File name: | SQL Server.exe |
Full analysis: | https://app.any.run/tasks/2b3e5bb4-da88-43fa-a51b-8f51b4cefe0c |
Verdict: | Malicious activity |
Threats: | DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim. |
Analysis date: | October 04, 2022, 19:43:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 5621A1A475AAC822F7A56C93AB65F6C9 |
SHA1: | 6FB1D586F70B6D123B96F4D8901233ED8B8ADE92 |
SHA256: | BBC6486837B468D925394A9A14AAE39C75FBDE0E1C8FF087E33ECAEC00FB3C92 |
SSDEEP: | 6144:rXX3o41k5ebqlP2jYEQxHjXc0kpKn/gRjMUPNfL7aWUkeJHtSWI4:r5bqlPdxjMFMUPNf/aWvC0+ |
.exe | | | Win32 Executable Borland Delphi 7 (97.4) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (0.9) |
.exe | | | Win32 Executable (generic) (0.6) |
.exe | | | Win16/32 Executable Delphi generic (0.3) |
.exe | | | Generic Win/DOS Executable (0.2) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 1992-Jun-19 22:22:17 |
Detected languages: |
|
Comments: | Remote Service Application |
CompanyName: | Microsoft Corp. |
FileDescription: | Remote Service Application |
FileVersion: | 1, 0, 0, 1 |
InternalName: | MSRSAAPP |
LegalCopyright: | Copyright (C) 1999 |
OriginalFilename: | MSRSAAP.EXE |
ProductName: | Remote Service Application |
ProductVersion: | 4, 0, 0, 0 |
e_magic: | MZ |
---|---|
e_cblp: | 80 |
e_cp: | 2 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | 15 |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | 26 |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 256 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 8 |
TimeDateStamp: | 1992-Jun-19 22:22:17 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
CODE | 4096 | 28388 | 28672 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.47734 |
DATA | 32768 | 516 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.68963 |
BSS | 36864 | 6393 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.idata | 45056 | 2032 | 2048 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.46857 |
.tls | 49152 | 8 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rdata | 53248 | 24 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.204488 |
.reloc | 57344 | 2308 | 2560 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 6.38701 |
.rsrc | 61440 | 7484 | 7680 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 3.88274 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.563 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
2 | 3.03265 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 3.3171 | 224 | Latin 1 / Western European | English - United States | RT_STRING |
1 (#2) | 3.61237 | 548 | Latin 1 / Western European | English - United States | RT_STRING |
2 (#2) | 3.63234 | 628 | Latin 1 / Western European | English - United States | RT_STRING |
DVCLAL | 4 | 16 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
PACKAGEINFO | 4.25693 | 92 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
MAINICON | 2.32824 | 34 | Latin 1 / Western European | English - United States | RT_GROUP_ICON |
1 (#3) | 1.95128 | 1716 | Latin 1 / Western European | UNKNOWN | RT_VERSION |
advapi32.dll |
gdi32.dll |
kernel32.dll |
kernel32.dll (#2) |
kernel32.dll (#3) |
kernel32.dll (#4) |
oleaut32.dll |
user32.dll |
user32.dll (#2) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3252 | "C:\Users\admin\AppData\Local\Temp\SQL Server.exe" | C:\Users\admin\AppData\Local\Temp\SQL Server.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corp. Integrity Level: MEDIUM Description: Remote Service Application Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
1936 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1192 | "C:\Users\admin\AppData\Local\Temp\SQL Server.exe" | C:\Users\admin\AppData\Local\Temp\SQL Server.exe | SQL Server.exe | ||||||||||||
User: admin Company: Microsoft Corp. Integrity Level: MEDIUM Description: Remote Service Application Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
1244 | "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\admin\AppData\Local\Temp\SQL Server.exe" +s +h | C:\Windows\System32\cmd.exe | — | SQL Server.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
292 | "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\admin\AppData\Local\Temp" +s +h | C:\Windows\System32\cmd.exe | — | SQL Server.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3668 | notepad | C:\Windows\system32\notepad.exe | — | SQL Server.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
288 | attrib "C:\Users\admin\AppData\Local\Temp\SQL Server.exe" +s +h | C:\Windows\system32\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
4056 | attrib "C:\Users\admin\AppData\Local\Temp" +s +h | C:\Windows\system32\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2396 | "C:\Users\admin\Documents\MSDCSC\msdcsc.exe" | C:\Users\admin\Documents\MSDCSC\msdcsc.exe | — | SQL Server.exe | |||||||||||
User: admin Company: Microsoft Corp. Integrity Level: MEDIUM Description: Remote Service Application Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
2264 | "C:\Users\admin\Documents\MSDCSC\msdcsc.exe" | C:\Users\admin\Documents\MSDCSC\msdcsc.exe | msdcsc.exe | ||||||||||||
User: admin Company: Microsoft Corp. Integrity Level: MEDIUM Description: Remote Service Application Version: 1, 0, 0, 1 Modules
DarkComet(PID) Process(2264) msdcsc.exe Offline keyloggerTrue PERS1 CHIDED1 CHIDEF1 SH41 SH11 MSGICON16 MSGCORE44697374726962757461626C6573206E6F7420666F756E642021 MSGTITLEError FAKEMSG1 File attrubutesTrue Directory attributesTrue Change Date1 MELT1 PersistanceTrue Edit date2007-04-16 Registry keyMicroUpdate Install pathMSDCSC\msdcsc.exe COMBOPATH7 InstallTrue gencodeNf0wsx6QY9sq FWB0 sidVictim MutexDC_MUTEX-CYNCSGL Version#KCMDDC51# C2 (3)192.168.0.8:6969 rtts.ddns.net:6969 127.0.0.1:6969 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1192 | SQL Server.exe | C:\Users\admin\Documents\MSDCSC\msdcsc.exe | executable | |
MD5:5621A1A475AAC822F7A56C93AB65F6C9 | SHA256:BBC6486837B468D925394A9A14AAE39C75FBDE0E1C8FF087E33ECAEC00FB3C92 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2264 | msdcsc.exe | 185.223.169.220:6969 | rtts.ddns.net | Andridan-Impex SRL | MD | unknown |
— | — | 192.168.100.182:56663 | — | — | — | malicious |
— | — | 192.168.100.182:57301 | — | — | — | malicious |
— | — | 192.168.100.182:57959 | — | — | — | malicious |
— | — | 185.223.169.220:6969 | rtts.ddns.net | Andridan-Impex SRL | MD | unknown |
Domain | IP | Reputation |
---|---|---|
rtts.ddns.net |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
— | — | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |