File name:

cock.rar

Full analysis: https://app.any.run/tasks/b58a813f-133b-435b-b6be-a164ecbfb6a0
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: September 12, 2024, 18:41:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
dcrat
remote
darkcrystal
netreactor
wmi-base64
susp-powershell
stealer
exfiltration
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9E458F8F04BCFC5E875F0CCF7A412A44

SHA1:

593D33C2299968D83599A940110E34B1A329A9AE

SHA256:

5DBF886C130730B0F77C4C2CEE4051292CFA24D10D017EA7DB191F7F97306D8E

SSDEEP:

49152:iStEFv8kzlCBIWKyPk7mKEedLAGlqBIgQMzmEaGJfWA5llBI48yFhk+MTpw5Scj5:gFv8kzAbLedLAGgn9aCWA5Tbx7BMlw5H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6500)

    • DARKCRYSTAL has been detected (SURICATA)

      • SystemSettings.exe (PID: 3308)

    • Connects to the CnC server

      • SystemSettings.exe (PID: 3308)

    • DCRAT has been detected (YARA)

      • SystemSettings.exe (PID: 3308)

    • Steals credentials from Web Browsers

      • SystemSettings.exe (PID: 3308)

    • Actions looks like stealing of personal data

      • SystemSettings.exe (PID: 3308)

  • SUSPICIOUS

    • Suspicious files were dropped or overwritten

      • WinRAR.exe (PID: 2820)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 3900)

    • Uses WMIC.EXE to obtain data on the base board management (motherboard or system board)

      • cmd.exe (PID: 3900)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 208)
      • WMIC.exe (PID: 6056)
      • WMIC.exe (PID: 6124)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 3900)

    • Accesses computer name via WMI (SCRIPT)

      • WMIC.exe (PID: 6216)
      • WMIC.exe (PID: 6132)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 3900)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 6216)

    • Uses WMIC.EXE to obtain memory chip information

      • cmd.exe (PID: 3900)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 3900)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 6132)

    • Accesses system license id via WMI (SCRIPT)

      • WMIC.exe (PID: 6132)

    • Drops 7-zip archiver for unpacking

      • WinRAR.exe (PID: 2820)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 3900)

    • Reads security settings of Internet Explorer

      • testkey.scr (PID: 1556)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6500)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Executable content was dropped or overwritten

      • testkey.scr (PID: 1556)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)
      • SystemSettings.exe (PID: 3308)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 6500)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • The process creates files with name similar to system file names

      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Reads the date of Windows installation

      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 6164)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6500)

    • Loads DLL from Mozilla Firefox

      • SystemSettings.exe (PID: 3308)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6164)

    • Connects to the server without a host name

      • SystemSettings.exe (PID: 3308)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2820)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2820)
      • testkey.scr (PID: 1556)
      • wscript.exe (PID: 6500)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Manual execution by a user

      • WinRAR.exe (PID: 2820)
      • EagleSpy V5.exe (PID: 1448)
      • cmd.exe (PID: 3900)
      • notepad.exe (PID: 6676)
      • testkey.scr (PID: 1556)
      • notepad.exe (PID: 6452)

    • Checks supported languages

      • EagleSpy V5.exe (PID: 1448)
      • mode.com (PID: 6452)
      • testkey.scr (PID: 1556)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)
      • chcp.com (PID: 4540)
      • EagleSpy V5.exe (PID: 5984)
      • SystemSettings.exe (PID: 3308)

    • Reads the computer name

      • EagleSpy V5.exe (PID: 1448)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)
      • EagleSpy V5.exe (PID: 5984)
      • SystemSettings.exe (PID: 3308)
      • testkey.scr (PID: 1556)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6672)
      • WMIC.exe (PID: 6856)
      • WMIC.exe (PID: 208)
      • WMIC.exe (PID: 6216)
      • WMIC.exe (PID: 6776)
      • WMIC.exe (PID: 2016)
      • WMIC.exe (PID: 6124)
      • WMIC.exe (PID: 6132)
      • WMIC.exe (PID: 6056)
      • notepad.exe (PID: 6676)
      • notepad.exe (PID: 6452)

