File name:

HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe

Full analysis: https://app.any.run/tasks/5a321c33-38f5-4ee8-82d0-8949a7715efd
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 05, 2023, 16:16:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5D329190630C5C051E1B2C4AD4C69ABD

SHA1:

0227D4E1597CA90477CAD5FC3A960F3590457031

SHA256:

6974F159CB6E056FD9675EC4ECB6D271A7D6BB69711A295BE593091D3BCB9E45

SSDEEP:

49152:cFrKj5Ge6AB8lQrSNrRhk5IF3ajBAX5uefILAxe:cFrKdc05IF3aqfILAQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • hui.exe (PID: 1612)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 284)

    • Changes the login/logoff helper path in the registry

      • hui.exe (PID: 1612)

    • Creates a writable file the system directory

      • hui.exe (PID: 1612)

    • Changes the autorun value in the registry

      • hui.exe (PID: 1612)

    • DCRAT has been detected (SURICATA)

      • taskhost.exe (PID: 2276)

  • SUSPICIOUS

    • Reads the Internet Settings

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • wscript.exe (PID: 284)
      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 284)
      • hui.exe (PID: 1612)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 284)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 284)
      • hui.exe (PID: 1612)

    • Executed via WMI

      • schtasks.exe (PID: 2476)
      • schtasks.exe (PID: 1784)
      • schtasks.exe (PID: 2820)
      • schtasks.exe (PID: 2660)
      • schtasks.exe (PID: 2120)
      • schtasks.exe (PID: 2452)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 2152)

    • The process creates files with name similar to system file names

      • hui.exe (PID: 1612)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2488)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2488)

    • Creates executable files that already exist in Windows

      • hui.exe (PID: 1612)

  • INFO

    • Checks supported languages

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • hui.exe (PID: 1612)
      • chcp.com (PID: 1680)
      • taskhost.exe (PID: 2276)

    • Reads the computer name

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Creates files or folders in the user directory

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)

    • The executable file from the user directory is run by the CMD process

      • hui.exe (PID: 1612)

    • Reads Environment values

      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Reads the machine GUID from the registry

      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Creates files in the program directory

      • hui.exe (PID: 1612)

    • Create files in a temporary directory

      • hui.exe (PID: 1612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 19:00:55+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 231936
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
17
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start heur-backdoor.msil.lightstone.gen-6974f159cb6.exe wscript.exe no specs cmd.exe no specs hui.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT taskhost.exe heur-backdoor.msil.lightstone.gen-6974f159cb6.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Adobe\sN8j8UtUmLUEbzv.vbe" C:\Windows\SysWOW64\wscript.exe—HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1480w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1612"C:\Users\admin\AppData\Roaming\Adobe\hui.exe"C:\Users\admin\AppData\Roaming\Adobe\hui.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.132.56703
Modules
Images
c:\users\admin\appdata\roaming\adobe\hui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
1628schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDINTAM\taskhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1680chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1784schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0100-0412-1000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2120schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\vcomp140\winlogon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2152schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\taskhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2276"C:\Windows\System32\KBDINTAM\taskhost.exe" C:\Windows\System32\KBDINTAM\taskhost.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.132.56703
Modules
Images
c:\windows\system32\kbdintam\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
2380"C:\Users\admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe" C:\Users\admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\heur-backdoor.msil.lightstone.gen-6974f159cb6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 890
Read events
2 854
Write events
36
Delete events
0

Modification events

(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1612) hui.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe
(PID) Process:(1612) hui.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\found.000\hui.exe"
Executable files
9
Suspicious files
1
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
1612hui.exeC:\found.000\f2164dc19afefe692c19df494576dbe29d2a7d0dtext
MD5:83BDBC54283B6A759FC990CB88561D1C
SHA256:69485A24C75ACFB4D92B5C7C47B70C71D7E5C074DCB0ED49B02B02C92E563852
1612hui.exeC:\Windows\System32\dot3gpui\conhost.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\found.000\hui.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\ProgramData\Oracle\Java\javapath\services.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\MSOCache\All Users\{90140000-0100-0412-1000-0000000FF1CE}-C\conhost.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\Windows\System32\dot3gpui\088424020bedd6b28ac7fd22ee35dcd7322895cetext
MD5:5F96EBEBB181471F2BB3E46767D58A48
SHA256:AB2E7F5F16324C7D8BE4298B61CBF3FB604B7056028849D9A255740103156B0F
1612hui.exeC:\Windows\System32\vcomp140\cc11b995f2a76da408ea6a601e682e64743153adtext
MD5:2598E19A89D5152690F46A51CF28F6F6
SHA256:2CCD6150587E87DC6CADA72049C8D84FC5C5EAD57F96FEEC835EB3405A6AB2CD
2380HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeC:\Users\admin\AppData\Roaming\Adobe\hui.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\Windows\System32\KBDINTAM\b75386f1303e64d8139363b71e44ac16341adf4etext
MD5:7A371B326D3FBE11F83D36CABACCD657
SHA256:2A1ACAC306D846D1C9DCEB184AA61F053FDA64500224F2811434F8C2F63B8EFD
1612hui.exeC:\Windows\System32\DShowRdpFilter\b75386f1303e64d8139363b71e44ac16341adf4etext
MD5:D56EB6A9778AEB7C01DC2F9DAD4C02BA
SHA256:2949D3CB12B30FFA389A21279840BB321DD535238F173F65ED66B4EC2285FCB3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2276
taskhost.exe
GET
404
185.26.122.79:80
http://host1835875.hostland.pro/Lowlongpolltest.php?GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk&3998e4b767cc58057b788963dc557b0a=79a349ba785d906a76eb09f6c1191279&a186b4e8b8ab60f6ea84885b889965cc=QYmZGN2AjM0ATO3gTOwIjY2YzYkNjMiJ2Y0QjYhRDNyYzN1MDNycTY&GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk
unknown
html
146 b
unknown
2276
taskhost.exe
GET
404
185.26.122.79:80
http://host1835875.hostland.pro/Lowlongpolltest.php?GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk&3998e4b767cc58057b788963dc557b0a=79a349ba785d906a76eb09f6c1191279&a186b4e8b8ab60f6ea84885b889965cc=QYmZGN2AjM0ATO3gTOwIjY2YzYkNjMiJ2Y0QjYhRDNyYzN1MDNycTY&GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk
unknown
html
146 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2276
taskhost.exe
185.26.122.79:80
host1835875.hostland.pro
Hostland LTD
RU
unknown

DNS requests

Domain
IP
Reputation
host1835875.hostland.pro
  • 185.26.122.79
unknown

Threats

PID
Process
Class
Message
2276
taskhost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe