File name:

12f4b96090bb7a1aa45768f68870ef90.exe

Full analysis: https://app.any.run/tasks/8cad344e-7329-4c3d-842b-b59623d939d1
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: November 08, 2023, 07:56:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
privateloader
evasion
opendir
loader
risepro
stealer
stealc
tofsee
redline
botnet
ransomware
stop
sinkhole
miner
smoke
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

12F4B96090BB7A1AA45768F68870EF90

SHA1:

54ADFCC0E9DA25AEA9966EA76DDFC7E4940AF1A3

SHA256:

FF63976D5CC3F2965EF707E4073440CA0FD9D976A02CCC766BF7A4D9AF9144E9

SSDEEP:

98304:fu+9nQV5NO8k40RX3Cy1OujjcntpHfkqAsxNprhuXlmx0ab3KeXKvan7OpcZ8G4I:wFJCu502D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file the system directory

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • svchost.exe (PID: 712)

    • Connects to the CnC server

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • AppLaunch.exe (PID: 2240)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • svchost.exe (PID: 2572)
      • explorer.exe (PID: 1944)
      • explorer.exe (PID: 3044)
      • explorer.exe (PID: 1036)

    • PRIVATELOADER has been detected (SURICATA)

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)

    • Actions looks like stealing of personal data

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • AppLaunch.exe (PID: 2240)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • explorer.exe (PID: 3044)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)

    • Drops the executable file immediately after the start

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • Y1InncwESkL_RAhoc4OJGw6d.exe (PID: 3008)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • cmd.exe (PID: 2868)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • QzGq7E5Qz84uzUAYYjJ7f5l2.exe (PID: 2220)
      • InstallSetup5.exe (PID: 2960)
      • kos4.exe (PID: 2548)
      • LzmwAqmV.exe (PID: 1680)
      • IronPython.exe (PID: 2892)
      • is-ALL3Q.tmp (PID: 2776)
      • H0FzWQoMLRzXXrlV4SYv3QG6.exe (PID: 1460)

    • Create files in the Startup directory

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)

    • RISEPRO has been detected (SURICATA)

      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • IEUpdater1.exe (PID: 2620)

    • Uses Task Scheduler to run other applications

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • is-ALL3Q.tmp (PID: 2776)
      • explorer.exe (PID: 1944)

    • Uses Task Scheduler to autorun other applications

      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • powershell.exe (PID: 2084)
      • powershell.exe (PID: 1632)

    • TOFSEE has been detected (YARA)

      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Runs injected code in another process

      • BSD7jpt34WpxtPXF368ls6wj.exe (PID: 2620)

    • STEALC has been detected (SURICATA)

      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)

    • REDLINE has been detected (SURICATA)

      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • AppLaunch.exe (PID: 2240)

    • REDLINE has been detected (YARA)

      • v9Q3TmQ_3ki9FH0ghvlrf42J.exe (PID: 2692)

    • Steals credentials

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • explorer.exe (PID: 3044)

    • Steals credentials from Web Browsers

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • AppLaunch.exe (PID: 2240)

    • Stop is detected

      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)

    • TOFSEE has been detected (SURICATA)

      • svchost.exe (PID: 712)

    • Starts CMD.EXE for self-deleting

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 1944)
      • explorer.exe (PID: 3044)
      • explorer.exe (PID: 1036)

    • RISEPRO has been detected (YARA)

      • IEUpdater1.exe (PID: 2620)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2572)

    • Unusual connection from system programs

      • explorer.exe (PID: 3044)

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 1944)

    • PRIVATELOADER has been detected (YARA)

      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)

    • Modifies hosts file to block updates

      • latestX.exe (PID: 2264)

  • SUSPICIOUS

    • Adds/modifies Windows certificates

      • explorer.exe (PID: 1944)

    • Process requests binary or script from the Internet

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • kos4.exe (PID: 2548)

    • Reads settings of System Certificates

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • kos4.exe (PID: 2548)

    • Connects to the server without a host name

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)

    • Reads the Internet Settings

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • control.exe (PID: 3052)
      • cmd.exe (PID: 2268)
      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • cmd.exe (PID: 2804)
      • QzGq7E5Qz84uzUAYYjJ7f5l2.exe (PID: 2220)
      • explorer.exe (PID: 3044)
      • kos4.exe (PID: 2548)
      • powershell.exe (PID: 2772)
      • powershell.exe (PID: 2340)

    • Executes as Windows Service

      • raserver.exe (PID: 312)
      • zognsqvn.exe (PID: 2304)
      • raserver.exe (PID: 2572)
      • raserver.exe (PID: 2120)

    • Drops 7-zip archiver for unpacking

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)

    • Executing commands from a ".bat" file

      • Y1InncwESkL_RAhoc4OJGw6d.exe (PID: 3008)

    • Starts CMD.EXE for commands execution

      • Y1InncwESkL_RAhoc4OJGw6d.exe (PID: 3008)
      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • explorer.exe (PID: 1944)

    • Process drops legitimate windows executable

      • Y1InncwESkL_RAhoc4OJGw6d.exe (PID: 3008)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • is-ALL3Q.tmp (PID: 2776)

    • Reads the BIOS version

      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • IEUpdater1.exe (PID: 2620)

    • Checks for external IP

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)

    • Reads security settings of Internet Explorer

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)

    • Checks Windows Trust Settings

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)

    • Connects to unusual port

      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • AppLaunch.exe (PID: 2240)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • svchost.exe (PID: 2572)
      • svchost.exe (PID: 712)
      • IEUpdater1.exe (PID: 2620)

    • Application launched itself

      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 2452)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 2904)
      • svchost.exe (PID: 712)
      • explorer.exe (PID: 1944)
      • toolspub2.exe (PID: 1936)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)

    • Uses ICACLS.EXE to modify access control lists

      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)

    • Reads the date of Windows installation

      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)

    • Reads browser cookies

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • AppLaunch.exe (PID: 2240)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)

    • Accesses Microsoft Outlook profiles

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • explorer.exe (PID: 3044)

    • Searches for installed software

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • AppLaunch.exe (PID: 2240)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 712)

    • Creates or modifies Windows services

      • svchost.exe (PID: 712)

    • Starts itself from another location

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)

    • The process drops Mozilla's DLL files

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)

    • The process drops C-runtime libraries

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)

    • Connects to SMTP port

      • svchost.exe (PID: 712)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2788)

    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 1036)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 3056)

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 1944)

    • Starts POWERSHELL.EXE for commands execution

      • explorer.exe (PID: 1944)

    • Reads the Windows owner or organization settings

      • is-ALL3Q.tmp (PID: 2776)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1644)
      • cmd.exe (PID: 1844)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 2440)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2308)

  • INFO

    • Checks supported languages

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • Y1InncwESkL_RAhoc4OJGw6d.exe (PID: 3008)
      • BSD7jpt34WpxtPXF368ls6wj.exe (PID: 2620)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • v9Q3TmQ_3ki9FH0ghvlrf42J.exe (PID: 2692)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 2452)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • tJhBSnEx9vKiHjQYhPyP3i3S.exe (PID: 2120)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • AppLaunch.exe (PID: 2240)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • zognsqvn.exe (PID: 2304)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 2904)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)
      • IEUpdater1.exe (PID: 2620)
      • H0FzWQoMLRzXXrlV4SYv3QG6.exe (PID: 1460)
      • QzGq7E5Qz84uzUAYYjJ7f5l2.exe (PID: 2220)
      • InstallSetup5.exe (PID: 2960)
      • toolspub2.exe (PID: 1936)
      • Broom.exe (PID: 2132)
      • toolspub2.exe (PID: 1212)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 1644)
      • kos4.exe (PID: 2548)
      • latestX.exe (PID: 2264)
      • LzmwAqmV.exe (PID: 1680)
      • is-ALL3Q.tmp (PID: 2776)
      • IronPython.exe (PID: 2892)
      • IronPython.exe (PID: 2596)
      • updater.exe (PID: 2308)

    • Process checks computer location settings

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)

    • Reads the machine GUID from the registry

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • AppLaunch.exe (PID: 2240)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)
      • IEUpdater1.exe (PID: 2620)
      • kos4.exe (PID: 2548)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 1644)
      • QzGq7E5Qz84uzUAYYjJ7f5l2.exe (PID: 2220)

    • Reads the computer name

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • AppLaunch.exe (PID: 2240)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • vZOL1p2OybMvXTcvS7hi_nvj.exe (PID: 2408)
      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)
      • zognsqvn.exe (PID: 2304)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)
      • IEUpdater1.exe (PID: 2620)
      • QzGq7E5Qz84uzUAYYjJ7f5l2.exe (PID: 2220)
      • InstallSetup5.exe (PID: 2960)
      • Broom.exe (PID: 2132)
      • kos4.exe (PID: 2548)
      • e0cbefcb1af40c7d4aff4aca26621a98.exe (PID: 1644)
      • is-ALL3Q.tmp (PID: 2776)
      • IronPython.exe (PID: 2892)

    • Creates files or folders in the user directory

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)
      • explorer.exe (PID: 1944)

    • Create files in a temporary directory

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • Y1InncwESkL_RAhoc4OJGw6d.exe (PID: 3008)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • fYRN_UdFpiYX4FSO4lIlU29q.exe (PID: 648)
      • IEUpdater1.exe (PID: 2620)
      • QzGq7E5Qz84uzUAYYjJ7f5l2.exe (PID: 2220)
      • InstallSetup5.exe (PID: 2960)
      • explorer.exe (PID: 3044)
      • kos4.exe (PID: 2548)
      • is-ALL3Q.tmp (PID: 2776)
      • LzmwAqmV.exe (PID: 1680)
      • IronPython.exe (PID: 2892)

    • Process checks are UAC notifies on

      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • IEUpdater1.exe (PID: 2620)

    • Checks proxy server information

      • 12f4b96090bb7a1aa45768f68870ef90.exe (PID: 2732)
      • v5P2RTIxxy6uw58KNWERLcJN.exe (PID: 2160)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1268)
      • TQrFhmoLTw5M2T5SEnNhmSVi.exe (PID: 2412)
      • zHvlrAJQeeEdK27dnryLm2Ul.exe (PID: 1456)

    • Creates files in the program directory

      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • JD9UPgnytCESFHIRJnr9a8Is.exe (PID: 1228)
      • vNB5B9j4yHYEAB2b9WHarHmW.exe (PID: 1980)
      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • is-ALL3Q.tmp (PID: 2776)
      • IronPython.exe (PID: 2892)
      • H0FzWQoMLRzXXrlV4SYv3QG6.exe (PID: 1460)

    • Reads product name

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)

    • Reads Environment values

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • X2M4P4t3ZgeYOaNmTD213YeE.exe (PID: 3044)
      • 4LERtRDy5nQC4vHgdNIFAGWN.exe (PID: 640)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)
      • AppLaunch.exe (PID: 2240)
      • kos4.exe (PID: 2548)

    • Reads CPU info

      • ykr8m_oOps7zmszbWkHF3o0r.exe (PID: 2728)
      • P__Xndfl0n7QgZNThtHcArxM.exe (PID: 1844)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)
      • explorer.exe (PID: 1036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Tofsee

(PID) Process(648) fYRN_UdFpiYX4FSO4lIlU29q.exe
C2 (2)vanaheim.cn
jotunheim.name
Encrypted Strings (59)c:\Windows
\system32\
ImagePath
.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSConfig
/r
.exe
cmd /C move /Y "%s" %s sc config %s binPath= "%s%s /d\"%s\"" sc start %s
svchost.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
MSConfig
:.repos
USERPROFILE
\Local Settings:.repos
USERPROFILE
\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos
USERPROFILE
\wincookie.repos
TMP
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
SYSTEM\CurrentControlSet\services
ImagePath
SYSTEM\CurrentControlSet\services
SYSTEM\CurrentControlSet\services
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
.exe
qazwsxed
%s%i%i%i%i.bat
@echo off :next_try del "%s">nul if exist "%s" ( ping 127.0.0.1 >nul goto next_try ) del %%0
svchost.exe
.exe
/u
USERPROFILE
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/d
/e
/d
/e
.exe
"%s" /u"%s"
USERPROFILE
.exe
USERPROFILE
USERPROFILE
ver=%d lid=%d win=%X/%d sid=%s rep=%s

RisePro

(PID) Process(2620) IEUpdater1.exe
C2194.169.175.128

PrivateLoader

(PID) Process(1980) vNB5B9j4yHYEAB2b9WHarHmW.exe
C2 (4)91.92.243.151
94.142.138.131
94.142.138.113
208.67.104.60
Strings (62)Unknown
SOFTWARE\Microsoft\Cryptography
MachineGuid
telegram.org
twitter.com
yandex.ru
google.com
/api/tracemap.php
http://
15.5pnp.10.lock
data=
/api/firecom.php
ipinfo.io/widget
country
db-ip.com
data-api-key="
/self
countryCode
www.maxmind.com/geoip/v2.1/city/me
iso_code
GetIP
api.ipgeolocation.io/ipgeo?include=hostname&ip=
country_code2
PowerControl
\PowerControl
\PowerControl_Svc.exe
Power monitoring service for your device.
WININET.dll
WINHTTP.dll
91.92.243.151
94.142.138.131
94.142.138.113
208.67.104.60
GetVersion|
GetUpdateLink
https://
Later
" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
schtasks /create /f /RU "
" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpSetTimeouts
CharNextA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:10:14 10:37:34+02:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 3204096
InitializedDataSize: 849920
UninitializedDataSize: -
EntryPoint: 0x8fcb6a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.0
ProductVersionNumber: 1.0.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: StatusMessageResourceLib
FileVersion: 1.0.1.0
InternalName: StatusMessageResourceLib.dll
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: StatusMessageResourceLib.dll
ProductName: StatusMessageResourceLib
ProductVersion: 1.0.1.0
AssemblyVersion: 1.0.1.35400
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
97
Malicious processes
34
Suspicious processes
4

Behavior graph

Click at the process to see the details
start inject #PRIVATELOADER 12f4b96090bb7a1aa45768f68870ef90.exe raserver.exe no specs #TOFSEE fyrn_udfpiyx4fso4lilu29q.exe no specs bsd7jpt34wpxtpxf368ls6wj.exe no specs #STEALC v5p2rtixxy6uw58knwerlcjn.exe #REDLINE v9q3tmq_3ki9fh0ghvlrf42j.exe no specs #PRIVATELOADER vnb5b9j4yhyeab2b9wharhmw.exe y1inncweskl_rahoc4ojgw6d.exe no specs #STEALC ykr8m_oops7zmszbwkhf3o0r.exe #REDLINE 4lertrdy5nqc4vhgdnifagwn.exe #RISEPRO p__xndfl0n7qgznththcarxm.exe tjhbsnex9vkihjqyhpyp3i3s.exe no specs zhvlrajqeeedk27dnrylm2ul.exe no specs #REDLINE x2m4p4t3zgeyoanmtd213yee.exe #RISEPRO jd9upgnytcesfhirjnr9a8is.exe cmd.exe no specs #PRIVATELOADER vzol1p2oybmvxtcvs7hi_nvj.exe #REDLINE applaunch.exe #PRIVATELOADER tqrfhmoltw5m2t5sennhmsvi.exe control.exe no specs rundll32.exe no specs schtasks.exe no specs schtasks.exe no specs zhvlrajqeeedk27dnrylm2ul.exe schtasks.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs zognsqvn.exe no specs netsh.exe no specs zhvlrajqeeedk27dnrylm2ul.exe no specs #TOFSEE svchost.exe #STOP zhvlrajqeeedk27dnrylm2ul.exe schtasks.exe no specs schtasks.exe no specs #RISEPRO ieupdater1.exe raserver.exe no specs cmd.exe no specs cmd.exe no specs raserver.exe no specs timeout.exe no specs #SMOKE explorer.exe #MINER svchost.exe qzgq7e5qz84uzuayyjj7f5l2.exe no specs h0fzwqomlrzxxrlv4syv3qg6.exe no specs installsetup5.exe no specs #SMOKE explorer.exe toolspub2.exe no specs broom.exe no specs #SMOKE explorer.exe toolspub2.exe no specs e0cbefcb1af40c7d4aff4aca26621a98.exe no specs kos4.exe latestx.exe no specs lzmwaqmv.exe no specs is-all3q.tmp no specs rundll32.exe no specs rundll32.exe no specs schtasks.exe no specs ironpython.exe no specs powershell.exe ironpython.