File name:

SpaceRat.exe

Full analysis: https://app.any.run/tasks/ba561922-9a93-4b96-8c1e-cadc24a00ea9
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: August 16, 2024, 23:22:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
sheetrat
rat
ip-check
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

5376F9ADE20FCEACED20B8018DD6B94D

SHA1:

7F523A9B6A3709583C9829F3B9D0E4E984F19124

SHA256:

E2115E48BEDC332BA3FBCE1965FA60D0C68EC4E674D021F83529E4CD773FDD50

SSDEEP:

98304:sLlJ/GVS6Megu+3sffsGMX67paAZV9XhlLZXbW3DUcDK2tFQdThHPpQ2o1pvkn/H:Y3WLqOzI+iQX5P1+n5N5vq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SHEETRAT has been detected (YARA)

      • SpaceRat.exe (PID: 6488)
      • x32dbg.exe (PID: 360)
      • SpaceRat.exe (PID: 4772)
      • x32dbg.exe (PID: 6540)
      • SpaceRat.exe (PID: 6336)

  • SUSPICIOUS

    • Reads the BIOS version

      • SpaceRat.exe (PID: 6488)

    • Drops the executable file immediately after the start

      • SpaceRat.exe (PID: 6488)

    • The process checks if it is being run in the virtual environment

      • SpaceRat.exe (PID: 6488)

    • Read disk information to detect sandboxing environments

      • SpaceRat.exe (PID: 6488)

    • There is functionality for capture public ip (YARA)

      • SpaceRat.exe (PID: 6488)

    • There is functionality for taking screenshot (YARA)

      • SpaceRat.exe (PID: 6488)
      • x32dbg.exe (PID: 360)
      • x32dbg.exe (PID: 6540)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3032)

    • Reads security settings of Internet Explorer

      • x96dbg.exe (PID: 6316)
      • x96dbg.exe (PID: 4248)
      • x32dbg.exe (PID: 360)
      • x96dbg.exe (PID: 5244)
      • x32dbg.exe (PID: 6540)

    • Reads the date of Windows installation

      • x96dbg.exe (PID: 6316)
      • x96dbg.exe (PID: 4248)
      • x96dbg.exe (PID: 5244)

    • Application launched itself

      • x96dbg.exe (PID: 6316)

    • Checks Windows Trust Settings

      • x32dbg.exe (PID: 360)
      • x32dbg.exe (PID: 6540)

  • INFO

    • Checks supported languages

      • SpaceRat.exe (PID: 6488)
      • x96dbg.exe (PID: 6316)
      • x96dbg.exe (PID: 2876)
      • x96dbg.exe (PID: 4248)
      • x32dbg.exe (PID: 360)
      • x96dbg.exe (PID: 5244)
      • x32dbg.exe (PID: 6540)
      • SpaceRat.exe (PID: 6336)
      • SpaceRat.exe (PID: 4772)

    • Reads the computer name

      • SpaceRat.exe (PID: 6488)
      • x96dbg.exe (PID: 6316)
      • x96dbg.exe (PID: 4248)
      • x96dbg.exe (PID: 2876)
      • x32dbg.exe (PID: 360)
      • x96dbg.exe (PID: 5244)
      • x32dbg.exe (PID: 6540)
      • SpaceRat.exe (PID: 4772)

    • Reads the machine GUID from the registry

      • SpaceRat.exe (PID: 6488)
      • x32dbg.exe (PID: 360)
      • x32dbg.exe (PID: 6540)

    • Reads Environment values

      • SpaceRat.exe (PID: 6488)

    • Checks proxy server information

      • SpaceRat.exe (PID: 6488)

    • Disables trace logs

      • SpaceRat.exe (PID: 6488)

    • Reads the software policy settings

      • SpaceRat.exe (PID: 6488)
      • x32dbg.exe (PID: 360)
      • x32dbg.exe (PID: 6540)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3032)

    • Manual execution by a user

      • WinRAR.exe (PID: 3032)
      • x96dbg.exe (PID: 6316)
      • x96dbg.exe (PID: 4248)
      • x96dbg.exe (PID: 5244)

    • Process checks computer location settings

      • x96dbg.exe (PID: 6316)
      • x96dbg.exe (PID: 4248)
      • x96dbg.exe (PID: 5244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:02 00:15:07+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 15890432
InitializedDataSize: 28672
UninitializedDataSize: -
EntryPoint: 0xf2960e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.2.2.2
ProductVersionNumber: 2.2.2.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: SpaceRat
CompanyName: -
FileDescription: SpaceRat
FileVersion: 2.2.2.2
InternalName: SpaceRat.exe
LegalCopyright: Copyright © ksr
LegalTrademarks: -
OriginalFileName: SpaceRat.exe
ProductName: SpaceRat
ProductVersion: 2.2.2.2
AssemblyVersion: 2.2.2.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
12
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #SHEETRAT spacerat.exe svchost.exe winrar.exe rundll32.exe no specs x96dbg.exe x96dbg.exe x96dbg.exe #SHEETRAT x32dbg.exe no specs #SHEETRAT spacerat.exe no specs x96dbg.exe #SHEETRAT x32dbg.exe no specs #SHEETRAT spacerat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x32\x32dbg.exe" "C:\Users\admin\Desktop\SpaceRat.exe" "" "C:\Users\admin\Desktop"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x32\x32dbg.exe
x96dbg.exe
User:
admin
Integrity Level:
MEDIUM
Description:
x64dbg
Exit code:
0
Version:
0.0.2.5
Modules
Images
c:\users\admin\desktop\snapshot_2024-07-28_17-00\release\x32\x32dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\wintrust.dll
c:\windows\syswow64\msvcrt.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2876"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" ::installC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
x96dbg.exe
User:
admin
Integrity Level:
HIGH
Description:
x64dbg
Exit code:
0
Version:
0.0.2.5
Modules
Images
c:\users\admin\desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3032"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\snapshot_2024-07-28_17-00.zip" C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4248"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" "C:\Users\admin\Desktop\SpaceRat.exe"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
x64dbg
Exit code:
0
Version:
0.0.2.5
Modules
Images
c:\users\admin\desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
4772"C:\Users\admin\Desktop\SpaceRat.exe"C:\Users\admin\Desktop\SpaceRat.exe
x32dbg.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SpaceRat
Exit code:
0
Version:
2.2.2.2
Modules
Images
c:\users\admin\desktop\spacerat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5088C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5244"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" "C:\Users\admin\Desktop\SpaceRat.exe"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
x64dbg
Exit code:
0
Version:
0.0.2.5
Modules
Images
c:\users\admin\desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
6316"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
x64dbg
Exit code:
0
Version:
0.0.2.5
Modules
Images
c:\users\admin\desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6336"C:\Users\admin\Desktop\SpaceRat.exe"C:\Users\admin\Desktop\SpaceRat.exe
x32dbg.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SpaceRat
Version:
2.2.2.2
Modules
Images
c:\users\admin\desktop\spacerat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
20 501
Read events
20 453
Write events
48
Delete events
0

Modification events

(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6488) SpaceRat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SpaceRat_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
86
Suspicious files
69
Text files
88
Unknown types
4

Dropped files

PID
Process
Filename
Type
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\commithash.txttext
MD5:2794DD14331FB75A4E0891F06E128D50
SHA256:66841D1B207A586079B83978DBF99637DCA85013281521747A29C645EA7B354B
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\dbghelp\dbghelp.htext
MD5:0B507925699ECCED4ADA1EF8061D7DB7
SHA256:4E556135CC506E2A30D78C24FD2934A832A7C663F6D2BA5A76F16DA9E86E0B85
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\bridgegraph.htext
MD5:95E63959AE4DC547059310D0907C167B
SHA256:1366A84F21DCBCACDF3E767E889E1F875F03713F4374CDE7D8CFE6C25DA10A69
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\bridgemain.htext
MD5:764DE6582E2C8D713AD87B7B115503AB
SHA256:97A9EF20468CF5D7124FD29595B843E5AB4E13401F8A8455C15EA1AD071B293E
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\bridgelist.htext
MD5:76B286ABCE8611B5D03721CA4FB893DF
SHA256:6D8BC206E406FC6981A1D7D92E1BB5EA6E2DF09A3F060A42330093745DEA4571
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\dbghelp\dbghelp_x64.abinary
MD5:9160B8815D608B3F516FF17969B34EED
SHA256:6ADCE5F9FB3F63BF4398F308F9B256B0DEF1B5805DDA8121C849A3C41DD8F542
6488SpaceRat.exeC:\Users\admin\Desktop\Intro.wavbinary
MD5:A89764CEE8FAAD8B0C776BCCCB2976CC
SHA256:9C5EA02E71FBD2993029000BD713A62B35D578526829E9931AFE66E5D73A28DD
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\DeviceNameResolver\DeviceNameResolver.htext
MD5:02863C21A76FBC195B7BFA98EA4A29CE
SHA256:F176A5317CE81BD61E1B5BBA20731CC907B30DE086A2B4D69AA763A235F240D5
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\dbghelp\dbghelp_x64.libobj
MD5:72B063AA283860D44F2106120D1165DE
SHA256:C4C2ADA7073B2D5FCC081FE9D88D286BAEF71A14C40A09756F5C556F1DBF413E
3032WinRAR.exeC:\Users\admin\Desktop\snapshot_2024-07-28_17-00\pluginsdk\DeviceNameResolver\DeviceNameResolver_x64.aobj
MD5:816D74E626D0351470C7C19187532A7D
SHA256:0D59FDCCAD341F27D8E84A556FBF640A37D0D9337666224F3F4BA85C29E49C97
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
46
DNS requests
20
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6904
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6932
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
532
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5212
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
6488
SpaceRat.exe
104.26.1.5:443
keyauth.win
CLOUDFLARENET
US
unknown
5336
SearchApp.exe
2.23.209.189:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4436
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.78
whitelisted
keyauth.win
  • 104.26.1.5
  • 104.26.0.5
  • 172.67.72.57
malicious
www.bing.com
  • 2.23.209.189
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.176
  • 2.23.209.185
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.73
  • 40.126.31.71
  • 40.126.31.69
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
th.bing.com
  • 2.23.209.176
  • 2.23.209.193
  • 2.23.209.149
  • 2.23.209.185
  • 2.23.209.158
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.140
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)
6488
SpaceRat.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI
Process
Message
x96dbg.exe
[x96dbg] Command line:
x96dbg.exe
"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe"
x96dbg.exe
[x96dbg] Command line:
x96dbg.exe
"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" ::install
x96dbg.exe
[x96dbg] Command line:
x96dbg.exe
"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" "C:\Users\admin\Desktop\SpaceRat.exe"
x96dbg.exe
[x96dbg] Command line:
x96dbg.exe
"C:\Users\admin\Desktop\snapshot_2024-07-28_17-00\release\x96dbg.exe" "C:\Users\admin\Desktop\SpaceRat.exe"
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpaceRat.exe