| File name: | grimxploit crypter.rar |
| Full analysis: | https://app.any.run/tasks/f26d24aa-5b84-4c74-b677-20947944693f |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 29, 2021, 07:05:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | A3A4A0F336272F86DCAD2285BD24E0DB |
| SHA1: | 637866BD5532E7888CE7BF25E124EEAF9D3F0FAC |
| SHA256: | 11951C28F4E31D4EC2E3F5468280EB58151B7AD85449F73EBA95775C7FDE0366 |
| SSDEEP: | 98304:oOwQo0ooK38Hs3WYjjDeBOh2H73drt8meCfB1SCWez/mW0ImOrLr0j8nalHi02:04oXeIjqBxH7xt8meCfHSHebv0ImQ+N6 |
MALICIOUS
Application was dropped or rewritten from another process
- spidy crypt.exe (PID: 1148)
- stub.exe (PID: 2800)
- xWuGpmuV2fBM9Zo7.exe (PID: 1724)
- xWuGpmuV2fBM9Zo7.exe (PID: 2188)
- MSBuild.exe (PID: 3744)
Changes the autorun value in the registry
- stub.exe (PID: 2800)
BITRAT was detected
- stub.exe (PID: 2800)
Connects to CnC server
- stub.exe (PID: 2800)
Changes the login/logoff helper path in the registry
- spidy crypt.exe (PID: 1148)
Drops executable file immediately after starts
- MSBuild.exe (PID: 3744)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2580)
- stub.exe (PID: 2800)
- spidy crypt.exe (PID: 1148)
- MSBuild.exe (PID: 3744)
Drops a file with a compile date too recent
- WinRAR.exe (PID: 2580)
- stub.exe (PID: 2800)
- spidy crypt.exe (PID: 1148)
- MSBuild.exe (PID: 3744)
Creates files in the user directory
- spidy crypt.exe (PID: 1148)
- powershell.exe (PID: 2184)
Executes PowerShell scripts
- spidy crypt.exe (PID: 1148)
Drops a file that was compiled in debug mode
- spidy crypt.exe (PID: 1148)
INFO
Manual execution by user
- NOTEPAD.EXE (PID: 2712)
- spidy crypt.exe (PID: 1148)
- stub.exe (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
49
Monitored processes
8
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1148 | "C:\Users\admin\Desktop\grimxploit crypter\spidy crypt.exe" | C:\Users\admin\Desktop\grimxploit crypter\spidy crypt.exe | explorer.exe | ||||||||||||
User: admin Company: ShareX Team Integrity Level: MEDIUM Description: ShareX Exit code: 0 Version: 13.4.0.0 Modules
| |||||||||||||||
| 1724 | "C:\Users\admin\AppData\Local\Temp\xWuGpmuV2fBM9Zo7.exe" | C:\Users\admin\AppData\Local\Temp\xWuGpmuV2fBM9Zo7.exe | — | MSBuild.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2184 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\admin\Desktop\grimxploit crypter\spidy crypt.exe" -Force | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | spidy crypt.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2188 | "C:\Users\admin\AppData\Local\Temp\xWuGpmuV2fBM9Zo7.exe" | C:\Users\admin\AppData\Local\Temp\xWuGpmuV2fBM9Zo7.exe | — | MSBuild.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2580 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\grimxploit crypter.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2712 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\grimxploit crypter\README.txt | C:\Windows\system32\NOTEPAD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2800 | "C:\Users\admin\Desktop\grimxploit crypter\stub.exe" | C:\Users\admin\Desktop\grimxploit crypter\stub.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3744 | C:\Users\admin\AppData\Local\Temp\MSBuild.exe | C:\Users\admin\AppData\Local\Temp\MSBuild.exe | spidy crypt.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 Modules
| |||||||||||||||
Total events
1 201
Read events
1 085
Write events
116
Delete events
0
Modification events
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\grimxploit crypter.rar | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
Executable files
6
Suspicious files
4
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2184 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9IHSNL5H4QR1LM1SL65S.temp | — | |
MD5:— | SHA256:— | |||
| 2580 | WinRAR.exe | C:\Users\admin\Desktop\grimxploit crypter\stub.exe | executable | |
MD5:— | SHA256:— | |||
| 2580 | WinRAR.exe | C:\Users\admin\Desktop\grimxploit crypter\README.txt | text | |
MD5:— | SHA256:— | |||
| 2800 | stub.exe | C:\Users\admin\AppData\Local\progammedata\scvhoist.exe | executable | |
MD5:— | SHA256:— | |||
| 3744 | MSBuild.exe | C:\Users\admin\AppData\Local\Temp\xWuGpmuV2fBM9Zo7.exe | executable | |
MD5:— | SHA256:— | |||
| 2184 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 2580 | WinRAR.exe | C:\Users\admin\Desktop\grimxploit crypter\spidy crypt.exe | executable | |
MD5:— | SHA256:— | |||
| 1148 | spidy crypt.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\scvhost.exe | executable | |
MD5:— | SHA256:— | |||
| 2184 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF161c28.TMP | binary | |
MD5:— | SHA256:— | |||
| 1148 | spidy crypt.exe | C:\Users\admin\AppData\Local\Temp\MSBuild.exe | executable | |
MD5:9AF17C8393F0970EE5136BD3FFA27001 | SHA256:71D6A7A3FE5F8DC878CD5BDECA0E09177EFB85C01E9A8A10A95262CABEFAA019 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
1
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2800 | stub.exe | 31.220.4.216:9622 | — | HostHatch, Inc | NL | malicious |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
2800 | stub.exe | A Network Trojan was detected | ET TROJAN Observed Malicious SSL Cert (BitRAT CnC) |