analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dark Souls 3 Trainer Setup.exe

Full analysis: https://app.any.run/tasks/11f0a382-479e-478b-834f-300fe03a79d9
Verdict: Malicious activity
Analysis date: March 21, 2019, 17:36:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

123C72727CBE31B21F9596580A963D1D

SHA1:

28313BF9581E23D2BD8E3D3C08A1D38757B6EA91

SHA256:

4A5C87E97675A2D88575305526439C9F956DF6BAF8AB1A452198A7E3EDF6A209

SSDEEP:

1536:uP3C75n6UGB8M/kLu9qtz5IsH6aEu4afE91rkc3/oclgRV905bPy+9G:8Sx6UG+Fu9qwIXfE/kc3/ov2e+9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NDP8A66.exe (PID: 3020)
      • NDP8A66.exe (PID: 3264)
      • SetupUtility.exe (PID: 3028)
      • SetupUtility.exe (PID: 1092)
      • Setup.exe (PID: 2972)
      • aspnet_regiis.exe (PID: 3928)

    • Changes settings of System certificates

      • Setup.exe (PID: 2972)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2972)
      • ngen.exe (PID: 1184)
      • mscorsvw.exe (PID: 3064)
      • ngen.exe (PID: 2640)
      • ngen.exe (PID: 3960)

    • Loads the Task Scheduler COM API

      • ngen.exe (PID: 1184)
      • ngen.exe (PID: 3960)
      • mscorsvw.exe (PID: 3064)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NDP8A66.exe (PID: 3264)
      • WeMod-6.0.3[1].exe (PID: 3192)
      • Setup.exe (PID: 2972)
      • TMPC16C.tmp.exe (PID: 2456)
      • msiexec.exe (PID: 2780)

    • Creates files in the user directory

      • Dark Souls 3 Trainer Setup.exe (PID: 2840)

    • Adds / modifies Windows certificates

      • Setup.exe (PID: 2972)

    • Creates COM task schedule object

      • msiexec.exe (PID: 2780)
      • aspnet_regiis.exe (PID: 3928)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2780)

    • Creates files in the Windows directory

      • lodctr.exe (PID: 352)
      • ngen.exe (PID: 1184)
      • aspnet_regiis.exe (PID: 3928)
      • lodctr.exe (PID: 3268)
      • lodctr.exe (PID: 2408)
      • mscorsvw.exe (PID: 3064)
      • msiexec.exe (PID: 2780)
      • ngen.exe (PID: 3960)
      • lodctr.exe (PID: 1100)
      • lodctr.exe (PID: 2312)

    • Removes files from Windows directory

      • lodctr.exe (PID: 352)
      • lodctr.exe (PID: 2312)
      • lodctr.exe (PID: 3268)
      • lodctr.exe (PID: 2408)
      • msiexec.exe (PID: 2780)
      • lodctr.exe (PID: 1100)
      • aspnet_regiis.exe (PID: 3928)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Setup.exe (PID: 2972)
      • msiexec.exe (PID: 2780)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2072)
      • msiexec.exe (PID: 2780)
      • MsiExec.exe (PID: 1864)

    • Application launched itself

      • msiexec.exe (PID: 2780)

    • Creates or modifies windows services

      • msiexec.exe (PID: 2780)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

ProductVersion: 5.0.0.0
ProductName: WeMod
LegalCopyright: Copyright (C) 2018
FileVersion: 5.0.0.0
FileDescription: WeMod Setup
CompanyName: Daring Development Inc.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 5.0.0.0
FileVersionNumber: 5.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x20950
UninitializedDataSize: 77824
InitializedDataSize: 16384
CodeSize: 53248
LinkerVersion: 14.15
PEType: PE32
TimeStamp: 2018:09:27 04:43:27+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Sep-2018 02:43:27
Detected languages:
  • English - United States
CompanyName: Daring Development Inc.
FileDescription: WeMod Setup
FileVersion: 5.0.0.0
LegalCopyright: Copyright (C) 2018
ProductName: WeMod
ProductVersion: 5.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 27-Sep-2018 02:43:27
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00013000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00014000
0x0000D000
0x0000CC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.91245
.rsrc
0x00021000
0x00004000
0x00003800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.67704

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.14523
1556
UNKNOWN
English - United States
RT_MANIFEST
102
1.51664
20
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

GDI32.dll
KERNEL32.DLL
SHELL32.dll
SHLWAPI.dll
USER32.dll
WININET.dll
gdiplus.dll
urlmon.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
42
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start dark souls 3 trainer setup.exe wemod-6.0.3[1].exe ndp8a66.exe no specs ndp8a66.exe setup.exe setuputility.exe no specs setuputility.exe no specs tmpc16c.tmp.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs servicemodelreg.exe no specs wevtutil.exe no specs wevtutil.exe no specs lodctr.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs mofcomp.exe no specs mofcomp.exe no specs aspnet_regiis.exe no specs mofcomp.exe no specs ngen.exe no specs mscorsvw.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs ngen.exe no specs ngen.exe no specs mscorsvw.exe no specs mscorsvw.exe no specs mscorsvw.exe no specs mscorsvw.exe no specs mscorsvw.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2840"C:\Users\admin\AppData\Local\Temp\Dark Souls 3 Trainer Setup.exe" C:\Users\admin\AppData\Local\Temp\Dark Souls 3 Trainer Setup.exe
explorer.exe
User:
admin
Company:
Daring Development Inc.
Integrity Level:
MEDIUM
Description:
WeMod Setup
Version:
5.0.0.0
3192"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\WeMod-6.0.3[1].exe" --silentC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\WeMod-6.0.3[1].exe
Dark Souls 3 Trainer Setup.exe
User:
admin
Company:
WeMod
Integrity Level:
MEDIUM
Description:
WeMod - Cheats and Mods
Version:
6.0.3
3020"C:\Users\admin\AppData\Local\Temp\NDP8A66.exe" /q /norestartC:\Users\admin\AppData\Local\Temp\NDP8A66.exe—WeMod-6.0.3[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.7.1 Setup
Exit code:
3221226540
Version:
4.7.02558.00
3264"C:\Users\admin\AppData\Local\Temp\NDP8A66.exe" /q /norestartC:\Users\admin\AppData\Local\Temp\NDP8A66.exe
WeMod-6.0.3[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.7.1 Setup
Version:
4.7.02558.00
2972C:\06ef353ac8ac6208cbf668e0e2c033\\Setup.exe /q /norestart /x86 /x64 /webC:\06ef353ac8ac6208cbf668e0e2c033\Setup.exe
NDP8A66.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Version:
14.7.2558.0 built by: NET471REL1
3028SetupUtility.exe /aupauseC:\06ef353ac8ac6208cbf668e0e2c033\SetupUtility.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
0
Version:
14.7.2558.0 built by: NET471REL1
1092SetupUtility.exe /screbootC:\06ef353ac8ac6208cbf668e0e2c033\SetupUtility.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
0
Version:
14.7.2558.0 built by: NET471REL1
2456TMPC16C.tmp.exe /Q /X:C:\06ef353ac8ac6208cbf668e0e2c033\TMPC16C.tmp.exe.tmpC:\06ef353ac8ac6208cbf668e0e2c033\TMPC16C.tmp.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.7.1 Setup
Exit code:
0
Version:
4.7.02558.00
2780C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2072C:\Windows\system32\MsiExec.exe -Embedding 5E47125218BA271C3886E12489FC85F5C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Total events
20 178
Read events
7 294
Write events
0
Delete events
0

Modification events

No data
Executable files
523
Suspicious files
21
Text files
220
Unknown types
5

Dropped files

PID
Process
Filename
Type
2840Dark Souls 3 Trainer Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\WeMod-6.0.3[1].exe —
MD5:—
SHA256:—
3192WeMod-6.0.3[1].exeC:\Users\admin\AppData\Local\Temp\NDP8A66.exe —
MD5:—
SHA256:—
2840Dark Souls 3 Trainer Setup.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@wemod[1].txttext
MD5:726AB56E4FBF6B9CC192021FC515FB6B
SHA256:CCF5D7614C48822450ED1CFC80D5B7E64E84E7595497087B8DC4FB09C31C6683
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\watermark.bmpimage
MD5:B0075CEE80173D764C0237E840BA5879
SHA256:AB18374B3AAB10E5979E080D0410579F9771DB888BA1B80A5D81BA8896E2D33A
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\Graphics\Setup.icoimage
MD5:6125F32AA97772AFDFF2649BD403419B
SHA256:A0C7B4B17A69775E1D94123DFCEEC824744901D55B463BA9DCA9301088F12EA5
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\SplashScreen.bmpimage
MD5:BC32088BFAA1C76BA4B56639A2DEC592
SHA256:B05141DBC71669A7872A8E735E5E43A7F9713D4363B7A97543E1E05DCD7470A7
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\Graphics\Rotate9.icoimage
MD5:8853DA1F831CAE28E59D45F5E51885AC
SHA256:0203C7D678464641C016DC3D658ABA0A68F20B9A141D6E3EE1820C5B8B6401DB
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\Graphics\Rotate5.icoimage
MD5:25F0D572761CB610BDAD6DD980C46CC7
SHA256:CE2AFC0AA52B3D459D6D8D7C551F7B8FBF323E2260326908C37A13F21FEE423E
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\DisplayIcon.icoimage
MD5:F9657D290048E169FFABBBB9C7412BE0
SHA256:B74AD253B9B8F9FCADE725336509143828EE739CC2B24782BE3ECFF26F229160
3264NDP8A66.exeC:\06ef353ac8ac6208cbf668e0e2c033\Graphics\Rotate3.icoimage
MD5:0ADE6BE0DF29400E5534AA71ABFA03F6
SHA256:C2F6FAA18B16F728AE5536D5992CC76A4B83530A1EA74B9D11BEBDF871CF3B4E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
9
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
Setup.exe
GET
200
2.16.186.74:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
der
550 b
whitelisted
2972
Setup.exe
GET
200
2.16.186.74:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
der
555 b
whitelisted
—
—
HEAD
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net471Rel1&plcid=0x409&clcid=0x409&ar=02558.00&sar=amd64&o1=netfx_Full_x86.msi
NL
—
—
whitelisted
—
—
HEAD
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net471Rel1&plcid=0x409&clcid=0x409&ar=02558.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
—
—
GET
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net471Rel1&plcid=0x409&clcid=0x409&ar=02558.00&sar=amd64&o1=netfx_Full_x86.msi
NL
—
—
whitelisted
—
—
GET
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?LinkId=848159
NL
—
—
whitelisted
—
—
GET
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net471Rel1&plcid=0x409&clcid=0x409&ar=02558.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
—
—
HEAD
200
2.18.233.19:80
http://download.microsoft.com/download/2/F/4/2F4F48F4-D980-43AA-906A-8FFF40BCB832/Windows6.1-KB4019990-x86.msu
unknown
—
—
whitelisted
—
—
HEAD
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?LinkId=671733&clcid=0x409
NL
—
—
whitelisted
—
—
HEAD
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?LinkId=848159
NL
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
Setup.exe
2.16.186.74:80
crl.microsoft.com
Akamai International B.V.
—
whitelisted
2840
Dark Souls 3 Trainer Setup.exe
104.24.26.12:443
api.wemod.com
Cloudflare Inc
US
shared
3192
WeMod-6.0.3[1].exe
2.18.233.19:443
download.microsoft.com
Akamai International B.V.
—
whitelisted
—
—
2.18.233.19:80
download.microsoft.com
Akamai International B.V.
—
whitelisted
—
—
2.18.233.19:443
download.microsoft.com
Akamai International B.V.
—
whitelisted
—
—
104.109.80.115:80
go.microsoft.com
Akamai International B.V.
NL
whitelisted
3192
WeMod-6.0.3[1].exe
104.24.26.12:443
api.wemod.com
Cloudflare Inc
US
shared
2972
Setup.exe
2.23.106.83:80
www.microsoft.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
api.wemod.com
  • 104.24.26.12
  • 104.24.27.12
unknown
storage-cdn.wemod.com
  • 104.24.26.12
  • 104.24.27.12
suspicious
download.microsoft.com
  • 2.18.233.19
whitelisted
crl.microsoft.com
  • 2.16.186.74
  • 2.16.186.120
whitelisted
go.microsoft.com
  • 104.109.80.115
whitelisted
www.microsoft.com
  • 2.23.106.83
whitelisted

Threats

PID
Process
Class
Message
2840
Dark Souls 3 Trainer Setup.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3192
WeMod-6.0.3[1].exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dark Souls 3 Trainer Setup.exe