    • Displays MAC addresses of computer network adapters

      • getmac.exe (PID: 2804)

    • Checks proxy server information

      • slui.exe (PID: 5544)
      • SystemSettings.exe (PID: 3308)

    • Reads the software policy settings

      • slui.exe (PID: 5504)
      • slui.exe (PID: 5544)

    • Process checks computer location settings

      • testkey.scr (PID: 1556)
      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Reads the machine GUID from the registry

      • surrogateDriverSavesSessionCrt.exe (PID: 7056)
      • SystemSettings.exe (PID: 3308)

    • Reads Environment values

      • surrogateDriverSavesSessionCrt.exe (PID: 7056)
      • SystemSettings.exe (PID: 3308)

    • Create files in a temporary directory

      • surrogateDriverSavesSessionCrt.exe (PID: 7056)
      • SystemSettings.exe (PID: 3308)

    • Creates files in the program directory

      • surrogateDriverSavesSessionCrt.exe (PID: 7056)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6164)

    • Disables trace logs

      • SystemSettings.exe (PID: 3308)

    • .NET Reactor protector has been detected

      • SystemSettings.exe (PID: 3308)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • SystemSettings.exe (PID: 3308)

    • Found Base64 encoded reference to WMI classes (YARA)

      • SystemSettings.exe (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3308) SystemSettings.exe
C2 (1)http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower
Options
Version5.0.4
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2true
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Plugins (3)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAMXZ72QAAAAAAAAAAOAAIiALAQgAAPIAAAAGAAAAAAAAThABAAAgAAAAIAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAABgAQAAAgAARYYBAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
33
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe rundll32.exe no specs eaglespy v5.exe no specs cmd.exe conhost.exe no specs mode.com no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs getmac.exe no specs wmic.exe no specs wmic.exe no specs slui.exe eaglespy v5.exe no specs notepad.exe no specs testkey.scr wscript.exe no specs cmd.exe no specs conhost.exe no specs surrogatedriversavessessioncrt.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs notepad.exe no specs #DARKCRYSTAL systemsettings.exe

Process information

PID
CMD
Path
Indicators
Parent process
208wmic path win32_computersystemproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
368C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1076"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\cock.rarC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1448"C:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\EagleSpy V5.exe" C:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\EagleSpy V5.exe—explorer.exe
User:
admin
Company:
EagleSpy
Integrity Level:
MEDIUM
Description:
EagleSpy
Exit code:
99999
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\eaglespy v5\eaglespy v5\eaglespy v5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1556"C:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Lib\testkey.scr" /SC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Lib\testkey.scr
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\eaglespy v5\eaglespy v5\res\lib\testkey.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2016wmic cpu get processoridC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2804getmacC:\Windows\System32\getmac.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Displays NIC MAC information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\getmac.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2820"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver "-an=C:\Users\admin\Desktop\EagleSpy v5.part5.rar" "-an=C:\Users\admin\Desktop\EagleSpy v5.part4.rar" "-an=C:\Users\admin\Desktop\EagleSpy v5.part3.rar" "-an=C:\Users\admin\Desktop\EagleSpy v5.part1.rar" -- "C:\Users\admin\Desktop\EagleSpy v5.part2.rar" "C:\Users\admin\Desktop\EagleSpy v5\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3032\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3308"C:\blockproviderPerfSvc\SystemSettings.exe" C:\blockproviderPerfSvc\SystemSettings.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
16.10.31418.88
Modules
Images
c:\blockproviderperfsvc\systemsettings.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
DcRat
(PID) Process(3308) SystemSettings.exe
C2 (1)http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower
Options
Version5.0.4
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2true
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Plugins (3)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAMXZ72QAAAAAAAAAAOAAIiALAQgAAPIAAAAGAAAAAAAAThABAAAgAAAAIAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAABgAQAAAgAARYYBAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
Total events
8 059
Read events
8 046
Write events
13
Delete events
0

Modification events

(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\cock.rar
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2820) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
37
Suspicious files
53
Text files
465
Unknown types
3

Dropped files

PID
Process
Filename
Type
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\EagleSpy V5.exe —
MD5:—
SHA256:—
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\Cryptolens.Licensing.dllexecutable
MD5:F20CB7BA70247BF54E0F52BF705F5699
SHA256:87ADAAE9DADBB59CF050B6688D4BB1DBC6C7F2B3E9DDC6C41CB6CE7A086CBE63
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\Newtonsoft.Json.dllexecutable
MD5:6815034209687816D8CF401877EC8133
SHA256:7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\NAudio.dllexecutable
MD5:6CA17ABCCAE3050F391401B2955F9333
SHA256:3AD5D09B4C8C3146D15955A564A9F1A57D7C795B189A25C6F722A738D95EF89C
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\Newtonsoft.Json.xmlxml
MD5:AD1A946CDBE4FC83907CF558FB80A37F
SHA256:E3C9CB0CBF4B3BE20B6030F3A4872EDD81E042048D2D19732EAC3EEB9779DC0B
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Audio\2.wavbinary
MD5:9B15A3D6EA1205C555F91893859BDB7A
SHA256:40504BE5DA4002ABAD4B6B6B54DE0B966A3B9A5F4F24793B3AC9FC90E6CBE2CC
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Audio\3.wavbinary
MD5:269E4F85692280ED9C59CB1C40517007
SHA256:258C0A0B95163A9379E6BD7E95CEA5F47B96CE2816692016DAB5DAFA73AA1FE9
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Audio\5.wavwav
MD5:33794366BB58C3AF5E464B0A974CC182
SHA256:19DFFF92A123AC883F38BF617D530C6CD222ABF5540E3F215C9A44F6FCBA0D60
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Audio\4.wavwav
MD5:87F33DC8407B25DEAF98AC120E1883D6
SHA256:A3B05031FC5D69766F5C59923495A1158D0624D4D168070BC74B7F315405B127
2820WinRAR.exeC:\Users\admin\Desktop\EagleSpy v5\EagleSpy v5\res\Audio\6.wavbinary
MD5:A812F51D703FF92C95DD481FE270782F
SHA256:4AC90B06262E1D8DD6FC3F25E09ACD47619D159A46C763DC8298616910C0FE3A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
32
DNS requests
13
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3672
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
3308
SystemSettings.exe
POST
200
188.120.245.193:80
http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower.php
RU
binary
152 b
unknown
3308
SystemSettings.exe
POST
200
188.120.245.193:80
http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower.php
RU
binary
152 b
unknown
3308
SystemSettings.exe
POST
200
188.120.245.193:80
http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower.php
RU
binary
1.35 Kb
unknown
3672
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
3424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
3308
SystemSettings.exe
POST
200
188.120.245.193:80
http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower.php
RU
text
4 b
unknown
3308
SystemSettings.exe
POST
200
188.120.245.193:80
http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower.php
RU
binary
152 b
unknown
3308
SystemSettings.exe
POST
200
188.120.245.193:80
http://188.120.245.193/Cpu/to/7/3TestTo/baseEternal/UniversalPythonimage/LowWindows6/protonauthApi/Temporary01/cdnTemp/wp/line4ProcessDb/ImageJs_updateDefaultLinuxFlower.php
RU
binary
152 b
unknown
608
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
608
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6268
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
608
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3424
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3424
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3672
SIHClient.exe
52.165.165.26:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
3308
SystemSettings.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
3308
SystemSettings.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
3308
SystemSettings.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible DarkCrystal Rat Encrypted Connection
3308
SystemSettings.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
3308
SystemSettings.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cock.rar