File name:

e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe

Full analysis: https://app.any.run/tasks/7139fae0-91ac-415d-bf13-acd94c5e9415
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 23:27:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
dcrat
rat
remote
darkcrystal
github
arch-exec
exfiltration
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

3A59355CF62DD850D29CF00BA7FF478B

SHA1:

1DE6C68B5DA51CC8B681FBFCB5F2E6E7238DD496

SHA256:

E71FC1170426B7F5407B292A1B880A1BF5475B7990AF6DDF4B82312FC2DA6611

SSDEEP:

98304:mZtMjYz/5iH27yZPnimkvmJ/mcwyWJM8AeeneJmHf5Ey+zlBrSuSvAUz2lTlvGii:5wlzNS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RAT has been found (auto)

      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7676)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7176)
      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 7584)
      • powershell.exe (PID: 7956)
      • powershell.exe (PID: 5112)
      • powershell.exe (PID: 7492)
      • powershell.exe (PID: 6752)
      • powershell.exe (PID: 7936)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 5064)
      • powershell.exe (PID: 4300)
      • powershell.exe (PID: 7636)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Connects to the CnC server

      • upfc.exe (PID: 7428)

    • DARKCRYSTAL has been detected (SURICATA)

      • upfc.exe (PID: 7428)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7536)

    • Changes Windows Defender settings

      • cmd.exe (PID: 7536)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 896)
      • powershell.exe (PID: 7336)
      • powershell.exe (PID: 1188)

    • Executing a file with an untrusted certificate

      • data.exe (PID: 7196)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • catlavan.exe (PID: 7444)
      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)

    • Executable content was dropped or overwritten

      • catlavan.exe (PID: 7444)
      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • upfc.exe (PID: 7428)
      • UnRAR.exe (PID: 8076)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 7584)
      • powershell.exe (PID: 7176)
      • powershell.exe (PID: 5112)
      • powershell.exe (PID: 7492)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 4300)

    • Starts CMD.EXE for commands execution

      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • cmd.exe (PID: 7408)
      • wscript.exe (PID: 7676)
      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • cmd.exe (PID: 7536)
      • powershell.exe (PID: 7620)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7676)
      • containerServersvc.exe (PID: 7152)
      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • powershell.exe (PID: 7620)

    • The process hides Powershell's copyright startup banner

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7676)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Reads the date of Windows installation

      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)

    • Lists computer manufacturer and model

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Application launched itself

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • The process creates files with name similar to system file names

      • containerServersvc.exe (PID: 7152)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 7536)
      • cmd.exe (PID: 7408)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7716)
      • powershell.exe (PID: 7720)
      • powershell.exe (PID: 744)
      • powershell.exe (PID: 7944)
      • powershell.exe (PID: 5776)
      • powershell.exe (PID: 4244)
      • powershell.exe (PID: 7696)
      • powershell.exe (PID: 3396)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 7408)
      • net.exe (PID: 7616)
      • cmd.exe (PID: 7536)
      • net.exe (PID: 6668)

    • Starts process via Powershell

      • powershell.exe (PID: 7620)
      • powershell.exe (PID: 7336)
      • powershell.exe (PID: 1188)
      • powershell.exe (PID: 896)

    • Connects to the server without a host name

      • upfc.exe (PID: 7428)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7536)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7536)

    • Probably download files using WebClient

      • cmd.exe (PID: 7536)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1228)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 7564)
      • cmd.exe (PID: 2288)

    • Starts a Microsoft application from unusual location

      • java.exe (PID: 6740)

    • Executes application which crashes

      • java11.exe (PID: 4880)

  • INFO

    • Reads the computer name

      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • catlavan.exe (PID: 7444)
      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • upfc.exe (PID: 7428)

    • Checks supported languages

      • catlavan.exe (PID: 7444)
      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • upfc.exe (PID: 7428)
      • chcp.com (PID: 7460)
      • chcp.com (PID: 7668)
      • chcp.com (PID: 660)

    • Process checks computer location settings

      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • catlavan.exe (PID: 7444)
      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)

    • Create files in a temporary directory

      • e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe (PID: 7316)
      • containerServersvc.exe (PID: 7152)

    • Reads the machine GUID from the registry

      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • upfc.exe (PID: 7428)

