File name:

Darktrack RAT v4.1 Alien+ By LuckyDuck.rar

Full analysis: https://app.any.run/tasks/4daafbb3-463d-45a5-91ae-0b9592be4092
Verdict: Malicious activity
Analysis date: August 13, 2020, 07:53:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

2961AD8237A5D1FA40FE9DD1A6342BC5

SHA1:

C8DC16788909D8C9419073E01FA848CC0D3D14D9

SHA256:

CD2EF5C1B294C64B203127B02109F167E7F69F221F334D883C81B6A007AD5DBD

SSDEEP:

393216:AOHqoZMMyts7sIfNj8IoOhXOS1P1W3lPeMAw4L:AOH1Z3sIfGIBXOS1P03wLw4L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3464)
      • Darktrack 4.1 Beta.exe (PID: 2420)

    • Application was dropped or rewritten from another process

      • Darktrack 4.1 Beta.exe (PID: 2420)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3436)

  • INFO

    • Manual execution by user

      • Darktrack 4.1 Beta.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 289108
UncompressedSize: 290304
OperatingSystem: Win32
ModifyDate: 2010:09:09 00:07:00
PackingMethod: Normal
ArchivedFileName: DarkTrack Alien 4.1\Compressors\upx.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe darktrack 4.1 beta.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2420"C:\Users\admin\Desktop\DarkTrack Alien 4.1\Darktrack 4.1 Beta.exe" C:\Users\admin\Desktop\DarkTrack Alien 4.1\Darktrack 4.1 Beta.exe—explorer.exe
User:
admin
Company:
Darktrack
Integrity Level:
MEDIUM
Description:
Remote Administration Tool
Exit code:
0
Version:
4.0.0.0
Modules
Images
c:\users\admin\desktop\darktrack alien 4.1\darktrack 4.1 beta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3436"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Darktrack RAT v4.1 Alien+ By LuckyDuck.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
845
Read events
834
Write events
11
Delete events
0

Modification events

(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3436) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3436) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Darktrack RAT v4.1 Alien+ By LuckyDuck.rar
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
8
Suspicious files
0
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\settings.initext
MD5:—
SHA256:—
2420Darktrack 4.1 Beta.exeC:\Users\admin\Desktop\DarkTrack Alien 4.1\settings.initext
MD5:—
SHA256:—
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\stub\stub.exeexecutable
MD5:—
SHA256:—
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\sqlite3.dllexecutable
MD5:A2EBA4B5199074DBE91FAE77E1050D8A
SHA256:629FD65A87D6D08503E45348ECC7C337F4921F35E47356E8FAB6F3007039C280
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\Mescaline File Binder\Mescaline Multi File Binder.exeexecutable
MD5:4580BC445DFAD7D046E7440B1C179C33
SHA256:80EB6C0204241543F26412C21AF9B8D9BC89C20DC24F2D2EFFF4D674C9E6F350
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\Modules\ffmpeg.exeexecutable
MD5:F25EEF8A89531E8A78340B2A682D6047
SHA256:1ABEE4A7DBE8F624290054C14EF7B58DB19E93DF976C2ADB8FF4BD20974C3A78
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\Compressors\upx.exeexecutable
MD5:308F709A8F01371A6DD088A793E65A5F
SHA256:C0F9FAFFDF14AB2C853880457BE19A237B10F8986755F184ECFE21670076CB35
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\Data\DataBase.dbsqlite
MD5:CA5749D6BC67E67F2369C2A47F26E9FD
SHA256:B974AA3BBF8569EAD530978778DB835F34FE9E107A39B77BA4E63FD500F88ED4
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\Plugins\sqlite3.dllexecutable
MD5:744DCC4CBBFBB18FE3878C4E769EC48F
SHA256:33EB31A2A576E663474A895FF0190316C64A93D9CE05A55DF0D53F9BEEB61163
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3436.6488\DarkTrack Alien 4.1\sqlite3Reader.dllexecutable
MD5:744DCC4CBBFBB18FE3878C4E769EC48F
SHA256:33EB31A2A576E663474A895FF0190316C64A93D9CE05A55DF0D53F9BEEB61163
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Darktrack RAT v4.1 Alien+ By LuckyDuck.rar