File name:

Installer.exe

Full analysis: https://app.any.run/tasks/26074e75-1d91-4fe9-925f-12cb8bab7c96
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:06:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
darkcomet
rat
antivm
delphi
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

BA7B877D1FF3EC8306406C7BE60EACFB

SHA1:

C844C37FA13E3D0F2B97A01F098F24D44EB309AF

SHA256:

18D11D4C837FB6BB2C6806318CB1510BA7FDC54ABE8E7A53C589FD12B3A02292

SSDEEP:

98304:ECYzBDvnSJj2+COESkvWgfbSb4Y6ZhkDQet54nHZUhOcz0dGElMTjtGRU6EQIeJx:Gxnj881mw2/kiS3V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DARKCOMET mutex has been found

      • tmpxr7je5nu.exe (PID: 7496)

    • DARKCOMET has been detected (YARA)

      • tmpxr7je5nu.exe (PID: 7496)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • Installer.exe (PID: 7368)

    • Executable content was dropped or overwritten

      • Installer.exe (PID: 7368)
      • Installer.exe (PID: 7396)

    • Process drops legitimate windows executable

      • Installer.exe (PID: 7368)

    • The executable file from the user directory is run by the CMD process

      • tmpxr7je5nu.exe (PID: 7496)

    • Starts CMD.EXE for commands execution

      • Installer.exe (PID: 7396)

    • Connects to unusual port

      • tmpxr7je5nu.exe (PID: 7496)

    • There is functionality for taking screenshot (YARA)

      • tmpxr7je5nu.exe (PID: 7496)

    • There is functionality for VM detection antiVM strings (YARA)

      • tmpxr7je5nu.exe (PID: 7496)

    • There is functionality for communication over UDP network (YARA)

      • tmpxr7je5nu.exe (PID: 7496)

    • Application launched itself

      • Installer.exe (PID: 7368)

    • Process drops python dynamic module

      • Installer.exe (PID: 7368)

    • Loads Python modules

      • Installer.exe (PID: 7396)

  • INFO

    • Create files in a temporary directory

      • Installer.exe (PID: 7368)
      • Installer.exe (PID: 7396)

    • The sample compiled with english language support

      • Installer.exe (PID: 7368)
      • Installer.exe (PID: 7396)

    • Reads the computer name

      • Installer.exe (PID: 7368)
      • tmpxr7je5nu.exe (PID: 7496)

    • Checks supported languages

      • Installer.exe (PID: 7368)
      • tmpxr7je5nu.exe (PID: 7496)
      • Installer.exe (PID: 7396)

    • UPX packer has been detected

      • tmpxr7je5nu.exe (PID: 7496)

    • Reads the software policy settings

      • slui.exe (PID: 7516)

    • Compiled with Borland Delphi (YARA)

      • tmpxr7je5nu.exe (PID: 7496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:09 00:39:00+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 173568
InitializedDataSize: 155648
UninitializedDataSize: -
EntryPoint: 0xce30
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start installer.exe installer.exe cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs #DARKCOMET tmpxr7je5nu.exe slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7368"C:\Users\admin\AppData\Local\Temp\Installer.exe" C:\Users\admin\AppData\Local\Temp\Installer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
7396"C:\Users\admin\AppData\Local\Temp\Installer.exe" C:\Users\admin\AppData\Local\Temp\Installer.exe
Installer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
7416C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\tmpxr7je5nu.exe"C:\Windows\System32\cmd.exe—Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
7424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
7468C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
7496C:\Users\admin\AppData\Local\Temp\tmpxr7je5nu.exeC:\Users\admin\AppData\Local\Temp\tmpxr7je5nu.exe
cmd.exe
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
Remote Service Application
Version:
1, 0, 0, 1
7516"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
8132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\VCRUNTIME140.dllexecutable
MD5:32DA96115C9D783A0769312C0482A62D
SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\_socket.pydexecutable
MD5:566CB4D39B700C19DBD7175BD4F2B649
SHA256:77EBA293FE03253396D7BB6E575187CD026C80766D7A345EB72AD92F0BBBC3AA
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\_decimal.pydexecutable
MD5:21FCB8E3D4310346A5DC1A216E7E23CA
SHA256:9A0E05274CAD8D90F6BA6BC594261B36BFBDDF4F5CA6846B6367FE6A4E2FDCE4
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\_hashlib.pydexecutable
MD5:3E540EF568215561590DF215801B0F59
SHA256:0ED7A6ED080499BC6C29D7113485A8A61BDBA93087B010FCA67D9B8289CBE6FA
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\python313.dllexecutable
MD5:7387FE038EA75EB9A57B054FCCFE37BF
SHA256:69FD86EA29370697C203F7E12830084F920F490766A8E3045AF52C036A9AD529
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\libcrypto-3.dllexecutable
MD5:AE5B2E9A3410839B31938F24B6FC5CD8
SHA256:CCFFFDDCD3DEFB8D899026298AF9AF43BC186130F8483D77E97C93233D5F27D7
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\select.pydexecutable
MD5:715A098175D3CA1C1DA2DC5756B31860
SHA256:A6FD5ECAA5129D9543888D0413272903BF53B3AE57008A1411EEE594FFC1199F
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\_lzma.pydexecutable
MD5:D63E2E743EA103626D33B3C1D882F419
SHA256:7C2D2030D5D246739C5D85F087FCF404BC36E1815E69A8AC7C9541267734FC28
7368Installer.exeC:\Users\admin\AppData\Local\Temp\_MEI73682\unicodedata.pydexecutable
MD5:503B3FFA6A5BF45AB34D6D74352F206B
SHA256:9BDC17238FFE19C39ECF849503EAF3DB282EA4BC91FEAD0EE2BBC7410624A75F
7396Installer.exeC:\Users\admin\AppData\Local\Temp\6x4j_bmytext
MD5:3F1D1D8D87177D3D8D897D7E421F84D6
SHA256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7948
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7948
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4784
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7496
tmpxr7je5nu.exe
162.250.188.82:1604
—
RICAWEBSERVICES
CA
unknown
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.130
  • 40.126.31.129
  • 20.190.159.0
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.73
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Installer.exe