| File name: | Z.zip |
| Full analysis: | https://app.any.run/tasks/88f2ac51-13f3-42d7-9493-21f2d3ad0276 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | March 24, 2025, 18:46:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=store |
| MD5: | 8F3ACA96CF1530F6C5988C8441EBC022 |
| SHA1: | 55AFE87F68AD4CA3788F5BFA02F4C2BB05E577AD |
| SHA256: | 2F47493F399969B80A50E5028A8E4D60E1A6D02A366D4E818A2FA80660EE2FF7 |
| SSDEEP: | 6144:icHHBdE1O0zPpSuBgNxmQFQoZWC54NkR7tOJoT:ierMODqgDh/WS4NktMKT |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 2448)
Actions looks like stealing of personal data
- XTomkX.exe (PID: 2008)
SUSPICIOUS
Executable content was dropped or overwritten
- J3WIN.EXE (PID: 2360)
- XTomkX.exe (PID: 2008)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 2448)
- XTomkX.exe (PID: 2008)
Reads the Internet Settings
- XTomkX.exe (PID: 2008)
- taskmgr.exe (PID: 3824)
Creates file in the systems drive root
- ntvdm.exe (PID: 2612)
Connects to unusual port
- XTomkX.exe (PID: 2008)
Starts CMD.EXE for commands execution
- XTomkX.exe (PID: 2008)
Executing commands from a ".bat" file
- XTomkX.exe (PID: 2008)
Application launched itself
- taskmgr.exe (PID: 3824)
There is functionality for taking screenshot (YARA)
- J3WIN.EXE (PID: 2360)
INFO
The sample compiled with japanese language support
- WinRAR.exe (PID: 2448)
Checks supported languages
- J3WIN.EXE (PID: 2360)
- XTomkX.exe (PID: 2008)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2448)
Create files in a temporary directory
- J3WIN.EXE (PID: 2360)
- XTomkX.exe (PID: 2008)
Reads the computer name
- XTomkX.exe (PID: 2008)
- J3WIN.EXE (PID: 2360)
Checks proxy server information
- XTomkX.exe (PID: 2008)
Reads the machine GUID from the registry
- XTomkX.exe (PID: 2008)
Creates files or folders in the user directory
- XTomkX.exe (PID: 2008)
The sample compiled with english language support
- XTomkX.exe (PID: 2008)
Manual execution by a user
- taskmgr.exe (PID: 3824)
Reads security settings of Internet Explorer
- taskmgr.exe (PID: 3824)
Aspack has been detected
- J3WIN.EXE (PID: 2360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2025:03:25 02:45:06 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Z/ |
Total processes
56
Monitored processes
12
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 972 | "C:\Windows\system32\ntvdm.exe" -i2 | C:\Windows\System32\ntvdm.exe | — | XTomkX.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1080 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1380 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\34a07f6c.bat" " | C:\Windows\System32\cmd.exe | — | XTomkX.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1400 | "C:\Windows\system32\ntvdm.exe" -i5 | C:\Windows\System32\ntvdm.exe | XTomkX.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1440 | "C:\Windows\system32\ntvdm.exe" -i3 | C:\Windows\System32\ntvdm.exe | — | XTomkX.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2008 | C:\Users\admin\AppData\Local\Temp\XTomkX.exe | C:\Users\admin\AppData\Local\Temp\XTomkX.exe | J3WIN.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2360 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2448.33816\Z\J3WIN.EXE" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2448.33816\Z\J3WIN.EXE | WinRAR.exe | ||||||||||||
User: admin Company: BLACKPACKAGE-TRYY Integrity Level: MEDIUM Description: J3WIN Exit code: 3221225547 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 2384 | "C:\Windows\system32\ntvdm.exe" -i4 | C:\Windows\System32\ntvdm.exe | — | XTomkX.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2448 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Z.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 2612 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\System32\ntvdm.exe | — | XTomkX.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 102
Read events
3 037
Write events
59
Delete events
6
Modification events
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1080) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet |
| Operation: | write | Name: | {4040CF00-1B3E-486A-B407-FA14C56B6FC0} |
Value: D4DA6D42058C | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Z.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
Executable files
3
Suspicious files
0
Text files
21
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2448 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2448.33816\Z\J3WIN.EXE | executable | |
MD5:BF3C555BD9DC28ECB37336A2B43E786C | SHA256:0A296575CC68BD62398765BF738C0D51F77ED4C8CE46A0E04594DE7F7C8DDEA2 | |||
| 2612 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs5C93.tmp | text | |
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B | SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD | |||
| 972 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs5D2E.tmp | text | |
MD5:8CF6DDB5AA59B49F34B967CD46F013B6 | SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C | |||
| 2008 | XTomkX.exe | C:\Users\admin\AppData\Local\Temp\06C76217.exe | text | |
MD5:D3B07384D113EDEC49EAA6238AD5FF00 | SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C | |||
| 2008 | XTomkX.exe | C:\Users\admin\AppData\Local\Temp\0E425A7D.exe | text | |
MD5:D3B07384D113EDEC49EAA6238AD5FF00 | SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C | |||
| 2008 | XTomkX.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\k3[1].rar | text | |
MD5:D3B07384D113EDEC49EAA6238AD5FF00 | SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C | |||
| 972 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs5D2F.tmp | text | |
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B | SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD | |||
| 1440 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs5DCB.tmp | text | |
MD5:8CF6DDB5AA59B49F34B967CD46F013B6 | SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C | |||
| 1440 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs5DDB.tmp | text | |
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B | SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD | |||
| 2360 | J3WIN.EXE | C:\Users\admin\AppData\Local\Temp\XTomkX.exe | executable | |
MD5:56B2C3810DBA2E939A8BB9FA36D3CF96 | SHA256:4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
2
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k1.rar | unknown | — | — | malicious |
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k2.rar | unknown | — | — | malicious |
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k3.rar | unknown | — | — | malicious |
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k4.rar | unknown | — | — | malicious |
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k4.rar | unknown | — | — | malicious |
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k5.rar | unknown | — | — | malicious |
2008 | XTomkX.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k4.rar | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2008 | XTomkX.exe | 3.229.117.57:799 | ddos.dnsnb8.net | AMAZON-AES | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
ddos.dnsnb8.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Misc activity | SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
2008 | XTomkX.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |