analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

victor heritage.exe

Full analysis: https://app.any.run/tasks/ab4f9fd0-9352-49c6-8357-0d0b64fb8c04
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Analysis date: May 20, 2019, 14:11:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
trojan
rat
darkcomet
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5:

50DEDC492A6A11CBF8632ED3CA694A70

SHA1:

E34719F1B3C82F46C036446E3040443CCC7890C1

SHA256:

F25B876C1EA73530D3068844CFD5E36F9ADFB75A209EB5D232869C50A20D7A7D

SSDEEP:

24576:D2O/GlbqowJ+WFzZhu+nuQoSyzyLvAbbHUuNpXeOAOwz9FonLW/JwKhKbHofaVGC:bJ9u+uyYyM/HUMVLAOio6RwKUTxz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • jie.exe (PID: 2084)
    • Application was dropped or rewritten from another process

      • jie.exe (PID: 2084)
      • jie.exe (PID: 3224)
    • DARKCOMET was detected

      • RegSvcs.exe (PID: 3032)
  • SUSPICIOUS

    • Drop AutoIt3 executable file

      • victor heritage.exe (PID: 2624)
    • Executable content was dropped or overwritten

      • victor heritage.exe (PID: 2624)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • victor heritage.exe (PID: 2624)
      • jie.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:06:09 15:19:49+02:00
PEType: PE32
LinkerVersion: 9
CodeSize: 74752
InitializedDataSize: 59392
UninitializedDataSize: -
EntryPoint: 0xac87
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: P75DU69VP69L
OriginalFileName: W72BT69JT87W
CompanyName: N90UB73KP88J
FileVersion: F75DF76VE73Q
LegalCopyright: G67VD70PG70M
ProductName: F74QD83NK76M
ProductVersion: 1,0,0,0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 09-Jun-2012 13:19:49
Detected languages:
  • English - United States
  • Process Default Language
Debug artifacts:
  • d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
FileDescription: P75DU69VP69L
OriginalFilename: W72BT69JT87W
CompanyName: N90UB73KP88J
FileVersion: F75DF76VE73Q
LegalCopyright: G67VD70PG70M
ProductName: F74QD83NK76M
ProductVersion: 1,0,0,0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 09-Jun-2012 13:19:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001231E
0x00012400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55555
.rdata
0x00014000
0x00001D15
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.99401
.data
0x00016000
0x00017724
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.54914
.CRT
0x0002E000
0x00000020
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.394141
.rsrc
0x0002F000
0x0000C594
0x0000C600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.53703

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20816
1464
Latin 1 / Western European
English - United States
RT_MANIFEST
7
3.24143
556
Latin 1 / Western European
English - United States
RT_STRING
8
3.26996
974
Latin 1 / Western European
English - United States
RT_STRING
9
3.04375
530
Latin 1 / Western European
English - United States
RT_STRING
10
3.16254
776
Latin 1 / Western European
English - United States
RT_STRING
11
3.06352
380
Latin 1 / Western European
English - United States
RT_STRING
12
2.33959
102
Latin 1 / Western European
English - United States
RT_STRING
100
1.91924
20
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
101
4.19099
2998
Latin 1 / Western European
English - United States
RT_BITMAP
ASKNEXTVOL
3.42597
646
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start victor heritage.exe jie.exe no specs jie.exe #DARKCOMET regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2624"C:\Users\admin\AppData\Local\Temp\victor heritage.exe" C:\Users\admin\AppData\Local\Temp\victor heritage.exe
explorer.exe
User:
admin
Company:
N90UB73KP88J
Integrity Level:
MEDIUM
Description:
P75DU69VP69L
Exit code:
0
Version:
F75DF76VE73Q
3224"C:\Users\admin\AppData\Local\Temp\42965311\jie.exe" amv=wvs C:\Users\admin\AppData\Local\Temp\42965311\jie.exevictor heritage.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
2084C:\Users\admin\AppData\Local\Temp\42965311\jie.exe C:\Users\admin\AppData\Local\Temp\42965311\XFNFYC:\Users\admin\AppData\Local\Temp\42965311\jie.exe
jie.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
3032"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
jie.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
394
Read events
388
Write events
6
Delete events
0

Modification events

(PID) Process:(2624) victor heritage.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2624) victor heritage.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2084) jie.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:wertyujhgvcxdfgb.exe
Value:
C:\Users\admin\AppData\Local\Temp\42965311\jie.exe C:\Users\admin\AppData\Local\Temp\42965311\AMV_WV~1
Executable files
1
Suspicious files
0
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\GuiDateTimePicker.mp3text
MD5:C6F8F96298CBF40621B414B7C039AD81
SHA256:EA8161F4145C4841483E06E5A8C78DF35C560D4590765565E6E43D39CF36AAAC
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\lru.pdftext
MD5:053B7ADC71B7A053DDD4170EB648FF12
SHA256:05FAF0AE3CC06AF944DC1FC1945F32ABAF519F1338D8A80C9C5B0BB09A638BC2
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\gue.txttext
MD5:6221F9ABE01B96A71A0822B69F2C5599
SHA256:5A0260AADBBE46DE8B68E0E8A8C074FE72F1285B41EC79213D9DD946C77DF5EE
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\piv.dattext
MD5:27D1498F587A268EB32756DDBFB8EB9A
SHA256:E52E700AD9FB0C9ADF5D6D5ABD3DC68768871ADB9581BE02D43B6B512FEC7E04
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\cpp.txttext
MD5:6D1CFE6232F91CDB165DB0C37A95E4C9
SHA256:392C3A3CF145515976B83817B2439CF8631F878D189FCDBD8B17ED5AB25502E5
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\blg.docxtext
MD5:CEAACEF6596E87E1065C0D8E2088D91A
SHA256:F4A05CC97D987A98374B935AEF8EEB5D92B7B3D4B6CAFCD758FEC9A25011AA44
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\mmo.mp3text
MD5:CE2E2BF63FE3E8C37AD97DBF53791FA3
SHA256:75B41AC3AD741FB393852A4162B69548020C4DD6F8D64E6AE4DE9BA9F286D44B
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\uwj.bmptext
MD5:103372B3D0AB777F1535A41ACFDCC41F
SHA256:B07A271D36AB287CFA996FC65EABF199FC8306F19CDB51AB609E2FC663B590AC
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\lnb.xltext
MD5:6945813A059A9DBC2FC0602A5EA59BE5
SHA256:5DF35A71F7E0E3EB06BB320C9318423614CB779F5A8E2BB0F0D0AF5EFD0EB5B6
2624victor heritage.exeC:\Users\admin\AppData\Local\Temp\42965311\hkl.dattext
MD5:2F3C1AE37902C5CE85529472E152A754
SHA256:BA2B123CD95D33EBEBC82C4FE998F56E16F70DF889624048C2A31072355D09C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
9
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3032
RegSvcs.exe
185.247.228.22:1678
ahiaoguvictor.duckdns.org
malicious
3032
RegSvcs.exe
105.112.112.70:1678
ahiaoguvictor.duckdns.org
NG
unknown

DNS requests

Domain
IP
Reputation
ahiaoguvictor.duckdns.org
  • 105.112.112.70
  • 185.247.228.22
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3032
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] DarkComet-RAT Inbound connection
3032
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32.DarkKomet!O outbound stream
3032
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible DarkComet-RAT activity
3032
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible DarkComet-RAT activity
3032
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible DarkComet-RAT activity
13 ETPRO signatures available at the full report
No debug info