File name:

Kratos.exe

Full analysis: https://app.any.run/tasks/08d8d904-06a4-4aea-82cc-b9c897c5e82d
Verdict: Suspicious activity
Analysis date: June 09, 2018, 17:14:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4F4BBA771B123F61FD40C79AAC991C82

SHA1:

A966224FF65D3AB1DFE94A7C736172193C0843BE

SHA256:

46B001A845789629648498FA122FA2F5CC0607F4AE205624DD93BEFF57016881

SSDEEP:

24576:O02zBf9BU8kpUvzegINWkvuRBlGhdByM0m50sy9w5a:gU8cGe/VD0Xlw5a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Kratos.exe (PID: 3108)

  • SUSPICIOUS

    • Creates files in the user directory

      • vlc.exe (PID: 3888)

  • INFO

    • Dropped object may contain URL's

      • vlc.exe (PID: 3888)
      • Kratos.exe (PID: 3108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:05:07 09:16:29+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 716800
InitializedDataSize: 151040
UninitializedDataSize: -
EntryPoint: 0x8e435
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-May-2018 07:16:29

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 07-May-2018 07:16:29
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000AEF99
0x000AF000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62908
.rdata
0x000B0000
0x0001B562
0x0001B600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.90529
.data
0x000CC000
0x000033F8
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.58476
.gfids
0x000D0000
0x00000250
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.58737
.tls
0x000D1000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.reloc
0x000D2000
0x00005D48
0x00005E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.60691

Imports

ADVAPI32.dll
CRYPT32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
WININET.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kratos.exe vlc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3108"C:\Users\admin\AppData\Local\Temp\Kratos.exe" C:\Users\admin\AppData\Local\Temp\Kratos.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\kratos.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3888"C:\Program Files\VideoLAN\VLC\vlc.exe" C:\Program Files\VideoLAN\VLC\vlc.exe
explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Exit code:
0
Version:
2.2.6
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\videolan\vlc\libvlc.dll
c:\program files\videolan\vlc\libvlccore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
54
Read events
36
Write events
18
Delete events
0

Modification events

(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3108) Kratos.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Kratos_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
0
Suspicious files
1
Text files
7
Unknown types
5

Dropped files

PID
Process
Filename
Type
3888vlc.exeC:\Users\admin\AppData\Roaming\vlc\ml.xspf.tmp3888 —
MD5:—
SHA256:—
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\90059c37-1320-41a4-b58d-2b75a9850d2f\Browsers\Passwords.logtext
MD5:—
SHA256:—
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\90059c37-1320-41a4-b58d-2b75a9850d2f\Screenshot.bmpimage
MD5:—
SHA256:—
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\83698sqlite
MD5:—
SHA256:—
3888vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.initext
MD5:—
SHA256:—
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\90059c37-1320-41a4-b58d-2b75a9850d2f.zipcompressed
MD5:—
SHA256:—
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\90059c37-1320-41a4-b58d-2b75a9850d2f\Browsers\CC.logtext
MD5:CE168D8BB3761D846D781C75C1E5A144
SHA256:388864BDB6338A1C392CDD811B163367CE48FB7332D7F90546AF66AE8461F9B1
3888vlc.exeC:\Users\admin\AppData\Roaming\vlc\ml.xspfxml
MD5:781602441469750C3219C8C38B515ED4
SHA256:81970DBE581373D14FBD451AC4B3F96E5F69B79645F1EE1CA715CFF3AF0BF20D
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\log.txttext
MD5:A590D0C30C9867DBB91ADAD21A3E67A1
SHA256:AD492E8C6777288B23AD1124D5832C7E751926BA6D1F93A118E5C3D8168D86C9
3108Kratos.exeC:\Users\admin\AppData\Local\Temp\90059c37-1320-41a4-b58d-2b75a9850d2f\Browsers\Autofill.logtext
MD5:D83221FFF21514A7F71FA1B4616D1F49
SHA256:7E3057086BB794EC236208042550FD93A584B09944B069DFF5AA22291FB210C6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3108
Kratos.exe
5.101.78.169:80
—
OOO IT-Grad
RU
suspicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
Process
Message
vlc.exe
core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Kratos.exe