    • Reads Environment values

      • containerServersvc.exe (PID: 5972)
      • containerServersvc.exe (PID: 7152)
      • upfc.exe (PID: 7428)

    • Creates files in the program directory

      • containerServersvc.exe (PID: 7152)

    • Changes the display of characters in the console

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7536)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • catlavan.exe (PID: 7444)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7904)

    • Checks proxy server information

      • upfc.exe (PID: 7428)

    • Disables trace logs

      • upfc.exe (PID: 7428)

    • The sample compiled with english language support

      • powershell.exe (PID: 7980)
      • UnRAR.exe (PID: 8076)

    • The executable file from the user directory is run by the Powershell process

      • java.exe (PID: 6740)
      • java11.exe (PID: 4880)
      • data.exe (PID: 7196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:12 14:02:25+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 307200
InitializedDataSize: 177152
UninitializedDataSize: -
EntryPoint: 0x32680
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
239
Monitored processes
106
Malicious processes
10
Suspicious processes
9

Behavior graph

Click at the process to see the details
start e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe cmd.exe no specs conhost.exe no specs catlavan.exe findstr.exe no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs powershell.exe no specs wscript.exe no specs sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs containerserversvc.exe cmd.exe conhost.exe no specs containerserversvc.exe powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs findstr.exe no specs findstr.exe no specs chcp.com no specs timeout.exe no specs powershell.exe no specs findstr.exe no specs powershell.exe no specs findstr.exe no specs doskey.exe no specs wmic.exe no specs findstr.exe no specs rundll32.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs powershell.exe no specs #DARKCRYSTAL upfc.exe powershell.exe no specs powershell.exe no specs findstr.exe no specs findstr.exe no specs chcp.com no specs timeout.exe no specs powershell.exe no specs findstr.exe no specs powershell.exe no specs findstr.exe no specs doskey.exe no specs wmic.exe no specs findstr.exe no specs rundll32.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs reg.exe no specs rundll32.exe no specs reg.exe no specs powershell.exe no specs doskey.exe no specs doskey.exe no specs rundll32.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs findstr.exe no specs doskey.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe timeout.exe no specs powershell.exe no specs unrar.exe powershell.exe no specs powershell.exe no specs doskey.exe no specs rundll32.exe no specs powershell.exe no specs data.exe no specs powershell.exe no specs java.exe no specs powershell.exe no specs java11.exe powershell.exe no specs werfault.exe no specs findstr.exe no specs powershell.exe no specs findstr.exe no specs cmd.exe no specs wmic.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456findstr /i "echo" "C:\Users\admin\AppData\Local\Temp\catlavan.bat" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
660chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
720rundll32 C:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
728findstr /i "echo" "C:\Users\admin\AppData\Local\Temp\catlavan.bat" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
744powershell.exe -nop -c "Write-Host -NoNewLine $null" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896powershell -Command "Start-Process 'C:\Users\admin\AppData\Local\Temp\Testerka\java.exe' -WindowStyle Hidden" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
960ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
960doskey CERTREQ=PRINT C:\Windows\System32\doskey.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Keyboard History Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\doskey.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1072findstr /i "echo" "C:\Users\admin\AppData\Local\Temp\catlavan.bat" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
128 795
Read events
128 749
Write events
43
Delete events
3

Modification events

(PID) Process:(7444) catlavan.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(7152) containerServersvc.exeKey:HKEY_CURRENT_USER\SOFTWARE\1dc402f64b1e51e032ef9dbdee21890edcce8666
Operation:writeName:20e0dbf701859ea4afa485f9d73bada1bcbab9ab
Value:
H4sIAAAAAAAEAIWQQUvDQBCF/0roScEuaQ/FeisFTyLSpHjwicTNJFnc3Qkz2xj/vdF4yM25zPDNm/dgXlbHO+BElgeSL+CBWwU0qBoaaXXzuz4ryUQP3md/o1DrarPZ7zfrfGcsBxOcFVZuElBQJbY79P3CouFLrE2e50Dt5C2fa2ts9zER7zvWtJA/CbdShezeedLsarzdXQPPLtb8qdljCZTVu6eSxlSQDM4SQHF9LqY29p6F5D+zI4fAcWbApW/s4sLFxAWpOo7FYAHLMVUukvykTQ8YZvHrN5gz9rU+AQAA
(PID) Process:(7152) containerServersvc.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(7152) containerServersvc.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(7428) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7428) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7428) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7428) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7428) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7428) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
31
Suspicious files
28
Text files
92
Unknown types
0

