analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DarkH.rar

Full analysis: https://app.any.run/tasks/8d60191a-838e-493f-9c67-fd153d74bc2d
Verdict: Malicious activity
Analysis date: April 25, 2019, 03:26:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B1E2A4A65AF38F10D9CC22FA10826126

SHA1:

84B0B4874CF6002A546747406916BD8AF1235CA3

SHA256:

4DEA713D22E226C5366A8511BB5D6CB6C114E8D26628B526DB2982D12C0C557A

SSDEEP:

768:7wH9X9e+z1C2N23aNUt3iKIvORxzh0mE4ERSWl4199/VF:7wH9X9eC177NUty8z2mDcSW2Z/7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts Internet Explorer

      • cmd.exe (PID: 2552)
      • cmd.exe (PID: 1472)
      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 556)

    • Starts CMD.EXE for commands execution

      • DarkHydrus.exe (PID: 2960)
      • DarkHydrus.exe (PID: 4012)
      • DarkHydrus.exe (PID: 768)
      • DarkHydrus.exe (PID: 3880)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 1972)
      • iexplore.exe (PID: 2956)
      • iexplore.exe (PID: 304)
      • iexplore.exe (PID: 2488)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3332)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3332)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3332)
      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3088)

    • Creates files in the user directory

      • iexplore.exe (PID: 3332)
      • iexplore.exe (PID: 1972)
      • iexplore.exe (PID: 2168)

    • Dropped object may contain TOR URL's

      • iexplore.exe (PID: 3332)
      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3088)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
18
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs x64netdumper.exe darkhydrus.exe cmd.exe no specs iexplore.exe iexplore.exe darkhydrus.exe cmd.exe no specs iexplore.exe iexplore.exe darkhydrus.exe no specs cmd.exe no specs iexplore.exe iexplore.exe darkhydrus.exe no specs cmd.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DarkH.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2008"C:\Users\admin\Desktop\DarkH\X64NetDumper.exe" C:\Users\admin\Desktop\DarkH\X64NetDumper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
X64NetDumper
Version:
1.0.5463.29853
2960"C:\Users\admin\Desktop\DarkH\DarkHydrus.exe" C:\Users\admin\Desktop\DarkH\DarkHydrus.exe
explorer.exe
User:
admin
Company:
AyaN Software
Integrity Level:
HIGH
Description:
Share Facebook
Exit code:
0
Version:
1.0.0.0
2552cmd /c ""C:\Users\admin\AppData\Local\Temp\ztmp\t24124.bat" "C:\Users\admin\Desktop\DarkH\DarkHydrus.exe" "C:\Windows\system32\cmd.exe—DarkHydrus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1972"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3332"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1972 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4012"C:\Users\admin\Desktop\DarkH\DarkHydrus.exe" C:\Users\admin\Desktop\DarkH\DarkHydrus.exe
explorer.exe
User:
admin
Company:
AyaN Software
Integrity Level:
HIGH
Description:
Share Facebook
Exit code:
0
Version:
1.0.0.0
1472cmd /c ""C:\Users\admin\AppData\Local\Temp\ztmp\t16685.bat" "C:\Users\admin\Desktop\DarkH\DarkHydrus.exe" "C:\Windows\system32\cmd.exe—DarkHydrus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2956"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1748"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
3 386
Read events
3 121
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
69
Unknown types
4

Dropped files

PID
Process
Filename
Type
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.29366\DarkH\DarkHydrus.exe —
MD5:—
SHA256:—
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.29366\DarkH\X64NetDumper.exe —
MD5:—
SHA256:—
1972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
1972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sharer[1].php —
MD5:—
SHA256:—
3332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sharer[1].htm —
MD5:—
SHA256:—
3332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\login[1].php —
MD5:—
SHA256:—
1972iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4FA4FB065CFBD24B.TMP —
MD5:—
SHA256:—
3332iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\PrivacIE\index.datdat
MD5:D36B984EDB896F684228FF57BED096D4
SHA256:E691D75F30AABA0116D364E0E17DDFE233FF8A26DA7F6B81F5433F520DBEB76B
3332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\jkXFI9PmTGK[1].csstext
MD5:A23ED5B42AA506C880F336BEC75854FD
SHA256:F6A967D639B22A29D35C5B25243C4F281177DFA6B1F3B21C4674CA16C4A8E6D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
44
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2488
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2956
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
304
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
1972
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3332
iexplore.exe
185.60.216.35:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
3332
iexplore.exe
185.60.216.19:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
2956
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1972
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1748
iexplore.exe
185.60.216.19:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
1748
iexplore.exe
31.13.90.36:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
—
—
185.60.216.19:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
3088
iexplore.exe
31.13.90.36:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
2488
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
304
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.facebook.com
  • 185.60.216.35
  • 31.13.90.36
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
static.xx.fbcdn.net
  • 185.60.216.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DarkH.rar