File name:

6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe

Full analysis: https://app.any.run/tasks/c25d5534-305c-40b8-9182-91d8cd17d2fc
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Malware Trends Tracker     >>>
Analysis date: December 13, 2024, 13:21:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
darkcomet
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

F6351DA84168D40FAE8DA0C156FBAB0F

SHA1:

1A2283C85BC5C655F5F2F77F27EC3A9412E8DB7E

SHA256:

6D34DED00C0DA9887BA752872093F59C649DE72A1F629A32014F5ED8BE509363

SSDEEP:

12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hn:qZ1xuVVjfFoynPaVBUR8f+kN10EBV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)
      • runddl32.exe (PID: 6628)

    • Changes the login/logoff helper path in the registry

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • DARKCOMET has been detected (YARA)

      • runddl32.exe (PID: 6628)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • Reads security settings of Internet Explorer

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • Starts CMD.EXE for commands execution

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 6476)
      • cmd.exe (PID: 6464)

    • Starts itself from another location

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • Start notepad (likely ransomware note)

      • runddl32.exe (PID: 6628)

    • There is functionality for taking screenshot (YARA)

      • runddl32.exe (PID: 6628)

    • There is functionality for communication over UDP network (YARA)

      • runddl32.exe (PID: 6628)

  • INFO

    • Create files in a temporary directory

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • Reads the computer name

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)
      • runddl32.exe (PID: 6628)

    • Checks supported languages

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)
      • runddl32.exe (PID: 6628)

    • The sample compiled with english language support

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)

    • Process checks computer location settings

      • 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe (PID: 6412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (31.9)
.scr | Windows screen saver (29.4)
.dll | Win32 Dynamic Link Library (generic) (14.8)
.exe | Win32 Executable (generic) (10.1)
.exe | Win16/32 Executable Delphi generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:06:07 15:59:53+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 586752
InitializedDataSize: 86528
UninitializedDataSize: -
EntryPoint: 0x8f888
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.0.0.0
ProductVersionNumber: 4.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Remote Service Application
CompanyName: Microsoft Corp.
FileDescription: Remote Service Application
FileVersion: 1, 0, 0, 1
InternalName: MSRSAAPP
LegalCopyright: Copyright (C) 1999
OriginalFileName: MSRSAAP.EXE
ProductName: Remote Service Application
ProductVersion: 4, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs #DARKCOMET runddl32.exe notepad.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6412"C:\Users\admin\Desktop\6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe" C:\Users\admin\Desktop\6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
explorer.exe
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
Remote Service Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6464"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\admin\Desktop\6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe" +s +hC:\Windows\SysWOW64\cmd.exe—6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6476"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\admin\Desktop" +s +hC:\Windows\SysWOW64\cmd.exe—6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6484\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6504\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6576attrib "C:\Users\admin\Desktop" +s +hC:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6584attrib "C:\Users\admin\Desktop\6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe" +s +hC:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6628"C:\Users\admin\AppData\Local\Temp\MSDCSC\runddl32.exe" C:\Users\admin\AppData\Local\Temp\MSDCSC\runddl32.exe
6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
Remote Service Application
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\msdcsc\runddl32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6660notepadC:\Windows\SysWOW64\notepad.exe—runddl32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
Total events
1 822
Read events
1 803
Write events
19
Delete events
0

Modification events

(PID) Process:(6412) 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicroUpdate
Value:
C:\Users\admin\AppData\Local\Temp\MSDCSC\runddl32.exe
(PID) Process:(6412) 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:UserInit
Value:
C:\Windows\system32\userinit.exe,C:\Users\admin\AppData\Local\Temp\MSDCSC\runddl32.exe
(PID) Process:(6412) 6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6628) runddl32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicroUpdate
Value:
C:\Users\admin\AppData\Local\Temp\MSDCSC\runddl32.exe
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
64126d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exeC:\Users\admin\AppData\Local\Temp\MSDCSC\runddl32.exeexecutable
MD5:F6351DA84168D40FAE8DA0C156FBAB0F
SHA256:6D34DED00C0DA9887BA752872093F59C649DE72A1F629A32014F5ED8BE509363
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
19
DNS requests
37
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
488
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
488
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
488
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
488
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
488
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
488
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
test213.no-ip.info
  • —
unknown
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 40.79.197.34
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe