analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cdn.discordapp.com/attachments/972462409266655305/977438551669108766/File.7z?file=181.zip

Full analysis: https://app.any.run/tasks/924f3efa-ef3e-446c-ae55-b65ec57d6e7c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 11:21:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
socelars
stealer
Indicators:
MD5:

46821FD3FF1E4E87DBA6BEC314D2F029

SHA1:

2615BB8D62A375881BDE41AA4999D6B4D874B1CE

SHA256:

E1C605EBC3E29A930CFC9504C0FCC6B705BE9983A893A8B5C0077FBC0705F930

SSDEEP:

3:N8cCWdy6//jB1VcrFWVfjiblB3gGjIAjIADn:2cry6XjD2lhB3x9jIADn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • File.exe (PID: 3396)
      • File.exe (PID: 2808)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2552)

    • Disables Windows Defender

      • File.exe (PID: 2808)

    • Changes settings of System certificates

      • File.exe (PID: 2808)

    • Connects to CnC server

      • File.exe (PID: 2808)

    • SOCELARS was detected

      • File.exe (PID: 2808)

    • Modifies files in Chrome extension folder

      • File.exe (PID: 2808)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 916)

    • Reads the computer name

      • WinRAR.exe (PID: 2552)
      • File.exe (PID: 2808)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2552)

    • Checks supported languages

      • WinRAR.exe (PID: 2552)
      • File.exe (PID: 2808)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2552)

    • Adds / modifies Windows certificates

      • File.exe (PID: 2808)

    • Checks for external IP

      • File.exe (PID: 2808)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1760)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 916)
      • iexplore.exe (PID: 1876)
      • chrome.exe (PID: 1760)
      • chrome.exe (PID: 1388)
      • chrome.exe (PID: 2032)
      • chrome.exe (PID: 1856)
      • chrome.exe (PID: 1604)
      • chrome.exe (PID: 3084)
      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 960)
      • chrome.exe (PID: 3500)
      • chrome.exe (PID: 1900)
      • chrome.exe (PID: 2148)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 3192)

    • Reads the computer name

      • iexplore.exe (PID: 916)
      • iexplore.exe (PID: 1876)
      • chrome.exe (PID: 1760)
      • chrome.exe (PID: 3084)
      • chrome.exe (PID: 1604)
      • chrome.exe (PID: 960)
      • chrome.exe (PID: 1900)

    • Application launched itself

      • iexplore.exe (PID: 1876)
      • chrome.exe (PID: 1760)

    • Changes internet zones settings

      • iexplore.exe (PID: 1876)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 916)
      • iexplore.exe (PID: 1876)
      • File.exe (PID: 2808)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1876)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 916)
      • File.exe (PID: 2808)
      • chrome.exe (PID: 1604)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 1876)

    • Manual execution by user

      • chrome.exe (PID: 1760)

    • Reads the hosts file

      • chrome.exe (PID: 1604)
      • chrome.exe (PID: 1760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe no specs iexplore.exe winrar.exe file.exe no specs #SOCELARS file.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1876"C:\Program Files\Internet Explorer\iexplore.exe" "https://cdn.discordapp.com/attachments/972462409266655305/977438551669108766/File.7z?file=181.zip"C:\Program Files\Internet Explorer\iexplore.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
916"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1876 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2552"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\File.7z"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3396"C:\Users\admin\AppData\Local\Temp\Rar$EXb2552.26214\File.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2552.26214\File.exe—WinRAR.exe
User:
admin
Company:
ForceMin
Integrity Level:
MEDIUM
Description:
ForceMin
Exit code:
3221226540
Version:
1.3.21001.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2552.26214\file.exe
c:\windows\system32\ntdll.dll
2808"C:\Users\admin\AppData\Local\Temp\Rar$EXb2552.26214\File.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2552.26214\File.exe
WinRAR.exe
User:
admin
Company:
ForceMin
Integrity Level:
HIGH
Description:
ForceMin
Version:
1.3.21001.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2552.26214\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1760"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
1388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6eb5d988,0x6eb5d998,0x6eb5d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3084"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,1320749889870422059,11835566977879249052,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1060 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1604"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,1320749889870422059,11835566977879249052,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1240 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\imm32.dll
1856"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,1320749889870422059,11835566977879249052,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
22 575
Read events
22 362
Write events
210
Delete events
3

Modification events

(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30960900
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
19998804
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30960901
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1876) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
1
Suspicious files
128
Text files
115
Unknown types
13

Dropped files

PID
Process
Filename
Type
916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B25DCD471EA48B6A4F1F86D24C696E54
SHA256:59FF2F189BD917EE4BEBE774B74298FDA7799585D35074BD36D1E402CD0FC0BC
1876iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA09FBCCE210D3171.TMPgmc
MD5:6B90DA18D87861E194B2AA230E20BEA1
SHA256:5489034F468DD121BBDF590E83F167C0F41CD13C737881A290FEEA1A41A1C899
916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:47020B685E77ECD74ABC9ADCE105AD13
SHA256:558C89968EE2679A433CC03190339A000DEDD32D1E7A21B9929DD7631C4211BD
916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\File[1].7zcompressed
MD5:AE2A65FA88E976D5BFA33C48DECD2A65
SHA256:95EBE1E03CFC38B35A96037C9D602710E0418A3C4A0575A0AEBD8AE749E2D2C2
2808File.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PL_Client[1].bmpbinary
MD5:8D505656356A73B4595320989D0F263E
SHA256:4B456A4681006C12F3225BC10A460DC672A110C8FD260225AE3CC0EFD7F101E9
2808File.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\glmhhkoaglkboooplngidahblhiadpab\1.0.3_0\assets\icons\128x128.pngimage
MD5:5987038AA0253D5704E62C32D59FFB44
SHA256:82477EEA0C18A332AFF8216DF5DC86708BFDB8675339E363AE25AD65C3A0D43E
2808File.exeC:\Users\admin\Pictures\Adobe Films\xVTRLacbQWNooH0AxqWAbwubcrx
MD5:EBA38E008FDA9268E9B93BD3AD48A000
SHA256:FE29566F19CACB67F82E7342B5DDC5D723F79C1ECBA7A73A0F21C251F895368E
1876iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\File.7zcompressed
MD5:4BAE0558EF80F6E0522E7A0F9FC9F782
SHA256:2278C8C48B2BF0E8080776FB52F09DF454454F4731E322174EBDC3E622D3E102
1876iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2CF0256F-D8F8-11EC-8C9F-1203334A04AF}.datbinary
MD5:AEEB02D9D8160155276F5520B234152C
SHA256:2DDA947CA5F121330378E81249FF155210A4D198777E81D24A8BD920F01FAAE4
2552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2552.26214\File.exeexecutable
MD5:D8933905DAF436FDE88523508F9F0EAE
SHA256:4AA606A0A542D44BF4AA6F7EBCDC2684BF914C65A344BFED77AA34C8C20768A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
26
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2808
File.exe
HEAD
200
212.193.30.45:80
http://212.193.30.45/EXT/smartsearch.jpeg
RU
—
—
malicious
2808
File.exe
GET
200
212.193.30.21:80
http://212.193.30.21/base/api/statistics.php
RU
binary
94 b
malicious
2808
File.exe
GET
200
212.193.30.45:80
http://212.193.30.45/EXT/smartsearch.jpeg
RU
crx
203 Kb
malicious
916
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2808
File.exe
GET
400
45.144.225.57:80
http://45.144.225.57/server.txt
unknown
html
301 b
malicious
2808
File.exe
GET
400
212.193.30.45:80
http://212.193.30.45/proxies.txt
RU
html
301 b
malicious
916
iexplore.exe
GET
200
8.252.188.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53acdcc8e58d37ad
US
compressed
4.70 Kb
whitelisted
2808
File.exe
POST
200
212.193.30.21:80
http://212.193.30.21/base/api/getData.php
RU
text
280 b
malicious
2808
File.exe
POST
200
212.193.30.21:80
http://212.193.30.21/base/api/getData.php
RU
text
108 b
malicious
2808
File.exe
GET
200
212.193.30.45:80
http://212.193.30.45/EXT/smartsearch.png
RU
text
5.96 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
916
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
916
iexplore.exe
8.250.177.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
2808
File.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
2808
File.exe
212.193.30.21:80
—
—
RU
malicious
2808
File.exe
212.193.30.45:80
—
—
RU
malicious
2808
File.exe
45.144.225.57:80
—
—
—
malicious
916
iexplore.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
2808
File.exe
162.159.129.233:80
cdn.discordapp.com
Cloudflare Inc
—
shared
916
iexplore.exe
8.252.188.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2808
File.exe
172.67.34.170:443
pastebin.com
—
US
malicious

DNS requests

Domain
IP
Reputation
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.134.233
  • 162.159.130.233
  • 162.159.133.233
  • 162.159.135.233
shared
ctldl.windowsupdate.com
  • 8.250.177.254
  • 8.252.189.126
  • 8.252.192.126
  • 8.252.188.126
  • 8.252.188.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
shared
ipinfo.io
  • 34.117.59.81
shared
clients2.google.com
  • 142.250.186.78
whitelisted
clientservices.googleapis.com
  • 142.251.36.131
whitelisted
accounts.google.com
  • 142.250.186.141
shared
www.google.com
  • 142.250.181.228
whitelisted
clients2.googleusercontent.com
  • 142.250.186.97
whitelisted

Threats

PID
Process
Class
Message
916
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
916
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2808
File.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2808
File.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2808
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2808
File.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2808
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2808
File.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2808
File.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2808
File.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.discordapp.com/attachments/972462409266655305/977438551669108766/File.7z?file=181.zip