File name:

HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe

Full analysis: https://app.any.run/tasks/5a321c33-38f5-4ee8-82d0-8949a7715efd
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 05, 2023, 16:16:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5D329190630C5C051E1B2C4AD4C69ABD

SHA1:

0227D4E1597CA90477CAD5FC3A960F3590457031

SHA256:

6974F159CB6E056FD9675EC4ECB6D271A7D6BB69711A295BE593091D3BCB9E45

SSDEEP:

49152:cFrKj5Ge6AB8lQrSNrRhk5IF3ajBAX5uefILAxe:cFrKdc05IF3aqfILAQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 284)

    • Drops the executable file immediately after the start

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • hui.exe (PID: 1612)

    • Changes the login/logoff helper path in the registry

      • hui.exe (PID: 1612)

    • Creates a writable file the system directory

      • hui.exe (PID: 1612)

    • Changes the autorun value in the registry

      • hui.exe (PID: 1612)

    • DCRAT has been detected (SURICATA)

      • taskhost.exe (PID: 2276)

  • SUSPICIOUS

    • Reads the Internet Settings

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • wscript.exe (PID: 284)
      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 284)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 284)
      • hui.exe (PID: 1612)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 284)
      • hui.exe (PID: 1612)

    • Executed via WMI

      • schtasks.exe (PID: 2476)
      • schtasks.exe (PID: 1784)
      • schtasks.exe (PID: 2120)
      • schtasks.exe (PID: 2820)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 2660)
      • schtasks.exe (PID: 2452)
      • schtasks.exe (PID: 2152)

    • The process creates files with name similar to system file names

      • hui.exe (PID: 1612)

    • Creates executable files that already exist in Windows

      • hui.exe (PID: 1612)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2488)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2488)

  • INFO

    • Checks supported languages

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • hui.exe (PID: 1612)
      • chcp.com (PID: 1680)
      • taskhost.exe (PID: 2276)

    • Reads the computer name

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)
      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Creates files or folders in the user directory

      • HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe (PID: 2380)

    • The executable file from the user directory is run by the CMD process

      • hui.exe (PID: 1612)

    • Reads Environment values

      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Reads the machine GUID from the registry

      • hui.exe (PID: 1612)
      • taskhost.exe (PID: 2276)

    • Create files in a temporary directory

      • hui.exe (PID: 1612)

    • Creates files in the program directory

      • hui.exe (PID: 1612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 19:00:55+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 231936
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
17
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start heur-backdoor.msil.lightstone.gen-6974f159cb6.exe wscript.exe no specs cmd.exe no specs hui.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT taskhost.exe heur-backdoor.msil.lightstone.gen-6974f159cb6.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Adobe\sN8j8UtUmLUEbzv.vbe" C:\Windows\SysWOW64\wscript.exe—HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1480w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1612"C:\Users\admin\AppData\Roaming\Adobe\hui.exe"C:\Users\admin\AppData\Roaming\Adobe\hui.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.132.56703
Modules
Images
c:\users\admin\appdata\roaming\adobe\hui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
1628schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDINTAM\taskhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1680chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1784schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0100-0412-1000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2120schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\vcomp140\winlogon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2152schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\taskhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2276"C:\Windows\System32\KBDINTAM\taskhost.exe" C:\Windows\System32\KBDINTAM\taskhost.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.132.56703
Modules
Images
c:\windows\system32\kbdintam\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
2380"C:\Users\admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe" C:\Users\admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\heur-backdoor.msil.lightstone.gen-6974f159cb6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 890
Read events
2 854
Write events
36
Delete events
0

Modification events

(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2380) HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(284) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1612) hui.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe
(PID) Process:(1612) hui.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\found.000\hui.exe"
Executable files
9
Suspicious files
1
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
1612hui.exeC:\ProgramData\Oracle\Java\javapath\services.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\found.000\f2164dc19afefe692c19df494576dbe29d2a7d0dtext
MD5:83BDBC54283B6A759FC990CB88561D1C
SHA256:69485A24C75ACFB4D92B5C7C47B70C71D7E5C074DCB0ED49B02B02C92E563852
1612hui.exeC:\found.000\hui.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\Windows\System32\vcomp140\winlogon.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
2380HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exeC:\Users\admin\AppData\Roaming\Adobe\hui.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\ProgramData\Oracle\Java\javapath\c5b4cb5e9653cce737f29f72ba880dd4c4bab27dtext
MD5:DF14FEDF5018D28032C49476A92593B6
SHA256:066EBD4A99DD18865AC82CCBAED2D60ED5506FAEF46C4E262FB66BDD8EF06DDC
1612hui.exeC:\MSOCache\All Users\{90140000-0100-0412-1000-0000000FF1CE}-C\088424020bedd6b28ac7fd22ee35dcd7322895cetext
MD5:E24D36F94FE542154E551393E5300F34
SHA256:9A54B0A2D37C25C8346D5B0E7C17FD9F82ED610CA682794DF2859B3D51DE781F
1612hui.exeC:\MSOCache\All Users\{90140000-0100-0412-1000-0000000FF1CE}-C\conhost.exeexecutable
MD5:1B46DAD7064609344351AC9EFE3F9AAB
SHA256:3BD60F927E3882940077FA527712E5C55A2767564B39A932C4D4941E190A4C81
1612hui.exeC:\Users\admin\AppData\Local\Temp\3D23NrKCWdtext
MD5:51CA7D514CA41301AE9AE377509C648B
SHA256:AA50C15AAEEE5D2105EA3245A76604ACB3906325C33BFE9872273F2BA0801A23
1612hui.exeC:\Windows\System32\KBDINTAM\b75386f1303e64d8139363b71e44ac16341adf4etext
MD5:7A371B326D3FBE11F83D36CABACCD657
SHA256:2A1ACAC306D846D1C9DCEB184AA61F053FDA64500224F2811434F8C2F63B8EFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2276
taskhost.exe
GET
404
185.26.122.79:80
http://host1835875.hostland.pro/Lowlongpolltest.php?GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk&3998e4b767cc58057b788963dc557b0a=79a349ba785d906a76eb09f6c1191279&a186b4e8b8ab60f6ea84885b889965cc=QYmZGN2AjM0ATO3gTOwIjY2YzYkNjMiJ2Y0QjYhRDNyYzN1MDNycTY&GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk
unknown
html
146 b
unknown
2276
taskhost.exe
GET
404
185.26.122.79:80
http://host1835875.hostland.pro/Lowlongpolltest.php?GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk&3998e4b767cc58057b788963dc557b0a=79a349ba785d906a76eb09f6c1191279&a186b4e8b8ab60f6ea84885b889965cc=QYmZGN2AjM0ATO3gTOwIjY2YzYkNjMiJ2Y0QjYhRDNyYzN1MDNycTY&GNwOuq8R1=XWo8IsmYMDB3ytgG&NDC0SKfNvdG8BAyS=UjoBTIVRrBONZCroNvOymELIuXPfa&CNk3Y7b=34qikJQAVaZUxPk
unknown
html
146 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2276
taskhost.exe
185.26.122.79:80
host1835875.hostland.pro
Hostland LTD
RU
unknown

DNS requests

Domain
IP
Reputation
host1835875.hostland.pro
  • 185.26.122.79
unknown

Threats

PID
Process
Class
Message
2276
taskhost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe