File name: | victor heritage.exe |
Full analysis: | https://app.any.run/tasks/ab4f9fd0-9352-49c6-8357-0d0b64fb8c04 |
Verdict: | Malicious activity |
Threats: | DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim. |
Analysis date: | May 20, 2019, 14:11:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
MD5: | 50DEDC492A6A11CBF8632ED3CA694A70 |
SHA1: | E34719F1B3C82F46C036446E3040443CCC7890C1 |
SHA256: | F25B876C1EA73530D3068844CFD5E36F9ADFB75A209EB5D232869C50A20D7A7D |
SSDEEP: | 24576:D2O/GlbqowJ+WFzZhu+nuQoSyzyLvAbbHUuNpXeOAOwz9FonLW/JwKhKbHofaVGC:bJ9u+uyYyM/HUMVLAOio6RwKUTxz |
.exe | | | Win32 Executable MS Visual C++ (generic) (35.8) |
---|---|---|
.exe | | | Win64 Executable (generic) (31.7) |
.scr | | | Windows screen saver (15) |
.dll | | | Win32 Dynamic Link Library (generic) (7.5) |
.exe | | | Win32 Executable (generic) (5.1) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2012:06:09 15:19:49+02:00 |
PEType: | PE32 |
LinkerVersion: | 9 |
CodeSize: | 74752 |
InitializedDataSize: | 59392 |
UninitializedDataSize: | - |
EntryPoint: | 0xac87 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.0.0.0 |
ProductVersionNumber: | 1.0.0.0 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Dynamic link library |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
FileDescription: | P75DU69VP69L |
OriginalFileName: | W72BT69JT87W |
CompanyName: | N90UB73KP88J |
FileVersion: | F75DF76VE73Q |
LegalCopyright: | G67VD70PG70M |
ProductName: | F74QD83NK76M |
ProductVersion: | 1,0,0,0 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 09-Jun-2012 13:19:49 |
Detected languages: |
|
Debug artifacts: |
|
FileDescription: | P75DU69VP69L |
OriginalFilename: | W72BT69JT87W |
CompanyName: | N90UB73KP88J |
FileVersion: | F75DF76VE73Q |
LegalCopyright: | G67VD70PG70M |
ProductName: | F74QD83NK76M |
ProductVersion: | 1,0,0,0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 09-Jun-2012 13:19:49 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001231E | 0x00012400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.55555 |
.rdata | 0x00014000 | 0x00001D15 | 0x00001E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.99401 |
.data | 0x00016000 | 0x00017724 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.54914 |
.CRT | 0x0002E000 | 0x00000020 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.394141 |
.rsrc | 0x0002F000 | 0x0000C594 | 0x0000C600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.53703 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.20816 | 1464 | Latin 1 / Western European | English - United States | RT_MANIFEST |
7 | 3.24143 | 556 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.26996 | 974 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.04375 | 530 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.16254 | 776 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.06352 | 380 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 2.33959 | 102 | Latin 1 / Western European | English - United States | RT_STRING |
100 | 1.91924 | 20 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
101 | 4.19099 | 2998 | Latin 1 / Western European | English - United States | RT_BITMAP |
ASKNEXTVOL | 3.42597 | 646 | Latin 1 / Western European | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2624 | "C:\Users\admin\AppData\Local\Temp\victor heritage.exe" | C:\Users\admin\AppData\Local\Temp\victor heritage.exe | explorer.exe | |
User: admin Company: N90UB73KP88J Integrity Level: MEDIUM Description: P75DU69VP69L Exit code: 0 Version: F75DF76VE73Q | ||||
3224 | "C:\Users\admin\AppData\Local\Temp\42965311\jie.exe" amv=wvs | C:\Users\admin\AppData\Local\Temp\42965311\jie.exe | — | victor heritage.exe |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
2084 | C:\Users\admin\AppData\Local\Temp\42965311\jie.exe C:\Users\admin\AppData\Local\Temp\42965311\XFNFY | C:\Users\admin\AppData\Local\Temp\42965311\jie.exe | jie.exe | |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
3032 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | jie.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.6.1055.0 built by: NETFXREL2 |
(PID) Process: | (2624) victor heritage.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2624) victor heritage.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2084) jie.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | wertyujhgvcxdfgb.exe |
Value: C:\Users\admin\AppData\Local\Temp\42965311\jie.exe C:\Users\admin\AppData\Local\Temp\42965311\AMV_WV~1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\GuiDateTimePicker.mp3 | text | |
MD5:C6F8F96298CBF40621B414B7C039AD81 | SHA256:EA8161F4145C4841483E06E5A8C78DF35C560D4590765565E6E43D39CF36AAAC | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\lru.pdf | text | |
MD5:053B7ADC71B7A053DDD4170EB648FF12 | SHA256:05FAF0AE3CC06AF944DC1FC1945F32ABAF519F1338D8A80C9C5B0BB09A638BC2 | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\gue.txt | text | |
MD5:6221F9ABE01B96A71A0822B69F2C5599 | SHA256:5A0260AADBBE46DE8B68E0E8A8C074FE72F1285B41EC79213D9DD946C77DF5EE | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\piv.dat | text | |
MD5:27D1498F587A268EB32756DDBFB8EB9A | SHA256:E52E700AD9FB0C9ADF5D6D5ABD3DC68768871ADB9581BE02D43B6B512FEC7E04 | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\cpp.txt | text | |
MD5:6D1CFE6232F91CDB165DB0C37A95E4C9 | SHA256:392C3A3CF145515976B83817B2439CF8631F878D189FCDBD8B17ED5AB25502E5 | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\blg.docx | text | |
MD5:CEAACEF6596E87E1065C0D8E2088D91A | SHA256:F4A05CC97D987A98374B935AEF8EEB5D92B7B3D4B6CAFCD758FEC9A25011AA44 | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\mmo.mp3 | text | |
MD5:CE2E2BF63FE3E8C37AD97DBF53791FA3 | SHA256:75B41AC3AD741FB393852A4162B69548020C4DD6F8D64E6AE4DE9BA9F286D44B | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\uwj.bmp | text | |
MD5:103372B3D0AB777F1535A41ACFDCC41F | SHA256:B07A271D36AB287CFA996FC65EABF199FC8306F19CDB51AB609E2FC663B590AC | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\lnb.xl | text | |
MD5:6945813A059A9DBC2FC0602A5EA59BE5 | SHA256:5DF35A71F7E0E3EB06BB320C9318423614CB779F5A8E2BB0F0D0AF5EFD0EB5B6 | |||
2624 | victor heritage.exe | C:\Users\admin\AppData\Local\Temp\42965311\hkl.dat | text | |
MD5:2F3C1AE37902C5CE85529472E152A754 | SHA256:BA2B123CD95D33EBEBC82C4FE998F56E16F70DF889624048C2A31072355D09C7 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3032 | RegSvcs.exe | 185.247.228.22:1678 | ahiaoguvictor.duckdns.org | — | — | malicious |
3032 | RegSvcs.exe | 105.112.112.70:1678 | ahiaoguvictor.duckdns.org | — | NG | unknown |
Domain | IP | Reputation |
---|---|---|
ahiaoguvictor.duckdns.org |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
3032 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] DarkComet-RAT Inbound connection |
3032 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Backdoor.Win32.DarkKomet!O outbound stream |
3032 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Possible DarkComet-RAT activity |
3032 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Possible DarkComet-RAT activity |
3032 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Possible DarkComet-RAT activity |