File name:

TrojanKiller.exe

Full analysis: https://app.any.run/tasks/df3d6e18-7d19-43e5-ba30-101b8ef09acd
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: September 07, 2024, 11:36:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
stealer
crypto-regex
dcrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

4C68D05476A56516544013DDA5BF03F3

SHA1:

7A11CD5107465F06D5C859E1A0EBCF91329DBDEE

SHA256:

FEF9D951A360CA0AD0A5724614A86602FDFA6916DD3E53784BC9FFCDE6F23352

SSDEEP:

49152:NKYOvnnn//vlqBS0+Uyjv5lPxrnqi1f/GZlCebwbH2xhJkPw59LjrBgPFfhh+oHy:NmnS+TrntJUcxj8Jj9Ljr2dfhQogWWzf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • tk64.exe (PID: 6836)

    • Steals credentials from Web Browsers

      • tk64.exe (PID: 6836)

    • DCRAT has been detected (YARA)

      • tk64.exe (PID: 6836)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • TrojanKiller.exe (PID: 6188)
      • tk.exe (PID: 3292)
      • tk64.exe (PID: 6836)

    • Checks Windows Trust Settings

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • Executable content was dropped or overwritten

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • Process drops legitimate windows executable

      • TrojanKiller.exe (PID: 6188)

    • Creates a software uninstall entry

      • TrojanKiller.exe (PID: 6188)

    • Drops 7-zip archiver for unpacking

      • TrojanKiller.exe (PID: 6188)

    • The process verifies whether the antivirus software is installed

      • tk64.exe (PID: 6836)

    • Process requests binary or script from the Internet

      • tk64.exe (PID: 6836)

    • Connects to unusual port

      • tk64.exe (PID: 6836)

    • Found regular expressions for crypto-addresses (YARA)

      • tk64.exe (PID: 6836)

    • Reads the Windows owner or organization settings

      • tk64.exe (PID: 6836)

  • INFO

    • Checks supported languages

      • TrojanKiller.exe (PID: 6188)
      • tk.exe (PID: 3292)
      • tk64.exe (PID: 6836)

    • Creates files or folders in the user directory

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • Checks proxy server information

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • Reads CPU info

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • Reads the software policy settings

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • Create files in a temporary directory

      • TrojanKiller.exe (PID: 6188)

    • Reads the machine GUID from the registry

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • UPX packer has been detected

      • TrojanKiller.exe (PID: 6188)

    • Reads the computer name

      • TrojanKiller.exe (PID: 6188)
      • tk.exe (PID: 3292)
      • tk64.exe (PID: 6836)

    • Creates files in the program directory

      • TrojanKiller.exe (PID: 6188)
      • tk64.exe (PID: 6836)

    • The process uses the downloaded file

      • TrojanKiller.exe (PID: 6188)
      • tk.exe (PID: 3292)

    • Process checks computer location settings

      • TrojanKiller.exe (PID: 6188)
      • tk.exe (PID: 3292)
      • tk64.exe (PID: 6836)

    • Reads Environment values

      • tk64.exe (PID: 6836)

    • Reads product name

      • tk64.exe (PID: 6836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (42.1)
.exe | Win32 EXE Yoda's Crypter (41.3)
.exe | Win32 Executable (generic) (7)
.exe | Win16/32 Executable Delphi generic (3.2)
.exe | Generic Win/DOS Executable (3.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:18 14:17:05+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Removable run from swap, Net run from swap, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 1069056
InitializedDataSize: 122880
UninitializedDataSize: 2854912
EntryPoint: 0x3bec90
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.48
ProductVersionNumber: 2.1.0.48
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Gridinsoft Trojan Killer Web Installer
ProductVersion: 2.1.0
CompanyName: Gridinsoft LLC
LegalCopyright: Gridinsoft LLC, 2008
LegalTrademarks: Gridinsoft
InternalName: TrojanKillerInstaller
OriginalFileName: TrojanKillerInstaller.exe
FileVersion: 2.1.0.48
FileDescription: Trojan Killer Web Installer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT trojankiller.exe tk.exe no specs THREAT tk64.exe trojankiller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3292"C:\Program Files\Trojan Killer\tk.exe" C:\Program Files\Trojan Killer\tk.exe—TrojanKiller.exe
User:
admin
Company:
Gridinsoft LLC
Integrity Level:
HIGH
Description:
Trojan Killer Portable Launcher
Exit code:
0
Version:
2.2.107.2124
Modules
Images
c:\program files\trojan killer\tk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6188"C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe" C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe
explorer.exe
User:
admin
Company:
Gridinsoft LLC
Integrity Level:
HIGH
Description:
Trojan Killer Web Installer
Exit code:
0
Version:
2.1.0.48
Modules
Images
c:\users\admin\appdata\local\temp\trojankiller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6796"C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe" C:\Users\admin\AppData\Local\Temp\TrojanKiller.exe—explorer.exe
User:
admin
Company:
Gridinsoft LLC
Integrity Level:
MEDIUM
Description:
Trojan Killer Web Installer
Exit code:
3221226540
Version:
2.1.0.48
Modules
Images
c:\users\admin\appdata\local\temp\trojankiller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6836"C:\Program Files\Trojan Killer\tk64.exe" C:\Program Files\Trojan Killer\tk64.exe
tk.exe
User:
admin
Company:
Gridinsoft LLC
Integrity Level:
HIGH
Description:
Trojan Killer Portable (64-bit)
Version:
2.2.107.2124
Modules
Images
c:\program files\trojan killer\tk64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
23 988
Read events
23 974
Write events
14
Delete events
0

