Find similar analyses in TI Lookup

Analysis date (UTC): 27 June 2023, 17:35Analysis environment: Windows 7 Pro, build 7601, x86

GTA V (fitgirl-repacks.site).exe

MD5:64C7636FA6FC7C945A4E12053F3E3791

SHA1:549811B6AEB13D7FA2C21E6DD52D9B5140DBABFB

SHA256:08FDE517F38A9E1FFF89E0A0A5FB096B44FD0C32ADF537CEE3AE32A80A41225E

Analysis result

Threat level:Malicious activity

Tags:

darkcomet

Full analysis:Analysis GTA V (fitgirl-repacks.site).exe (MD5: 64C7636FA6FC7C945A4E12053F3E3791) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the login/logoff helper path in the registry

GTA V (fitgirl-repacks.site).exe (PID: 3384)

DARKCOMET detected by memory dumps

explorer.exe (PID: 3424)

SUSPICIOUS

Creates executable files that already exist in Windows

GTA V (fitgirl-repacks.site).exe (PID: 3384)

Executable content was dropped or overwritten

GTA V (fitgirl-repacks.site).exe (PID: 3384)

The process creates files with name similar to system file names

GTA V (fitgirl-repacks.site).exe (PID: 3384)

Reads the Internet Settings

GTA V (fitgirl-repacks.site).exe (PID: 3384)

Starts itself from another location

GTA V (fitgirl-repacks.site).exe (PID: 3384)

INFO

The process checks LSA protection

GTA V (fitgirl-repacks.site).exe (PID: 3384)
explorer.exe (PID: 3424)

Checks supported languages

GTA V (fitgirl-repacks.site).exe (PID: 3384)
explorer.exe (PID: 3424)

Reads the computer name

GTA V (fitgirl-repacks.site).exe (PID: 3384)
explorer.exe (PID: 3424)

Reads the machine GUID from the registry

GTA V (fitgirl-repacks.site).exe (PID: 3384)

Threats

PID	Process	Class	Message
1076	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.ignorelist .com Domain
1076	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.ignorelist .com Domain
1076	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.ignorelist .com Domain