File name:

Deushack.exe

Full analysis: https://app.any.run/tasks/ea1eeb54-77b5-4aac-993f-5f33177f41ba
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: August 18, 2024, 14:17:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
metastealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

E97405E15F9F4B240F44FFB6F3C5CE32

SHA1:

9C9B4CA1300C1C5847ED125F3E3F5848E65B78A3

SHA256:

F15A0598C8F1521740548C00774CA6AF97437C6B0B4A0345A6735DC5ED1F0397

SSDEEP:

49152:aMWvdmIcwt9s5bjUbYcZAQfsdEifcMi1abuxPLlZENhLXsQnENbJYNzpzluLyAQr:a2wt254rNi4McPLlZE7LXsQEBJYNzLuI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 6620)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 6620)
    • METASTEALER has been detected (SURICATA)

      • RegAsm.exe (PID: 6620)
    • Stealers network behavior

      • RegAsm.exe (PID: 6620)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Deushack.exe (PID: 6468)
    • Drops the executable file immediately after the start

      • Deushack.exe (PID: 6468)
    • Executable content was dropped or overwritten

      • Deushack.exe (PID: 6468)
    • Reads the date of Windows installation

      • Deushack.exe (PID: 6468)
    • Executes application which crashes

      • Deushack.exe (PID: 6468)
    • Potential Corporate Privacy Violation

      • Deushack.exe (PID: 6468)
    • Searches for installed software

      • RegAsm.exe (PID: 6620)
    • Contacting a server suspected of hosting an CnC

      • RegAsm.exe (PID: 6620)
    • Connects to unusual port

      • RegAsm.exe (PID: 6620)
  • INFO

    • Checks supported languages

      • Deushack.exe (PID: 6468)
      • ygbrqu5k.bev.exe (PID: 6588)
      • RegAsm.exe (PID: 6620)
    • Reads the computer name

      • Deushack.exe (PID: 6468)
      • ygbrqu5k.bev.exe (PID: 6588)
      • RegAsm.exe (PID: 6620)
    • Disables trace logs

      • Deushack.exe (PID: 6468)
    • Reads Environment values

      • Deushack.exe (PID: 6468)
      • RegAsm.exe (PID: 6620)
    • Create files in a temporary directory

      • Deushack.exe (PID: 6468)
    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 6620)
      • Deushack.exe (PID: 6468)
    • Checks proxy server information

      • Deushack.exe (PID: 6468)
      • WerFault.exe (PID: 6852)
    • Process checks computer location settings

      • Deushack.exe (PID: 6468)
    • Reads the software policy settings

      • WerFault.exe (PID: 6852)
      • RegAsm.exe (PID: 6620)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:10 12:33:02+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1117184
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x112a5e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.0.0.0
ProductVersionNumber: 4.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Deushack
FileVersion: 4.0.0.0
InternalName: WindowsFormsApp1.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: WindowsFormsApp1.exe
ProductName: Deushack
ProductVersion: 4.0.0.0
AssemblyVersion: 4.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start deushack.exe ygbrqu5k.bev.exe no specs #METASTEALER regasm.exe conhost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6468"C:\Users\admin\AppData\Local\Temp\Deushack.exe" C:\Users\admin\AppData\Local\Temp\Deushack.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Deushack
Exit code:
3762504530
Version:
4.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\deushack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6588"C:\Users\admin\AppData\Local\Temp\ygbrqu5k.bev.exe" C:\Users\admin\AppData\Local\Temp\ygbrqu5k.bev.exeDeushack.exe
User:
admin
Company:
Volatilization Swellings
Integrity Level:
MEDIUM
Description:
Interruptible marbleised
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ygbrqu5k.bev.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6620"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
ygbrqu5k.bev.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeRegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6852C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6468 -s 2252C:\Windows\SysWOW64\WerFault.exe
Deushack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
15 335
Read events
15 312
Write events
23
Delete events
0

Modification events

(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6468) Deushack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Deushack_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6852WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Deushack.exe_7b3e80c11c89dc276d362c81e8019297071b5b3_6cf8a473_36f6df5a-7dbe-4f98-a2da-2f6d55163028\Report.wer
MD5:
SHA256:
6852WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Deushack.exe.6468.dmp
MD5:
SHA256:
6852WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
6852WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER76B3.tmp.WERInternalMetadata.xmlxml
MD5:A5CA5DE0705D5FA6A916165606181609
SHA256:A74A9D2B95B20365A9BD997008435E5EBC5490CE4C08E3A72C7D7559E3406951
6852WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7480.tmp.dmpbinary
MD5:59ED42677E662BC8D90802773EB40176
SHA256:D71B6955E66D617552A1B09DD7BF62FF6E7BE3ABD995ACB166CF6DCCBB266920
6468Deushack.exeC:\Users\admin\AppData\Local\Temp\ygbrqu5k.bev.exeexecutable
MD5:4B1F3665572793C95E91AA6499E70EDC
SHA256:40A0100C34E00270E43AFE4FE2B53AD98E4365B06043D76677F0B90131349E2D
6852WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
6852WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER76F3.tmp.xmlxml
MD5:F9E043C28C100B9DC7EA69AA9B93C3F7
SHA256:D75F55B149C8E204465B5B537D738415203D58A9930422C244C479CFB1072879
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
37
DNS requests
20
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6468
Deushack.exe
GET
200
185.22.155.72:80
http://s779602.ha005.t.justns.ru/loader.exe
unknown
whitelisted
6352
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
5068
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6228
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
6924
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3720
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
192.168.100.255:138
whitelisted
6468
Deushack.exe
185.22.155.72:80
s779602.ha005.t.justns.ru
LLC Baxet
RU
unknown
4936
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6852
WerFault.exe
20.189.173.21:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6620
RegAsm.exe
79.110.49.201:21180
GLOBALCOMPASS
US
unknown
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
s779602.ha005.t.justns.ru
  • 185.22.155.72
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.21
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
6468
Deushack.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6468
Deushack.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6620
RegAsm.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 8
6620
RegAsm.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] MetaStealer v.5 (MC-NMF TLS Server Certificate)
6620
RegAsm.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] MetaStealer v.5 TLS Certificate
No debug info