Malware analysis TrojanKiller.exe Malicious activity | ANY.RUN

Add for printing

File name:	TrojanKiller.exe
Full analysis:	https://app.any.run/tasks/df3d6e18-7d19-43e5-ba30-101b8ef09acd
Verdict:	Malicious activity
Threats:	DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	September 07, 2024, 11:36:33
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	upx stealer crypto-regex dcrat
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:	4C68D05476A56516544013DDA5BF03F3
SHA1:	7A11CD5107465F06D5C859E1A0EBCF91329DBDEE
SHA256:	FEF9D951A360CA0AD0A5724614A86602FDFA6916DD3E53784BC9FFCDE6F23352
SSDEEP:	49152:NKYOvnnn//vlqBS0+Uyjv5lPxrnqi1f/GZlCebwbH2xhJkPw59LjrBgPFfhh+oHy:NmnS+TrntJUcxj8Jj9Ljr2dfhQogWWzf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Steals credentials from Web Browsers
  - tk64.exe (PID: 6836)
- Actions looks like stealing of personal data
  - tk64.exe (PID: 6836)
- DCRAT has been detected (YARA)
  - tk64.exe (PID: 6836)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - TrojanKiller.exe (PID: 6188)
  - tk.exe (PID: 3292)
  - tk64.exe (PID: 6836)
- Drops 7-zip archiver for unpacking
  - TrojanKiller.exe (PID: 6188)
- Checks Windows Trust Settings
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Executable content was dropped or overwritten
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Process drops legitimate windows executable
  - TrojanKiller.exe (PID: 6188)
- Creates a software uninstall entry
  - TrojanKiller.exe (PID: 6188)
- The process verifies whether the antivirus software is installed
  - tk64.exe (PID: 6836)
- Found regular expressions for crypto-addresses (YARA)
  - tk64.exe (PID: 6836)
- Connects to unusual port
  - tk64.exe (PID: 6836)
- Reads the Windows owner or organization settings
  - tk64.exe (PID: 6836)
- Process requests binary or script from the Internet
  - tk64.exe (PID: 6836)
INFO
- Checks supported languages
  - TrojanKiller.exe (PID: 6188)
  - tk.exe (PID: 3292)
  - tk64.exe (PID: 6836)
- Creates files or folders in the user directory
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Reads CPU info
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Reads the computer name
  - TrojanKiller.exe (PID: 6188)
  - tk.exe (PID: 3292)
  - tk64.exe (PID: 6836)
- Reads the software policy settings
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Create files in a temporary directory
  - TrojanKiller.exe (PID: 6188)
- UPX packer has been detected
  - TrojanKiller.exe (PID: 6188)
- Reads the machine GUID from the registry
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Checks proxy server information
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- Creates files in the program directory
  - TrojanKiller.exe (PID: 6188)
  - tk64.exe (PID: 6836)
- The process uses the downloaded file
  - TrojanKiller.exe (PID: 6188)
  - tk.exe (PID: 3292)
- Process checks computer location settings
  - TrojanKiller.exe (PID: 6188)
  - tk.exe (PID: 3292)
  - tk64.exe (PID: 6836)
- Reads Environment values
  - tk64.exe (PID: 6836)
- Reads product name
  - tk64.exe (PID: 6836)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	UPX compressed Win32 Executable (42.1)
.exe	\|	Win32 EXE Yoda's Crypter (41.3)
.exe	\|	Win32 Executable (generic) (7)
.exe	\|	Win16/32 Executable Delphi generic (3.2)
.exe	\|	Generic Win/DOS Executable (3.1)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2020:11:18 14:17:05+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Removable run from swap, Net run from swap, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	1069056
InitializedDataSize:	122880
UninitializedDataSize:	2854912
EntryPoint:	0x3bec90
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI
FileVersionNumber:	2.1.0.48
ProductVersionNumber:	2.1.0.48
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Dynamic link library
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
ProductName:	Gridinsoft Trojan Killer Web Installer
ProductVersion:	2.1.0
CompanyName:	Gridinsoft LLC
LegalCopyright:	Gridinsoft LLC, 2008
LegalTrademarks:	Gridinsoft
InternalName:	TrojanKillerInstaller
OriginalFileName:	TrojanKillerInstaller.exe
FileVersion:	2.1.0.48
FileDescription:	Trojan Killer Web Installer

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

132

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

3292

"C:\Program Files\Trojan Killer\tk.exe"

C:\Program Files\Trojan Killer\tk.exe

—

TrojanKiller.exe

User:

admin

Company:

Gridinsoft LLC

Integrity Level:

HIGH

Description:

Trojan Killer Portable Launcher

Exit code:

Version:

2.2.107.2124

Modules

Images
c:\program files\trojan killer\tk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

6188

"C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe"

C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe

explorer.exe

User:

admin

Company:

Gridinsoft LLC

Integrity Level:

HIGH

Description:

Trojan Killer Web Installer

Exit code:

Version:

2.1.0.48

Modules

Images
c:\users\admin\appdata\local\temp\trojankiller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

6796

"C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe"

C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe

—

explorer.exe

User:

admin

Company:

Gridinsoft LLC

Integrity Level:

MEDIUM

Description:

Trojan Killer Web Installer

Exit code:

3221226540

Version:

2.1.0.48

Modules

Images
c:\users\admin\appdata\local\temp\trojankiller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

6836

"C:\Program Files\Trojan Killer\tk64.exe"

C:\Program Files\Trojan Killer\tk64.exe

tk.exe

User:

admin

Company:

Gridinsoft LLC

Integrity Level:

HIGH

Description:

Trojan Killer Portable (64-bit)

Version:

2.2.107.2124

Modules

Images
c:\program files\trojan killer\tk64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

23 988

Read events

23 974

Write events

Delete events

Modification events


(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	InstallLocation
Value: C:\Program Files\Trojan Killer
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	DisplayName
Value: Trojan Killer Portable
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	DisplayIcon
Value: C:\Program Files\Trojan Killer\tk.exe,2
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	DisplayVersion
Value: 2.2.107
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	UninstallString
Value: "C:\Program Files\Trojan Killer\tk.exe,2" -uninstall
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	Publisher
Value: Gridinsoft LLC
(PID) Process:	(6188) TrojanKiller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:	write	Name:	HelpLink
Value: https://support-antimalware.com/

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6188	TrojanKiller.exe	C:\Program Files\Trojan Killer\libmem32.dll		executable
		MD5:7C3EF122D03AC4B6CEE51142EE94EBE3	SHA256:9B5405266D666587E81B358AD3692BDA747DEBC990B386B46FE9045DF604C526
6188	TrojanKiller.exe	C:\Program Files\Trojan Killer\libeay86.dll		executable
		MD5:AA03FBC0FF83BFDA7C9AEA7F78FDF2DA	SHA256:F5A7FF7B64E5D09B41EE681E48B9F0382114C57B7BD6134244CDEC4A00416D44
6188	TrojanKiller.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\app[1].json		binary
		MD5:D7960C5E8ACB77E3C885984F7E53C27A	SHA256:9C26B3E86E613CF4AFE9AC3C0171ADE4B471DE9F1F61B418E11AD9480758205D
6188	TrojanKiller.exe	C:\Program Files\Trojan Killer\tk64.exe		executable
		MD5:E5F035E14AA7311B8832D920CE1A0BC2	SHA256:2E58BCB07BAD71F4DD6542FB59FD5615322E6ACC201D646F31F2240FCFC0CBF9
6188	TrojanKiller.exe	C:\Users\admin\AppData\Local\Temp\Z6tKVMrN.8V2		compressed
		MD5:9E7C7236ADA7D68D0A1AD62D1A16347C	SHA256:4C073C17448318A81560E991B3A6B5C3BA8A670F7A601D585F846F9272032158
6188	TrojanKiller.exe	C:\Users\Public\Desktop\Trojan Killer.lnk		binary
		MD5:AFF7BAD02C49C20A310BCE1F65B27FA8	SHA256:3821BEAEBBB0AFBD909F82414E50B72CAE53F07CAA75DD9CF5B64FCD45814381
6188	TrojanKiller.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751		binary
		MD5:3DFCA46E00FFA4795C72A41375F159D3	SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6188	TrojanKiller.exe	C:\Program Files\Trojan Killer\Database\upd104.c		binary
		MD5:860B821D7856EE90E35AA1E82751EC1E	SHA256:E9B76BC10C6E905FD5E90116A0832F565BBD21D02C04685B409D0241992B5E39
6188	TrojanKiller.exe	C:\Program Files\Trojan Killer\ssleay86.dll		executable
		MD5:EE82E12FF89F71141251C03DABAF3380	SHA256:1DDAA3332956929ACF0D9CF114A1A5FC2D0A8A4F787D94390ED3B96C251659B2
6188	TrojanKiller.exe	C:\Program Files\Trojan Killer\tk32.exe		executable
		MD5:62E1E097848E8043D9D9D344B5D67E2E	SHA256:EC049620799019B2996EF5AC9C54003B2E784300B6E448386A83FEB4EDFBFDFB

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7132	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1932	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6836	tk64.exe	GET	200	192.237.188.201:80	http://update1.trojan-killer.com/app.json?ver=2.2.107	unknown	—	—	unknown
6836	tk64.exe	POST	—	192.237.188.201:80	http://bind.trojan-killer.com/stats/?p=5&v=2.2.107&a=TrojanKiller%2Eexe	unknown	—	—	unknown
7132	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
6836	tk64.exe	GET	200	192.237.188.201:80	http://update1.trojan-killer.com/app.json?ver=2.2.107	unknown	—	—	unknown
6836	tk64.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl	unknown	—	—	whitelisted
6836	tk64.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl	unknown	—	—	whitelisted
6836	tk64.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTjzY2p9Pa8oibmj%2BNSMWsz63kmWgQUuhbZbU2FL3MpdpovdYxqII%2BeyG8CEAxNaXJLlPo8Kko9KQeAPVo%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
6232	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2120	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
6188	TrojanKiller.exe	192.237.188.201:443	update1.trojan-killer.com	RACKSPACE	US	suspicious
3260	svchost.exe	40.113.103.199:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1932	svchost.exe	40.126.32.74:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1932	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
2120	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 40.127.240.158 20.73.194.208	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
google.com	142.250.185.110	whitelisted
update1.trojan-killer.com	192.237.188.201	unknown
client.wns.windows.com	40.113.103.199	whitelisted
login.live.com	40.126.32.74 40.126.32.72 20.190.160.14 40.126.32.138 40.126.32.68 40.126.32.76 20.190.160.22 20.190.160.20	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
slscr.update.microsoft.com	40.127.169.103	whitelisted
s1.am.gridinsoft.com	165.227.52.218	unknown
fe3cr.delivery.mp.microsoft.com	20.166.126.56	whitelisted

Threats

PID	Process	Class	Message
6836	tk64.exe	Misc activity	ET POLICY GridinSoft.com Software Version Check
6836	tk64.exe	Misc activity	ET POLICY GridinSoft.com Software Version Check
6836	tk64.exe	Misc activity	ET POLICY GridinSoft.com Software Version Check

Add for printing

No debug info

General Info

TrojanKiller.exe

4C68D05476A56516544013DDA5BF03F3

7A11CD5107465F06D5C859E1A0EBCF91329DBDEE

FEF9D951A360CA0AD0A5724614A86602FDFA6916DD3E53784BC9FFCDE6F23352

49152:NKYOvnnn//vlqBS0+Uyjv5lPxrnqi1f/GZlCebwbH2xhJkPw59LjrBgPFfhh+oHy:NmnS+TrntJUcxj8Jj9Ljr2dfhQogWWzf

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Steals credentials from Web Browsers

Actions looks like stealing of personal data

DCRAT has been detected (YARA)

SUSPICIOUS

Reads security settings of Internet Explorer

Drops 7-zip archiver for unpacking

Checks Windows Trust Settings

Executable content was dropped or overwritten

Process drops legitimate windows executable

Creates a software uninstall entry

The process verifies whether the antivirus software is installed

Found regular expressions for crypto-addresses (YARA)

Connects to unusual port

Reads the Windows owner or organization settings

Process requests binary or script from the Internet

INFO

Checks supported languages

Creates files or folders in the user directory

Reads CPU info

Reads the computer name

Reads the software policy settings

Create files in a temporary directory

UPX packer has been detected

Reads the machine GUID from the registry

Checks proxy server information

Creates files in the program directory

The process uses the downloaded file

Process checks computer location settings

Reads Environment values

Reads product name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings