File name:

AimStar.exe

Full analysis: https://app.any.run/tasks/374d7189-287a-4296-b25f-ddd50302671c
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 14, 2024, 13:24:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8CA977D29A884DF4CC0FA29EFEE868AF

SHA1:

99CA71394C1483D331F0963FC0C476D7E98E3FC5

SHA256:

E341875335AB0192719A7A17C39DD43FE185BE56D7DFF52C8434525489523007

SSDEEP:

98304:HFrKdVa+1El/BW52kDATegZrIxpmueRY4kvutWgT48KSIei7PP4g5lDrqwHO15Ef:HWpEvSJ48

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AimStar.exe (PID: 2040)
      • Surrogatewin.exe (PID: 2304)

    • UAC/LUA settings modification

      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • lsass.exe (PID: 3200)
      • Surrogatewin.exe (PID: 1020)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 2812)

    • DCRAT has been detected (SURICATA)

      • lsass.exe (PID: 3200)

  • SUSPICIOUS

    • Reads the Internet Settings

      • wscript.exe (PID: 1432)
      • AimStar.exe (PID: 2040)
      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • wscript.exe (PID: 2812)
      • lsass.exe (PID: 3200)
      • Surrogatewin.exe (PID: 1020)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 2812)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1432)
      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • wscript.exe (PID: 2812)

    • The process executes VB scripts

      • AimStar.exe (PID: 2040)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1432)
      • Surrogatewin.exe (PID: 2304)
      • wscript.exe (PID: 2812)

    • Executable content was dropped or overwritten

      • AimStar.exe (PID: 2040)
      • Surrogatewin.exe (PID: 2304)

    • Executed via WMI

      • schtasks.exe (PID: 1924)
      • schtasks.exe (PID: 2736)
      • schtasks.exe (PID: 2572)
      • schtasks.exe (PID: 452)
      • schtasks.exe (PID: 1384)
      • schtasks.exe (PID: 2484)
      • schtasks.exe (PID: 2260)
      • schtasks.exe (PID: 664)
      • schtasks.exe (PID: 2568)
      • schtasks.exe (PID: 2760)
      • schtasks.exe (PID: 984)
      • schtasks.exe (PID: 1556)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 2828)
      • schtasks.exe (PID: 2780)
      • schtasks.exe (PID: 2724)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 2728)
      • schtasks.exe (PID: 2748)
      • schtasks.exe (PID: 2960)
      • schtasks.exe (PID: 2464)
      • schtasks.exe (PID: 1600)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 2512)
      • schtasks.exe (PID: 1932)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 2360)
      • schtasks.exe (PID: 2852)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 3076)
      • schtasks.exe (PID: 948)
      • schtasks.exe (PID: 2824)
      • schtasks.exe (PID: 3016)
      • schtasks.exe (PID: 2900)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 900)

    • The process creates files with name similar to system file names

      • Surrogatewin.exe (PID: 2304)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2752)

    • Reads settings of System Certificates

      • lsass.exe (PID: 3200)

    • Starts itself from another location

      • Surrogatewin.exe (PID: 1020)

  • INFO

    • Reads the computer name

      • AimStar.exe (PID: 2040)
      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • lsass.exe (PID: 3200)
      • Surrogatewin.exe (PID: 3672)
      • cmd.exe (PID: 4052)
      • Surrogatewin.exe (PID: 1020)
      • lsass.exe (PID: 2184)
      • Surrogatewin.exe (PID: 784)
      • Surrogatewin.exe (PID: 2308)
      • cmd.exe (PID: 1832)
      • Surrogatewin.exe (PID: 2692)

    • Checks supported languages

      • AimStar.exe (PID: 2040)
      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • lsass.exe (PID: 3200)
      • Surrogatewin.exe (PID: 3672)
      • cmd.exe (PID: 4052)
      • Surrogatewin.exe (PID: 1020)
      • lsass.exe (PID: 2184)
      • Surrogatewin.exe (PID: 2308)
      • Surrogatewin.exe (PID: 2692)
      • cmd.exe (PID: 1832)
      • Surrogatewin.exe (PID: 784)

    • Reads Environment values

      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • lsass.exe (PID: 3200)
      • Surrogatewin.exe (PID: 3672)
      • cmd.exe (PID: 4052)
      • lsass.exe (PID: 2184)
      • Surrogatewin.exe (PID: 1020)
      • Surrogatewin.exe (PID: 784)
      • cmd.exe (PID: 1832)
      • Surrogatewin.exe (PID: 2308)
      • Surrogatewin.exe (PID: 2692)

    • Manual execution by a user

      • explorer.exe (PID: 1504)
      • wscript.exe (PID: 2812)
      • Surrogatewin.exe (PID: 1020)
      • cmd.exe (PID: 4052)
      • lsass.exe (PID: 2184)
      • Surrogatewin.exe (PID: 784)
      • Surrogatewin.exe (PID: 2308)
      • cmd.exe (PID: 2336)

    • Reads the machine GUID from the registry

      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • Surrogatewin.exe (PID: 3672)
      • lsass.exe (PID: 3200)
      • cmd.exe (PID: 4052)
      • Surrogatewin.exe (PID: 1020)
      • lsass.exe (PID: 2184)
      • Surrogatewin.exe (PID: 784)
      • Surrogatewin.exe (PID: 2308)
      • cmd.exe (PID: 1832)
      • Surrogatewin.exe (PID: 2692)

    • Reads product name

      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • lsass.exe (PID: 3200)
      • cmd.exe (PID: 4052)
      • Surrogatewin.exe (PID: 3672)
      • Surrogatewin.exe (PID: 1020)
      • lsass.exe (PID: 2184)
      • Surrogatewin.exe (PID: 784)
      • cmd.exe (PID: 1832)
      • Surrogatewin.exe (PID: 2308)
      • Surrogatewin.exe (PID: 2692)

    • Process checks whether UAC notifications are on

      • Surrogatewin.exe (PID: 1392)
      • Surrogatewin.exe (PID: 2304)
      • lsass.exe (PID: 3200)
      • Surrogatewin.exe (PID: 1020)

    • Creates files in the program directory

      • Surrogatewin.exe (PID: 2304)

    • Create files in a temporary directory

      • Surrogatewin.exe (PID: 2304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 19:00:55+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 255488
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
106
Monitored processes
58
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start aimstar.exe wscript.exe no specs wscript.exe no specs cmd.exe no specs surrogatewin.exe no specs explorer.exe no specs cmd.exe surrogatewin.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs #DCRAT lsass.exe wscript.exe no specs cmd.exe no specs surrogatewin.exe no specs cmd.exe no specs surrogatewin.exe no specs lsass.exe no specs cmd.exe surrogatewin.exe no specs surrogatewin.exe no specs cmd.exe no specs surrogatewin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Windows\System32\WScript.exe" "C:\containerwebref\file.vbs" C:\Windows\System32\wscript.exe—AimStar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
452schtasks.exe /create /tn "taskengt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Notepad++\taskeng.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
664schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Notepad++\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
784"C:\containerwebref\Surrogatewin.exe" C:\containerwebref\Surrogatewin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\containerwebref\surrogatewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
900schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\containerwebref\lsass.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
948schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\cmd.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
984schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\Application\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1020"C:\containerwebref\Surrogatewin.exe" C:\containerwebref\Surrogatewin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\containerwebref\surrogatewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1196schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-040C-0000-0000000FF1CE}-C\smss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1384schtasks.exe /create /tn "taskeng" /sc ONLOGON /tr "'C:\Program Files\Notepad++\taskeng.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
6 846
Read events
6 774
Write events
72
Delete events
0

Modification events

(PID) Process:(2040) AimStar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) AimStar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) AimStar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) AimStar.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1392) Surrogatewin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
1
(PID) Process:(1392) Surrogatewin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
13
Suspicious files
1
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040AimStar.exeC:\containerwebref\file.vbstext
MD5:677CC4360477C72CB0CE00406A949C61
SHA256:F1CCCB5AE4AA51D293BD3C7D2A1A04CB7847D22C5DB8E05AC64E9A6D7455AA0B
2304Surrogatewin.exeC:\Program Files\Notepad++\69ddcba757bf72text
MD5:543526577525C8889F6D2AB002E84D57
SHA256:CDA078297985135EFD66E3AE7A9FEC79A2317E6CC677BCDD7E7EEC4BE1886CD5
2304Surrogatewin.exeC:\containerwebref\cmd.exeexecutable
MD5:098ED4F4720ED2F17E54B2443E939D4F
SHA256:25F6D5BB9C5ADA0E49A0E635F9317903F2B9BFE3654E777234972FA6A666C30E
2304Surrogatewin.exeC:\Windows\Vss\Writers\Application\69ddcba757bf72text
MD5:E584CD4A5DB42A86223109EFBA6783C8
SHA256:71A85F7DB554D7FDED381C0B206A8747CEEACEE45050BD85AF635A219432119D
2304Surrogatewin.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\5940a34987c991text
MD5:AF52CD7279B8978CE7D71464DF27EFBA
SHA256:75C976BF951E16B87149DB23D33637517E69E8D64D8E691F05826B1D26443E5B
2304Surrogatewin.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\dllhost.exeexecutable
MD5:098ED4F4720ED2F17E54B2443E939D4F
SHA256:25F6D5BB9C5ADA0E49A0E635F9317903F2B9BFE3654E777234972FA6A666C30E
2304Surrogatewin.exeC:\MSOCache\All Users\{90140000-0100-0419-0000-0000000FF1CE}-C\taskeng.exeexecutable
MD5:098ED4F4720ED2F17E54B2443E939D4F
SHA256:25F6D5BB9C5ADA0E49A0E635F9317903F2B9BFE3654E777234972FA6A666C30E
2304Surrogatewin.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\lsm.exeexecutable
MD5:098ED4F4720ED2F17E54B2443E939D4F
SHA256:25F6D5BB9C5ADA0E49A0E635F9317903F2B9BFE3654E777234972FA6A666C30E
2304Surrogatewin.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\101b941d020240text
MD5:E7F1D57C269517FB543D71781B9B37CF
SHA256:50461BC17D33416543A2FD04F83714AD5D297FF327B0C5421F0C764F400E70EF
2304Surrogatewin.exeC:\MSOCache\All Users\{90140000-0100-0419-0000-0000000FF1CE}-C\96094160f8fe35text
MD5:4F5D3D58CEB5A264B1E65BB03551D8F3
SHA256:247B6F8A35794C7DB5447995E67651733B1F13F9E36C9E8DFAAE63E0937BE396
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
2
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3200
lsass.exe
GET
403
141.8.192.126:80
http://a0902024.xsph.ru/L1nc0In.php?SluzqhchnszNqshQ2lb4KStIV=q2rlj1XVaHtwm3evCgdfL5CYTNa4l&1l=v1k0CI70URZhF8iZ&PNo0tuzSSVbdu=PIS1C45AXgp1nm&6aaeabf44c2b163242e8eb756d1a2275=825da4d4a5fc7705a0043ea48045d6d4&8122b40371c16f0be15dd4e3d4e4788b=QOmhTZ2Y2YiVjNiZmMiR2NyI2YjJTZ0ATOjdjMjVjYxYzY1QjMkZWM&SluzqhchnszNqshQ2lb4KStIV=q2rlj1XVaHtwm3evCgdfL5CYTNa4l&1l=v1k0CI70URZhF8iZ&PNo0tuzSSVbdu=PIS1C45AXgp1nm
unknown
html
55.9 Kb
unknown
3200
lsass.exe
GET
403
141.8.192.126:80
http://a0902024.xsph.ru/L1nc0In.php?SluzqhchnszNqshQ2lb4KStIV=q2rlj1XVaHtwm3evCgdfL5CYTNa4l&1l=v1k0CI70URZhF8iZ&PNo0tuzSSVbdu=PIS1C45AXgp1nm&6aaeabf44c2b163242e8eb756d1a2275=825da4d4a5fc7705a0043ea48045d6d4&8122b40371c16f0be15dd4e3d4e4788b=QOmhTZ2Y2YiVjNiZmMiR2NyI2YjJTZ0ATOjdjMjVjYxYzY1QjMkZWM&SluzqhchnszNqshQ2lb4KStIV=q2rlj1XVaHtwm3evCgdfL5CYTNa4l&1l=v1k0CI70URZhF8iZ&PNo0tuzSSVbdu=PIS1C45AXgp1nm
unknown
html
55.9 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3200
lsass.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
3200
lsass.exe
141.8.192.126:80
a0902024.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
a0902024.xsph.ru
  • 141.8.192.126
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
3200
lsass.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AimStar.exe