File name:

Adobe Flash Player.rar

Full analysis: https://app.any.run/tasks/39d7d49f-2b2e-4094-be6e-51db94ef6cf3
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: August 20, 2024, 10:29:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
dyndns
netreactor
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C4CCDC83C0195F5B16FC00FB9644D0FA

SHA1:

93344DE47926F061B3CCBD553A54235AD4AB77B4

SHA256:

30A20AADBEC178DCFF20D87F9B995AF8717AA0251B37CCD8D504CCB92BFA4C43

SSDEEP:

49152:SpwQhmtyDhS/RV0vg5x78NwOmP4FfowlWT9J94CmcHUZtbGX0mt+2qZi39d9A00k:SpwQh/Ds/RkSxgNwOmQFgwl8x4N00mt1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Adobe Flash Player.exe (PID: 6956)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 2584)

    • Scans artifacts that could help determine the target

      • RegSvcs.exe (PID: 2584)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 2584)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2584)

    • SNAKE has been detected (YARA)

      • RegSvcs.exe (PID: 2584)

    • Connects to the CnC server

      • Synaptics.exe (PID: 7072)

    • Create files in the Startup directory

      • name.exe (PID: 7128)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Adobe Flash Player.exe (PID: 6956)
      • ._cache_Adobe Flash Player.exe (PID: 7004)
      • WinRAR.exe (PID: 6648)

    • Reads security settings of Internet Explorer

      • Adobe Flash Player.exe (PID: 6956)
      • Synaptics.exe (PID: 7072)

    • Executable content was dropped or overwritten

      • Adobe Flash Player.exe (PID: 6956)
      • ._cache_Adobe Flash Player.exe (PID: 7004)

    • Starts itself from another location

      • ._cache_Adobe Flash Player.exe (PID: 7004)

    • There is functionality for communication over UDP network (YARA)

      • Synaptics.exe (PID: 7072)

    • Contacting a server suspected of hosting an CnC

      • Synaptics.exe (PID: 7072)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • RegSvcs.exe (PID: 2584)

    • There is functionality for taking screenshot (YARA)

      • Synaptics.exe (PID: 7072)

    • There is functionality for communication dyndns network (YARA)

      • Synaptics.exe (PID: 7072)

    • The process verifies whether the antivirus software is installed

      • RegSvcs.exe (PID: 2584)

    • Reads the date of Windows installation

      • Adobe Flash Player.exe (PID: 6956)

    • Checks Windows Trust Settings

      • Synaptics.exe (PID: 7072)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6648)

    • Manual execution by a user

      • Adobe Flash Player.exe (PID: 6956)

    • Creates files in the program directory

      • Adobe Flash Player.exe (PID: 6956)
      • Synaptics.exe (PID: 7072)

    • Reads the computer name

      • ._cache_Adobe Flash Player.exe (PID: 7004)
      • Synaptics.exe (PID: 7072)
      • name.exe (PID: 7128)
      • RegSvcs.exe (PID: 2584)
      • Adobe Flash Player.exe (PID: 6956)

    • Checks supported languages

      • Synaptics.exe (PID: 7072)
      • name.exe (PID: 7128)
      • RegSvcs.exe (PID: 2584)
      • Adobe Flash Player.exe (PID: 6956)
      • ._cache_Adobe Flash Player.exe (PID: 7004)

    • Create files in a temporary directory

      • ._cache_Adobe Flash Player.exe (PID: 7004)
      • name.exe (PID: 7128)
      • Synaptics.exe (PID: 7072)

    • Creates files or folders in the user directory

      • ._cache_Adobe Flash Player.exe (PID: 7004)
      • name.exe (PID: 7128)
      • Synaptics.exe (PID: 7072)

    • Reads mouse settings

      • ._cache_Adobe Flash Player.exe (PID: 7004)
      • name.exe (PID: 7128)

    • Reads the machine GUID from the registry

      • ._cache_Adobe Flash Player.exe (PID: 7004)
      • RegSvcs.exe (PID: 2584)
      • Synaptics.exe (PID: 7072)

    • Checks proxy server information

      • Synaptics.exe (PID: 7072)
      • RegSvcs.exe (PID: 2584)

    • Reads Environment values

      • RegSvcs.exe (PID: 2584)

    • Disables trace logs

      • RegSvcs.exe (PID: 2584)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 2584)
      • Synaptics.exe (PID: 7072)

    • Reads Microsoft Office registry keys

      • RegSvcs.exe (PID: 2584)

    • .NET Reactor protector has been detected

      • RegSvcs.exe (PID: 2584)