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe cmd.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs schtasks.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs updater.exe no specs sc.exe no specs sc.exe no specs cmd.exe powershell.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs schtasks.exe 12f4b96090bb7a1aa45768f68870ef90.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312C:\Windows\system32\RAServer.exe /offerraupdateC:\Windows\System32\raserver.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Remote Assistance COM Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\raserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
572icacls "C:\Users\admin\AppData\Local\2c7e2ed0-3c61-4fce-bd2b-765607c97484" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\SysWOW64\icacls.exe—zHvlrAJQeeEdK27dnryLm2Ul.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
640"C:\Users\admin\Pictures\Minor Policy\4LERtRDy5nQC4vHgdNIFAGWN.exe" C:\Users\admin\Pictures\Minor Policy\4LERtRDy5nQC4vHgdNIFAGWN.exe
12f4b96090bb7a1aa45768f68870ef90.exe
User:
admin
Company:
Biohazard
Integrity Level:
HIGH
Description:
METRO 2022 Dev
Exit code:
0
Version:
5.1.1
Modules
Images
c:\users\admin\pictures\minor policy\4lertrdy5nqc4vhgdnifagwn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
648"C:\Users\admin\Pictures\Minor Policy\fYRN_UdFpiYX4FSO4lIlU29q.exe" C:\Users\admin\Pictures\Minor Policy\fYRN_UdFpiYX4FSO4lIlU29q.exe
12f4b96090bb7a1aa45768f68870ef90.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\minor policy\fyrn_udfpiyx4fso4lilu29q.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Tofsee
(PID) Process(648) fYRN_UdFpiYX4FSO4lIlU29q.exe
C2 (2)vanaheim.cn
jotunheim.name
Encrypted Strings (59)c:\Windows
\system32\
ImagePath
.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSConfig
/r
.exe
cmd /C move /Y "%s" %s sc config %s binPath= "%s%s /d\"%s\"" sc start %s
svchost.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
MSConfig
:.repos
USERPROFILE
\Local Settings:.repos
USERPROFILE
\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos
USERPROFILE
\wincookie.repos
TMP
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
SYSTEM\CurrentControlSet\services
ImagePath
SYSTEM\CurrentControlSet\services
SYSTEM\CurrentControlSet\services
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
.exe
qazwsxed
%s%i%i%i%i.bat
@echo off :next_try del "%s">nul if exist "%s" ( ping 127.0.0.1 >nul goto next_try ) del %%0
svchost.exe
.exe
/u
USERPROFILE
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/d
/e
/d
/e
.exe
"%s" /u"%s"
USERPROFILE
.exe
USERPROFILE
USERPROFILE
ver=%d lid=%d win=%X/%d sid=%s rep=%s
712svchost.exeC:\Windows\SysWOW64\svchost.exe
zognsqvn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
988"C:\Windows\System32\sc.exe" description vqnmshau "wifi internet conection"C:\Windows\SysWOW64\sc.exe—fYRN_UdFpiYX4FSO4lIlU29q.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1012sc stop bits C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036C:\Windows\explorer.exeC:\Windows\explorer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1088sc stop wuauserv C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1088"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"C:\Windows\System32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
32 697
Read events
31 618
Write events
990
Delete events
89

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}User
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine\SOFTWARE
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine\SOFTWARE\Policies
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine\SOFTWARE\Policies\Microsoft
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions
Operation:delete keyName:(default)
Value:
(PID) Process:(2732) 12f4b96090bb7a1aa45768f68870ef90.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7D75E352-3229-4636-BB94-68E568FD9B65}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
Operation:delete keyName:(default)
Value:
Executable files
95
Suspicious files
88
Text files
33
Unknown types
1

Dropped files

PID
Process
Filename
Type
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:39DFFC602ED934569F26BE44EC645814
SHA256:B57A88E5B1ACF3A784BE88B87FA3EE1F0991CB7C1C66DA423F3595FFC6E0C5C2
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\Pictures\Minor Policy\v5P2RTIxxy6uw58KNWERLcJN.exeexecutable
MD5:7444AF0A8014D31AC37C73FFEC6518E0
SHA256:899CB0AFF59FDBD1A1EDF8D7C42180D38ADB3B3849668BD0C469D1AFC65464E5
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\timeSync[1].exeexecutable
MD5:7444AF0A8014D31AC37C73FFEC6518E0
SHA256:899CB0AFF59FDBD1A1EDF8D7C42180D38ADB3B3849668BD0C469D1AFC65464E5
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\Pictures\Minor Policy\ykr8m_oOps7zmszbWkHF3o0r.exeexecutable
MD5:6615DEC0E862CA80005072E4936A0DC0
SHA256:D934F3BB89201A0FFC2FE21E8C1A4B75BA2640B98AF6E483EA3FE80BFFAA9320
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SXAE7XLE.txttext
MD5:E7A96168CA5F3DD04DDF5201C2AF1CAD
SHA256:AC8F5557538AF6696F48CD22D6585B7BD01720831AD66C5FF59AAA6C1952E13A
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\AppData\Local\Temp\CabDCAA.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:CDFD60E717A44C2349B553E011958B85
SHA256:0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\build[1].exeexecutable
MD5:6615DEC0E862CA80005072E4936A0DC0
SHA256:D934F3BB89201A0FFC2FE21E8C1A4B75BA2640B98AF6E483EA3FE80BFFAA9320
273212f4b96090bb7a1aa45768f68870ef90.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\DJ761XOJ.txttext
MD5:5C09566B7B413C050C7D12E0919BFD8F
SHA256:15A086C40268C3364E857F95C66702576AEFFF90B7AB960EB5C5F43C974FDE4A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
70
TCP/UDP connections
221
DNS requests
76
Threats
209

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2732
12f4b96090bb7a1aa45768f68870ef90.exe
HEAD
200
194.49.94.48:80
http://194.49.94.48/timeSync.exe
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
HEAD
200
194.169.175.118:80
http://194.169.175.118/xinchao.exe
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
HEAD
200
194.49.94.97:80
http://194.49.94.97/download/Services.exe
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
GET
—
194.49.94.97:80
http://194.49.94.97/download/Services.exe
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
GET
—
194.169.175.118:80
http://194.169.175.118/xinchao.exe
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
GET
—
194.49.94.48:80
http://194.49.94.48/timeSync.exe
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
HEAD
200
89.191.234.21:80
http://gons11fc.top/build.exe
unknown
—
—
unknown
1980
vNB5B9j4yHYEAB2b9WHarHmW.exe
GET
302
91.92.243.151:80
http://91.92.243.151/api/tracemap.php
unknown
—
—
unknown
2728
ykr8m_oOps7zmszbWkHF3o0r.exe
GET
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
—
—
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
POST
200
94.142.138.131:80
http://94.142.138.131/api/firegate.php
unknown
text
108 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2732
12f4b96090bb7a1aa45768f68870ef90.exe
94.142.138.131:80
—
Network Management Ltd
RU
malicious
2732
12f4b96090bb7a1aa45768f68870ef90.exe
104.26.8.59:443
api.myip.com
CLOUDFLARENET
US
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
2732
12f4b96090bb7a1aa45768f68870ef90.exe
87.240.129.133:80
vk.com
VKontakte Ltd
RU
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
87.240.129.133:443
vk.com
VKontakte Ltd
RU
unknown
2732
12f4b96090bb7a1aa45768f68870ef90.exe
89.191.234.21:80
gons11fc.top
MIRholding B.V.
US
unknown

DNS requests

Domain
IP
Reputation
api.myip.com
  • 104.26.8.59
  • 172.67.75.163
  • 104.26.9.59
malicious
ipinfo.io
  • 34.117.59.81
shared
vk.com
  • 87.240.129.133
  • 87.240.132.72
  • 87.240.137.164
  • 87.240.132.78
  • 87.240.132.67
  • 93.186.225.194
whitelisted
teredo.ipv6.microsoft.com
  • —
unknown
fdjbgkhjrpfvsdf.online
  • 172.67.139.27
  • 104.21.87.5
malicious
medfioytrkdkcodlskeej.net
  • 91.215.85.209
malicious
gons11fc.top
  • 89.191.234.21
unknown
ctldl.windowsupdate.com
  • 23.216.77.77
  • 23.216.77.67
  • 23.216.77.45
  • 23.216.77.68
  • 23.216.77.54
  • 23.216.77.46
  • 23.216.77.66
  • 23.216.77.49
  • 23.216.77.74
whitelisted
sun6-22.userapi.com
  • 95.142.206.2
unknown
sun6-21.userapi.com
  • 95.142.206.1
whitelisted

Threats

PID
Process
Class
Message
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
324
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Potentially Bad Traffic
ET HUNTING Suspicious services.exe in URI
2732
12f4b96090bb7a1aa45768f68870ef90.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
30 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
12f4b96090bb7a1aa45768f68870ef90.exe