Malware analysis 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe Malicious activity | ANY.RUN - Malware Sandbox Online (2024)

Table of Contents
5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe 9F052BB878A9F37F266832B84DDE2C78 D489EECA8763CD3CB5DB0EFCF8F9AD9F9D4DA58B 12288:StiN4ZtQUc3OJe6QtKQroLNvlpW3Ari4VVyZC0+1cCE1gig+fMHSyROFV8FBDjlD:SCOJeRKYyNN3iE0nwKIAxCGx6 MALICIOUS SUSPICIOUS INFO TRiD EXIF Behavior graph Process information Modification events Dropped files HTTP requests Connections DNS requests Threats References

File name:

5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe

Full analysis: https://app.any.run/tasks/5debe1cb-7c3c-4970-994e-bdaec745f25b
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker>>>

Analysis date: May 14, 2024, 06:32:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:

dcrat

rat

backdoor

remote

stealer

Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

9F052BB878A9F37F266832B84DDE2C78

SHA1:

D489EECA8763CD3CB5DB0EFCF8F9AD9F9D4DA58B

SHA256:
SSDEEP:

12288:StiN4ZtQUc3OJe6QtKQroLNvlpW3Ari4VVyZC0+1cCE1gig+fMHSyROFV8FBDjlD:SCOJeRKYyNN3iE0nwKIAxCGx6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • DcRAT is detected

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Connects to the CnC server

      • taskhostw.exe (PID: 7036)

    • DCRAT has been detected (SURICATA)

      • taskhostw.exe (PID: 7036)

    • Steals credentials from Web Browsers

      • taskhostw.exe (PID: 7036)

    • Actions looks like stealing of personal data

      • taskhostw.exe (PID: 7036)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)

    • Executable content was dropped or overwritten

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 6616)

    • Executing commands from a ".bat" file

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)

    • Starts CMD.EXE for commands execution

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)

    • The executable file from the user directory is run by the CMD process

      • taskhostw.exe (PID: 7036)

  • INFO

    • Checks supported languages

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Reads the computer name

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Reads Environment values

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Reads the machine GUID from the registry

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Creates files in the program directory

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)

    • Create files in a temporary directory

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)
      • taskhostw.exe (PID: 7036)

    • Creates files or folders in the user directory

      • 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe (PID: 6556)

    • Checks proxy server information

      • taskhostw.exe (PID: 7036)

    • Reads the software policy settings

      • slui.exe (PID: 6204)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the

full report

No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

ProductVersion: 1.2.7.1277
ProductName: -
OriginalFileName: SpotifyStartupTask.exe
LegalCopyright: Copyright (c) 2023, Spotify Ltd
InternalName: SpotifyStartupTask
FileVersion: 1.2.7.1277
FileDescription: -
CompanyName: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.2.7.1277
FileVersionNumber: 1.2.7.1277
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x115d3e
UninitializedDataSize: -
InitializedDataSize: 1536
CodeSize: 1129984
LinkerVersion: 11
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2024:05:08 15:21:38+00:00
MachineType: Intel 386 or later, and compatibles

No data.

Malware analysis 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe Malicious activity | ANY.RUN - Malware Sandbox Online (1)

All screenshots are available in the full report

Total processes

133

Monitored processes

9

Malicious processes

3

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

6556"C:\Users\admin\AppData\Local\Temp\5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe" C:\Users\admin\AppData\Local\Temp\5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeexplorer.exe

User:

admin

Integrity Level:

MEDIUM

Version:

1.2.7.1277

Modules

Images

c:\users\admin\appdata\local\temp\5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe

c:\windows\system32\ntdll.dll

c:\windows\system32\mscoree.dll

c:\windows\system32\kernel32.dll

c:\windows\system32\kernelbase.dll

c:\windows\system32\apphelp.dll

c:\windows\system32\advapi32.dll

c:\windows\system32\msvcrt.dll

c:\windows\system32\sechost.dll

c:\windows\system32\rpcrt4.dll

6616C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\ayRoa5cdpG.bat" "C:\Windows\System32\cmd.exe—5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

1

Version:

10.0.19041.1 (WinBuild.160101.0800)

6628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

6700w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Time Service Diagnostic Tool

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images

c:\windows\system32\kernel.appcore.dll

7036"C:\Users\admin\Local Settings\taskhostw.exe" C:\Users\admin\AppData\Local\taskhostw.execmd.exe

User:

admin

Integrity Level:

MEDIUM

Version:

1.2.7.1277

Modules

Images

c:\users\admin\appdata\local\taskhostw.exe

c:\windows\system32\ntdll.dll

c:\windows\system32\mscoree.dll

c:\windows\system32\kernel32.dll

c:\windows\system32\kernelbase.dll

c:\windows\system32\apphelp.dll

c:\windows\system32\advapi32.dll

c:\windows\system32\msvcrt.dll

c:\windows\system32\sechost.dll

c:\windows\system32\rpcrt4.dll

116C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images

c:\windows\system32\sppextcomobj.exe

c:\windows\system32\ntdll.dll

c:\windows\system32\kernel32.dll

c:\windows\system32\kernelbase.dll

c:\windows\system32\advapi32.dll

c:\windows\system32\msvcrt.dll

c:\windows\system32\sechost.dll

c:\windows\system32\rpcrt4.dll

c:\windows\system32\bcrypt.dll

c:\windows\system32\oleaut32.dll

6204"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images

c:\windows\system32\slui.exe

c:\windows\system32\ntdll.dll

c:\windows\system32\kernel32.dll

c:\windows\system32\kernelbase.dll

c:\windows\system32\advapi32.dll

c:\windows\system32\msvcrt.dll

c:\windows\system32\sechost.dll

c:\windows\system32\rpcrt4.dll

c:\windows\system32\bcrypt.dll

c:\windows\system32\user32.dll

6436C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images

c:\windows\system32\slui.exe

c:\windows\system32\ntdll.dll

c:\windows\system32\kernel32.dll

c:\windows\system32\kernelbase.dll

c:\windows\system32\advapi32.dll

c:\windows\system32\msvcrt.dll

c:\windows\system32\sechost.dll

c:\windows\system32\rpcrt4.dll

c:\windows\system32\bcrypt.dll

c:\windows\system32\user32.dll

6752C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft OneDriveFile Co-Authoring Executable

Exit code:

Version:

19.043.0304.0013

Modules

Images

c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe

c:\windows\system32\ntdll.dll

c:\windows\syswow64\ntdll.dll

c:\windows\system32\wow64.dll

c:\windows\system32\wow64win.dll

c:\windows\system32\wow64cpu.dll

c:\windows\syswow64\kernel32.dll

c:\windows\syswow64\kernelbase.dll

c:\windows\syswow64\user32.dll

c:\windows\syswow64\win32u.dll

Total events

6016

Read events

6000

Write events

16

Delete events

Modification events

(PID) Process:(6556)5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeKey:HKEY_CURRENT_USER\SOFTWARE\9ae3d46f9d06b4828c444653c0bcf0562c369160
Operation:writeName:0b38c3e8da72706484a97228459153586520d601

Value:

H4sIAAAAAAAEAHWPQQ+CMAyF/wrhbMzGnHPejB41MVFP1sPoihJBCR3izxcNB6Ph1Ob1vfelx3g5Bzgw1QzgfJnfANZ3dEW0oxDy27mTg+Pr5c6hHdOT4tF3YtukRY4Am4bfw7flv6dvbS7MD/w/L4oi6tchyw8FuWYe5CyqauWC698A2FNZAWifZjpD7zMtlCAjpTXGG5/MlJJCIkqtEUUiJ1PrpSObZEKmnWAV0UybD+70ArqMMoEuAQAA

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:EnableFileTracing

Value:

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:EnableAutoFileTracing

Value:

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:EnableConsoleTracing

Value:

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:FileTracingMask

Value:

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:ConsoleTracingMask

Value:

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:MaxFileSize

Value:

1048576

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASAPI32
Operation:writeName:FileDirectory

Value:

%windir%\tracing

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASMANCS
Operation:writeName:EnableFileTracing

Value:

(PID) Process:(7036)taskhostw.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\taskhostw_RASMANCS
Operation:writeName:EnableAutoFileTracing

Value:

Executable files

13

Suspicious files

20

Text files

9

Unknown types

2

Dropped files

PID

Process

Filename

Type

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\admin\Desktop\ZyMJJtbe.logexecutable

MD5:F4B38D0F95B7E844DD288B441EBC9AAF

SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

7036taskhostw.exeC:\Users\admin\Desktop\OaMLMWGj.logexecutable

MD5:F4B38D0F95B7E844DD288B441EBC9AAF

SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\Public\Music\csrss.exeexecutable

MD5:9F052BB878A9F37F266832B84DDE2C78

SHA256:5DBF5FCDDF5030E711977D7D2833101CC155CC021469D1AE92F01BC0293EE857

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\admin\uhssvc.exeexecutable

MD5:9F052BB878A9F37F266832B84DDE2C78

SHA256:5DBF5FCDDF5030E711977D7D2833101CC155CC021469D1AE92F01BC0293EE857

7036taskhostw.exeC:\Users\admin\Desktop\CPxxzPRO.logexecutable

MD5:D8BF2A0481C0A17A634D066A711C12E9

SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\admin\Desktop\aDXkJcQf.logexecutable

MD5:E9CE850DB4350471A62CC24ACB83E859

SHA256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\ProgramData\105eec298f1910text

MD5:197C6FFBA18FD4EDD314BD94404F10DA

SHA256:7512E97AF15E48F7E7E102898506C18B1901574F81FFD7B14315FE23D790A0EE

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\admin\AppData\Local\taskhostw.exeexecutable

MD5:9F052BB878A9F37F266832B84DDE2C78

SHA256:5DBF5FCDDF5030E711977D7D2833101CC155CC021469D1AE92F01BC0293EE857

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\Public\Music\886983d96e3d3etext

MD5:AA535ECB786EDB778D96588B54D3F3A3

SHA256:6EA2912B04FEFB671F6FBE7BE5B655B4204A66A40FAF9B561DB1C03D3EADAB6B

65565dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exeC:\Users\admin\Desktop\ULvLgwLq.logexecutable

MD5:D8BF2A0481C0A17A634D066A711C12E9

SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669

Download PCAP, analyze network streams, HTTP content and a lot more at the

full report

HTTP(S) requests

30

TCP/UDP connections

52

DNS requests

17

Threats

HTTP requests

PID

Process

Method

HTTP Code

IP

URL

CN

Type

Size

Reputation

2392

svchost.exe

GET

200

2.16.100.137:80

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

unknown

—

—

unknown

2392

svchost.exe

GET

200

95.101.149.131:80

http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl

unknown

—

—

unknown

5940

svchost.exe

GET

200

192.229.221.95:80

http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

7036

taskhostw.exe

POST

200

172.67.167.60:80

http://taketa.top/imageTocpuupdateApiTemporary.php

unknown

—

—

unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the

full report

Connections

PID

Process

IP

Domain

ASN

CN

Reputation

4

System

192.168.100.255:138

—

—

—

whitelisted

—

—

40.127.240.158:443

—

MICROSOFT-CORP-MSN-AS-BLOCK

IE

unknown

—

—

2.23.209.150:443

—

Akamai International B.V.

GB

unknown

4364

svchost.exe

239.255.255.250:1900

—

—

—

unknown

2392

svchost.exe

40.127.240.158:443

—

MICROSOFT-CORP-MSN-AS-BLOCK

IE

unknown

2392

svchost.exe

4.231.128.59:443

settings-win.data.microsoft.com

MICROSOFT-CORP-MSN-AS-BLOCK

IE

whitelisted

2392

svchost.exe

2.16.100.137:80

crl.microsoft.com

Akamai International B.V.

DE

whitelisted

2392

svchost.exe

95.101.149.131:80

www.microsoft.com

Akamai International B.V.

NL

unknown

4680

SearchApp.exe

2.23.209.140:443

—

Akamai International B.V.

GB

unknown

5940

svchost.exe

40.126.32.133:443

login.live.com

MICROSOFT-CORP-MSN-AS-BLOCK

NL

unknown

DNS requests

Domain

IP

Reputation

settings-win.data.microsoft.com

  • 4.231.128.59

whitelisted

crl.microsoft.com

  • 2.16.100.137
  • 88.221.110.114

whitelisted

www.microsoft.com

  • 95.101.149.131
  • 2.19.217.218

whitelisted

login.live.com

  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.72

whitelisted

taketa.top

  • 172.67.167.60
  • 104.21.16.102

unknown

go.microsoft.com

  • 23.35.238.131

whitelisted

client.wns.windows.com

  • 40.113.110.67

whitelisted

arc.msn.com

  • 20.103.156.88

whitelisted

fd.api.iris.microsoft.com

  • 20.199.58.43

whitelisted

slscr.update.microsoft.com

  • 40.68.123.157

whitelisted

Threats

PID

Process

Class

Message

—

—

Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile

7036

taskhostw.exe

Potentially Bad Traffic

ET INFO HTTP Request to a *.top domain

7036

taskhostw.exe

A Network Trojan was detected

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

7036

taskhostw.exe

A Network Trojan was detected

REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)

—

—

Misc activity

SUSPICIOUS [ANY.RUN] Possible DarkCrystal Rat Encrypted Connection

—

—

Potentially Bad Traffic

ET INFO HTTP Request to a *.top domain

No debug info

Malware analysis 5dbf5fcddf5030e711977d7d2833101cc155cc021469d1ae92f01bc0293ee857.exe Malicious activity | ANY.RUN - Malware Sandbox Online (2024)

References

Top Articles
Upper Saddle River Board of Education hiring Electives Teacher-Technology/Digital and Broadcast Media (Grs 6-8) Anticipated Opening in Saddle River, New Jersey, United States | LinkedIn
Mechanical Engineering - 2020-21 Berkeley Academic Guideguide.berkeley.edu/undergraduate/degree-programs/mechanical... · Mechanical Engineering 1 Mechanical Engineering Bachelor - [PDF Document]
Kentucky Craigslist Boats For Sale By Owner
Minor League Baseball Stat Leaders
Hair Love Salon Bradley Beach
Huidverzorging I L'Oréal Paris
Gold SWOT: Gold erased some of Friday’s losses as the dollar weakened
How To Use Mint Mobile International Roaming
Latest Posts
Economics and Finance (BS) - Double Major - UT Dallas 2024 Undergraduate Catalog
Mock Trial and Model United Nations Classes Spread Debate Benefits in Middle and Upper Schools
Article information

Author: Francesca Jacobs Ret

Last Updated:

Views: 5903

Rating: 4.8 / 5 (68 voted)

Reviews: 83% of readers found this page helpful

Author information

Name: Francesca Jacobs Ret

Birthday: 1996-12-09

Address: Apt. 141 1406 Mitch Summit, New Teganshire, UT 82655-0699

Phone: +2296092334654

Job: Technology Architect

Hobby: Snowboarding, Scouting, Foreign language learning, Dowsing, Baton twirling, Sculpting, Cabaret

Introduction: My name is Francesca Jacobs Ret, I am a innocent, super, beautiful, charming, lucky, gentle, clever person who loves writing and wants to share my knowledge and understanding with you.