Pictures\csrss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164schtasks.exe /create /tn "file" /sc ONLOGON /tr "'C:\Users\admin\AppData\Local\Temp\file.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\LdlOrv9CBY.bat" "C:\Windows\System32\cmd.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1640schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\dllhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1748schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\taskhostw.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1940schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\taskhostw.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2224schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
3 528
Read events
3 507
Write events
21
Delete events
0

Modification events

(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\35548566bbc1507aa99a194883e550ac7d59944a
Operation:writeName:8e76160d6a2d2a2f7b1477c9a0c33ad3ebfaf3da
Value:
H4sIAAAAAAAEAHXOwQrCQAwE0F8pPYsf4E0seFEoqCfHQ9xGXUx3yyZr/XxbETxUb2F4M+RYrhbAQTkpUPGFshiwowc3xZpaHtLeB4nXGOb85HL209feWU4jdppUp7LOZ/EOaERuUW0KliLF5/xrvu8ZJSu2HDJgpPeR91NPTevDMN11FRkBm+hIgD23HXDxwu/K6QVquzVaAwEAAA==
(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winlogon
Value:
"C:\Users\Default\Saved Games\winlogon.exe"
(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:csrss
Value:
"C:\Users\Default\Pictures\csrss.exe"
(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dllhost
Value:
"C:\Users\Public\dllhost.exe"
(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dllhost
Value:
"C:\Users\All Users\dllhost.exe"
(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:taskhostw
Value:
"C:\Users\Default\Start Menu\taskhostw.exe"
(PID) Process:(7052) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:file
Value:
"C:\Users\admin\AppData\Local\Temp\file.exe"
(PID) Process:(6508) winlogon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winlogon_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6508) winlogon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winlogon_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6508) winlogon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winlogon_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
12
Suspicious files
22
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
7052file.exeC:\Users\admin\Desktop\zaHrebVC.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
7052file.exeC:\ProgramData\dllhost.exeexecutable
MD5:02695C7F7CBCC35F221FB0E577CEDD66
SHA256:DE1422F5D42EC545B47C30B518BCAC1A40765611EB48453AA31EDAB447347BF3
7052file.exeC:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\ea9f0e6c9e2dcdtext
MD5:BD7B89549CC36918DF04DEDD168B8386
SHA256:863CCB03D9DD79C4B30A3D683A0E79E972B26BA49CB573639E020AD643FB9C01
7052file.exeC:\Users\admin\Desktop\HQLYdHol.logexecutable
MD5:E9CE850DB4350471A62CC24ACB83E859
SHA256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
7052file.exeC:\Users\admin\Desktop\qJutJUJW.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
7052file.exeC:\Users\Public\dllhost.exeexecutable
MD5:02695C7F7CBCC35F221FB0E577CEDD66
SHA256:DE1422F5D42EC545B47C30B518BCAC1A40765611EB48453AA31EDAB447347BF3
7052file.exeC:\Users\Public\5940a34987c991text
MD5:C7C95D3CB408E4B646E38F6CEB220C7E
SHA256:1AC7A4C227EF362F5CF0B09E6D7C41C0099ADF003149B45C7B89DCEB9F1F1788
7052file.exeC:\Users\Default\Pictures\886983d96e3d3etext
MD5:CAD059C2FC81AF68C0FD12561EEC1EA6
SHA256:519C1021A19581E8BB3B7D0D468E592EC15D3F0FC4A5226ECCECE1E292279736
7052file.exeC:\Users\admin\AppData\Local\Temp\tj4wtnso.0.cstext
MD5:80570124D2F10BEAE1B70FDAACD1F0E1
SHA256:5813D7DD79D140D8687F127A23275F1F9A002A38C9CCB693512FCC0DEDCF253C
7052file.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.exeexecutable
MD5:CF1A1B2A6F227D5B06AB0B3C8B88618B
SHA256:1FD250A499B2912B1ACEC31A03CAA32F1B328F2861E1383E94F23386F724FB36
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
27
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
6652
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6816
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
6564
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6508
winlogon.exe
POST
200
80.211.144.156:80
http://strepsils.top/VideoVm_requestMultiTestLocal.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6164
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6652
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6652
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6652
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6816
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6816
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.72
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
strepsils.top
  • 80.211.144.156
unknown
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
6508
winlogon.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6508
winlogon.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
6508
winlogon.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
6508
winlogon.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible DarkCrystal Rat Encrypted Connection
6508
winlogon.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file.exe