Modification events

(PID) Process:(6188) TrojanKiller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:InstallLocation
Value:
C:\Program Files\Trojan Killer
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:DisplayName
Value:
Trojan Killer Portable
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Trojan Killer\tk.exe,2
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:DisplayVersion
Value:
2.2.107
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:UninstallString
Value:
"C:\Program Files\Trojan Killer\tk.exe,2" -uninstall
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:Publisher
Value:
Gridinsoft LLC
(PID) Process:(6188) TrojanKiller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GridinSoft Trojan Killer
Operation:writeName:HelpLink
Value:
https://support-antimalware.com/
Executable files
15
Suspicious files
52
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6188TrojanKiller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\tk-2.2.107.2124[1].zipcompressed
MD5:9E7C7236ADA7D68D0A1AD62D1A16347C
SHA256:4C073C17448318A81560E991B3A6B5C3BA8A670F7A601D585F846F9272032158
6188TrojanKiller.exeC:\Program Files\Trojan Killer\libeay86.dllexecutable
MD5:AA03FBC0FF83BFDA7C9AEA7F78FDF2DA
SHA256:F5A7FF7B64E5D09B41EE681E48B9F0382114C57B7BD6134244CDEC4A00416D44
6188TrojanKiller.exeC:\Users\admin\AppData\Local\Temp\Z6tKVMrN.8V2compressed
MD5:9E7C7236ADA7D68D0A1AD62D1A16347C
SHA256:4C073C17448318A81560E991B3A6B5C3BA8A670F7A601D585F846F9272032158
6188TrojanKiller.exeC:\Program Files\Trojan Killer\libeay64.dllexecutable
MD5:CB42DE1BA2D8D47693155632B3E13865
SHA256:71534DF4C3DD0BB71C324F3C11A7A1DA68578E7853367F00CAC34A72DDC2311E
6188TrojanKiller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6188TrojanKiller.exeC:\Program Files\Trojan Killer\7z32.dllexecutable
MD5:FFB9F7908B29A2CB2C8736E5024A7EE4
SHA256:06E411EDC1EDC3C8590B37749C2C415B1B14A18A19DC93E8E0336F7BC120696B
6188TrojanKiller.exeC:\Program Files\Trojan Killer\Database\upd104.cbinary
MD5:860B821D7856EE90E35AA1E82751EC1E
SHA256:E9B76BC10C6E905FD5E90116A0832F565BBD21D02C04685B409D0241992B5E39
6188TrojanKiller.exeC:\Program Files\Trojan Killer\tk32.exeexecutable
MD5:62E1E097848E8043D9D9D344B5D67E2E
SHA256:EC049620799019B2996EF5AC9C54003B2E784300B6E448386A83FEB4EDFBFDFB
6188TrojanKiller.exeC:\Users\Public\Desktop\Trojan Killer.lnkbinary
MD5:AFF7BAD02C49C20A310BCE1F65B27FA8
SHA256:3821BEAEBBB0AFBD909F82414E50B72CAE53F07CAA75DD9CF5B64FCD45814381
6188TrojanKiller.exeC:\Program Files\Trojan Killer\ssleay86.dllexecutable
MD5:EE82E12FF89F71141251C03DABAF3380
SHA256:1DDAA3332956929ACF0D9CF114A1A5FC2D0A8A4F787D94390ED3B96C251659B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
52
DNS requests
25
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1932
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7132
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7132
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6836
tk64.exe
GET
200
192.237.188.201:80
http://update1.trojan-killer.com/app.json?ver=2.2.107
unknown
—
—
unknown
6836
tk64.exe
POST
—
192.237.188.201:80
http://bind.trojan-killer.com/stats/?p=5&v=2.2.107&a=TrojanKiller%2Eexe
unknown
—
—
unknown
6836
tk64.exe
GET
200
192.237.188.201:80
http://update1.trojan-killer.com/app.json?ver=2.2.107
unknown
—
—
unknown
6836
tk64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
6836
tk64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
6836
tk64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEARSlvj82CmnXclClPWkFaQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6232
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6188
TrojanKiller.exe
192.237.188.201:443
update1.trojan-killer.com
RACKSPACE
US
suspicious
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1932
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1932
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.110
whitelisted
update1.trojan-killer.com
  • 192.237.188.201
unknown
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.22
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
s1.am.gridinsoft.com
  • 165.227.52.218
unknown
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted

Threats

PID
Process
Class
Message
6836
tk64.exe
Misc activity
ET POLICY GridinSoft.com Software Version Check
6836
tk64.exe
Misc activity
ET POLICY GridinSoft.com Software Version Check
6836
tk64.exe
Misc activity
ET POLICY GridinSoft.com Software Version Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TrojanKiller.exe