    • Process checks computer location settings

      • Adobe Flash Player.exe (PID: 6956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(2584) RegSvcs.exe
Keys
DES6fc98cd6
Options
Telegram Bot Token7362576928:AAGEU8rcOmNnBJlp9Hlb8HpORMqfMHPhnjs
Telegram Chat ID6475103768
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
7
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe adobe flash player.exe ._cache_adobe flash player.exe THREAT synaptics.exe name.exe #SNAKEKEYLOGGER regsvcs.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2584"C:\Users\admin\Desktop\._cache_Adobe Flash Player.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
name.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
SnakeKeylogger
(PID) Process(2584) RegSvcs.exe
Keys
DES6fc98cd6
Options
Telegram Bot Token7362576928:AAGEU8rcOmNnBJlp9Hlb8HpORMqfMHPhnjs
Telegram Chat ID6475103768
6648"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Adobe Flash Player.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6956"C:\Users\admin\Desktop\Adobe Flash Player.exe" C:\Users\admin\Desktop\Adobe Flash Player.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\adobe flash player.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7004"C:\Users\admin\Desktop\._cache_Adobe Flash Player.exe" C:\Users\admin\Desktop\._cache_Adobe Flash Player.exe
Adobe Flash Player.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\._cache_adobe flash player.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7072"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
Adobe Flash Player.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7128"C:\Users\admin\Desktop\._cache_Adobe Flash Player.exe" C:\Users\admin\AppData\Local\directory\name.exe
._cache_Adobe Flash Player.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\directory\name.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Total events
10 389
Read events
10 334
Write events
55
Delete events
0

Modification events

(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Adobe Flash Player.rar
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
6
Suspicious files
14
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7004._cache_Adobe Flash Player.exeC:\Users\admin\AppData\Local\Temp\palladizebinary
MD5:A27F7271920B9CC2B01476C9541BBF0D
SHA256:33A5A0477CC888CADDF53A05C5AF5F264E9AAC5B8EB2C05FB8358DC57DC30BAD
7128name.exeC:\Users\admin\AppData\Local\Temp\autF6B1.tmpbinary
MD5:C124B7EF71A59BFBA1B8D170D1070EBC
SHA256:B913EFA5C0D3134C24967ECA443F7EAD72FC6E168F40E83BA1DDD682D61E39BF
7004._cache_Adobe Flash Player.exeC:\Users\admin\AppData\Local\directory\name.exeexecutable
MD5:4C38949261E48D38D51AB652ABDE0F96
SHA256:1EAED2D702412B04DEF536D1D042BC350E5127C883DE4EB3C1B961449DAE5CBD
7072Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_A58CEA7B0829C957B9B2C6786493EE99binary
MD5:EF4AD7C0351EE690A1CE644BE27657AE
SHA256:557E14C1E8505F86C8B9D1461E6C6DC5A97FFC10789973F911965F9812B3F900
7072Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:F9B20EDF0A993BEC4C736AE3859B2EF1
SHA256:A7F64ECC187DD914AA23E96AA721B0520CC54C5795D19793D04254635143533B
7128name.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbsbinary
MD5:8D36AEBB434979DC95BD369F5BBAC124
SHA256:2A4F18E7C423B6707A83926BCDA45179137A2CE168C7BB4267EF28AB7EB73E13
7072Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:E1F795EAB7890F1261F827D23B47CFFC
SHA256:128FB77618551729995341E21247D1CD97A2267D9A3780B323C83951D231631C
7072Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
7128name.exeC:\Users\admin\AppData\Local\Temp\autF6D1.tmpbinary
MD5:9B53C6AA5E201BBC12A69AD2D4C8413A
SHA256:7A043F7EE97217E679771F7D476B07EC6DA8E6F6A8F55DDFF3B0EA819FEA07BA
7072Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552binary
MD5:172452BEA522E4B554EDB6392BDBD482
SHA256:DAD6ABE355C0B73EC81659914A0E066422976887E6528FC748214D5BA8E39FB1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
45
DNS requests
26
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7072
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
2584
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
2584
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
2584
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
2584
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
6644
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2584
RegSvcs.exe
GET
504
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
2584
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
2228
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2584
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2904
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1492
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1492
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2256
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
7072
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
unknown
2256
svchost.exe
224.0.0.251:5353
—
—
—
unknown
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
checkip.dyndns.org
  • 132.226.8.169
  • 193.122.6.168
  • 193.122.130.0
  • 158.101.44.242
  • 132.226.247.73
shared
reallyfreegeoip.org
  • 188.114.97.3
  • 188.114.96.3
malicious
arc.msn.com
  • 20.223.35.26
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2584
RegSvcs.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
2584
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2584
RegSvcs.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
2584
RegSvcs.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
2584
RegSvcs.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2256
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
2584
RegSvcs.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
2584
RegSvcs.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Adobe Flash Player.rar