analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

123.exe

Full analysis: https://app.any.run/tasks/b9c23b27-3b53-42cd-b660-cf7518e6043b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: June 16, 2019, 13:50:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
redaman
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

4657F22E45BEB1AE370D5767EAF1C3B0

SHA1:

1061A2DC3C260764C3080082DF9527DD8125D45F

SHA256:

2EDCEFE7477444D9E012512F0E1F1DB62ECED8ED8AAFFA4673F6DE5EA2751395

SSDEEP:

6144:p7zNafO+c7vYaO+O6dtvcwx1Jxs2z5SaVPc:p7zNKAQaO+Bvr7JxRz2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe (PID: 3944)

    • Application was dropped or rewritten from another process

      • éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe (PID: 3944)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 2824)
      • rundll32.exe (PID: 1632)
      • explorer.exe (PID: 252)
      • WinRAR.exe (PID: 2988)

    • Loads the Task Scheduler COM API

      • rundll32.exe (PID: 2824)

    • REDAMAN was detected

      • rundll32.exe (PID: 1632)

  • SUSPICIOUS

    • Creates files in the user directory

      • explorer.exe (PID: 252)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2988)
      • éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe (PID: 3944)
      • rundll32.exe (PID: 2824)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 252)

    • Uses RUNDLL32.EXE to load library

      • éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe (PID: 3944)

    • Creates files in the program directory

      • rundll32.exe (PID: 2824)

    • Executed via Task Scheduler

      • rundll32.exe (PID: 1632)

    • Connects to server without host name

      • rundll32.exe (PID: 1632)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ???? ????? ???㬥?⮢ ?? ??????? ?????.exe
ZipUncompressedSize: 261632
ZipCompressedSize: 226244
ZipCRC: 0x61d68c6e
ZipModifyDate: 2019:05:26 20:50:05
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe éñß8 »á¬ñg ñ«¬p¼ñ¡g«ó ºá »a«f½d¬ ¼ñßnµ.exe rundll32.exe #REDAMAN rundll32.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2988"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\123.exe.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3944"C:\Users\admin\AppData\Local\Temp\Rar$EXa2988.3167\éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2988.3167\éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe
WinRAR.exe
User:
admin
Company:
Корпорация Майкрософт
Integrity Level:
MEDIUM
Description:
Самоизвлечение CAB-файлов Win32
Exit code:
0
Version:
6.00.2900.5512 (xpsp.080413-2105)
2824rundll32.exe asdf.dll,DllGetClassObject root 000000000000 Post Install program: <None>C:\Windows\system32\rundll32.exe
éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1632rundll32.exe "C:\ProgramData\2daf8815353e\2eac8b16363d.dat",DllGetClassObject rootC:\Windows\system32\rundll32.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
252C:\Windows\Explorer.EXEC:\Windows\explorer.exe—ctfmon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 343
Read events
1 307
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
3944éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\asdf.dllexecutable
MD5:DE9EE3A3D5560915E5966889AC828FC8
SHA256:EEAEC8C68A8DBAD2E661E70D665E125A5DC5CE4EBDD80DD4F312F7E8E40A6906
2824rundll32.exeC:\ProgramData\2daf8815353e\2eac8b16363d.datexecutable
MD5:DE9EE3A3D5560915E5966889AC828FC8
SHA256:EEAEC8C68A8DBAD2E661E70D665E125A5DC5CE4EBDD80DD4F312F7E8E40A6906
2988WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2988.3167\éÑß8 »á¬ÑG ñ«¬p¼Ñ¡G«ó ºá »a«F½d¬ ¼Ñßnµ.exeexecutable
MD5:7EA01F1FAF91627BAD22C980A0C44A8D
SHA256:BD5CCD704467BF4B12EEA588FAF72A8E84AB2EC782EC5EC6B41F6C5E84A59228
252explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\123.exe.zip.lnklnk
MD5:CD8FD0849D7FE1919CCF08A12669C578
SHA256:63A366B98A18988A304FBDBEFE40967DD2616C1567653C48C37B8400DF4D0707
252explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:D9F1BBE187DCA982CD20A5C930C7A939
SHA256:9418D49819C3F42B170C4F631A102C48F4C05B0C233F74A6F0D9FD358993AF5F
252explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:B676B11BE8D45E2B76F98BF5625C04D2
SHA256:93E1A03584F0B131722F531E5DC1CAC8D09DDB7305E676BCBD5E4CAB87F00DB7
252explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061620190617\index.datdat
MD5:87D0A166B1B1858F02B297A0BEA6678D
SHA256:77DC44F28A97D22F69A1E64E9FAAF98F0D0D90E6245C3F04701643129BC7031A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1632
rundll32.exe
POST
—
185.203.116.89:80
http://185.203.116.89/index.php
BG
—
—
malicious
1632
rundll32.exe
POST
—
185.205.210.233:80
http://185.205.210.233/index.php
BG
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1632
rundll32.exe
188.165.200.156:53
—
OVH SAS
FR
malicious
1632
rundll32.exe
185.203.116.89:80
—
BelCloud Hosting Corporation
BG
malicious
1632
rundll32.exe
185.205.210.233:80
—
BelCloud Hosting Corporation
BG
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
1632
rundll32.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
1632
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.RTM.N (Redaman)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
123.exe