File name:

Boleto 11-01-2019 cod. COXQybNuyP1.zip

Full analysis: https://app.any.run/tasks/1d576db7-6af5-417a-8b2b-312b33e0e089
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 10, 2019, 22:01:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
banload
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

76B086C9A15D81B6245F78C050E668C3

SHA1:

65A418017ED686A43BC7D084C056E6B0BA638B5D

SHA256:

23BC46BF4D7FDD5B4944920979ADB2C0F2E23653AD8B9BF91568A2202F9025DE

SSDEEP:

98304:w7kPqw7vmMA0PPn4u3OUPdcqz5SnxGLLLA:ZPq+vmF6PDPme5GxGLLLA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Banload was detected

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Application was dropped or rewritten from another process

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Changes settings of System certificates

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2988)
    • Application launched itself

      • WinRAR.exe (PID: 3016)
    • Adds / modifies Windows certificates

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Creates files in the program directory

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:01:07 12:21:21
ZipCRC: 0x88cd6b18
ZipCompressedSize: 3325269
ZipUncompressedSize: 3325269
ZipFileName: Boleto 11-01-2019 cod. COXQybNuyP.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe #BANLOAD boleto 11-01-2019 cod. coxqybnuyp.exe

Process information

PID
CMD
Path
Indicators
Parent process
2416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21027\Boleto 11-01-2019 cod. COXQybNuyP.zip"C:\Program Files\WinRAR\WinRAR.exeWinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2876"C:\Users\admin\AppData\Local\Temp\Rar$EXa2988.22184\Boleto 11-01-2019 cod. COXQybNuyP.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2988.22184\Boleto 11-01-2019 cod. COXQybNuyP.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2988.22184\boleto 11-01-2019 cod. coxqybnuyp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2988"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21777\Boleto 11-01-2019 cod. COXQybNuyP.zip"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3016"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Boleto 11-01-2019 cod. COXQybNuyP1.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3252"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21345\Boleto 11-01-2019 cod. COXQybNuyP.zip"C:\Program Files\WinRAR\WinRAR.exeWinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
Total events
1 813
Read events
1 719
Write events
93
Delete events
1

Modification events

(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3016) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Boleto 11-01-2019 cod. COXQybNuyP1.zip
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2988WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2988.22184\Boleto 11-01-2019 cod. COXQybNuyP.exeexecutable
MD5:
SHA256:
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21777\Boleto 11-01-2019 cod. COXQybNuyP.zipcompressed
MD5:
SHA256:
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21027\Boleto 11-01-2019 cod. COXQybNuyP.zipcompressed
MD5:
SHA256:
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21345\Boleto 11-01-2019 cod. COXQybNuyP.zipcompressed
MD5:
SHA256:
2876Boleto 11-01-2019 cod. COXQybNuyP.exeC:\ProgramData\TEMP\RAIDTesttext
MD5:C7B414D47E276953ED848B6EE9B03845
SHA256:38021E44326E235BC37782DD8B02634F2024D2952ECD1DFCC4524E45BB5B307F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2876
Boleto 11-01-2019 cod. COXQybNuyP.exe
64.233.166.137:443
0f46fc6b-a-62cb3a1a-s-sites.googlegroups.com
Google Inc.
US
whitelisted
2876
Boleto 11-01-2019 cod. COXQybNuyP.exe
74.125.140.199:443
sites.google.com
Google Inc.
US
unknown

DNS requests

Domain
IP
Reputation
sites.google.com
  • 74.125.140.199
whitelisted
0f46fc6b-a-62cb3a1a-s-sites.googlegroups.com
  • 64.233.166.137
shared

Threats

No threats detected
Process
Message
Boleto 11-01-2019 cod. COXQybNuyP.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Boleto 11-01-2019 cod. COXQybNuyP.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s