Dropped files

PID
Process
Filename
Type
7408cmd.exeC:\Users\admin\AppData\Local\Temp\kdotYrUehi.battext
MD5:337065424ED27284C55B80741F912713
SHA256:4EF6F5F73F87CD552BF0DCEB245365C44996F94EB72AEB2CCEFE440FE055043B
7316e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exeC:\Users\admin\AppData\Local\Temp\catlavan.battext
MD5:B5E43005771F8677EA9400695A7F112F
SHA256:5AF32FBF5852F937053AE3CD6D935E92F0EB615437386F3B93E7445384D49240
7444catlavan.exeC:\intoSessionSvc\containerServersvc.exeexecutable
MD5:20FE97D0B5F64D6136F14DFBD5A7EBBD
SHA256:9C0766859442861A34D4C24343E103773E3B34CA1B4EAF25EE8D2157D4F55F3D
7316e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exeC:\Users\admin\AppData\Local\Temp\catlavan.exeexecutable
MD5:B941CEC1A1C25B304D7E6EFB8452264D
SHA256:641D3B5292B32444F764CBD3D410750F6358E3382E19D1B23F549995CD668C10
7444catlavan.exeC:\intoSessionSvc\Ec98vGzxbE1gJl5WDP6J8PyE8.vbebinary
MD5:2DC757361BC53062489A9212C5DD3BD8
SHA256:1C5A1818FDAE90E9CF504575D0C5236BE8B8A8433326407EA7FD21597B6280AB
7408cmd.exeC:\Users\admin\AppData\Local\Temp\kdotmRkZb.battext
MD5:337065424ED27284C55B80741F912713
SHA256:4EF6F5F73F87CD552BF0DCEB245365C44996F94EB72AEB2CCEFE440FE055043B
7584powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vwqlez0h.qoj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7584powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lubzc235.iw5.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7584powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e3huxoyg.a02.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7584powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2nijlpgy.2ov.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
26
DNS requests
16
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7428
upfc.exe
POST
200
81.94.155.48:80
http://81.94.155.48/VideotempSecureDefault/eternal/CentraltempApiVm/ExternalSecureprotectAsyncCdn.php
unknown
—
—
malicious
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7428
upfc.exe
POST
200
81.94.155.48:80
http://81.94.155.48/VideotempSecureDefault/eternal/CentraltempApiVm/ExternalSecureprotectAsyncCdn.php
unknown
—
—
malicious
7428
upfc.exe
POST
200
81.94.155.48:80
http://81.94.155.48/VideotempSecureDefault/eternal/CentraltempApiVm/ExternalSecureprotectAsyncCdn.php
unknown
—
—
malicious
7428
upfc.exe
POST
200
81.94.155.48:80
http://81.94.155.48/VideotempSecureDefault/eternal/CentraltempApiVm/ExternalSecureprotectAsyncCdn.php
unknown
—
—
malicious
7428
upfc.exe
POST
200
81.94.155.48:80
http://81.94.155.48/VideotempSecureDefault/eternal/CentraltempApiVm/ExternalSecureprotectAsyncCdn.php
unknown
—
—
malicious
7428
upfc.exe
POST
200
81.94.155.48:80
http://81.94.155.48/VideotempSecureDefault/eternal/CentraltempApiVm/ExternalSecureprotectAsyncCdn.php
unknown
—
—
malicious
664
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.17
  • 20.190.160.66
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.4
  • 20.190.160.5
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
github.com
  • 140.82.121.4
whitelisted

Threats

PID
Process
Class
Message
7428
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
7428
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7428
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
7428
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
7428
upfc.exe
A suspicious string was detected
SUSPICIOUS [ANY.RUN] Sending an HTTP request body with a Base64 encoded ZIP file
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e71fc1170426b7f5407b292a1b880a1bf5475b7990af6ddf4b82312fc2da6611.exe