analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

AAAMZ1uciHS1GLDaVA9lJNzDa

Full analysis: https://app.any.run/tasks/e8ae3f66-1bf0-4f1c-8e9d-c9645ae72a35
Verdict: Malicious activity
Threats:

Loda is a remote access trojan (RAT) that has been in active use among multiple threat actors since 2016. The malware’s functionality includes stealing passwords and other sensitive information, keylogging, capturing screenshots, and delivering other malicious payloads. Loda is typically distributed as part of phishing email campaigns.

Malware Trends Tracker     >>>
Analysis date: March 22, 2019, 09:28:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
loda
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0ABF0BD96A40A05EFA58AED5D6929ABA

SHA1:

0E92896636B0ED726C925AD3653E31C1289F5EFE

SHA256:

352851C653B97548EF7DE217EDB2CCB133C2CEFB47BBB3EEA7B3906739458DC3

SSDEEP:

24576:mtXE+s3WaqEwRvftQos3BsYJ/9esG4euRhLwnpenc20xGS4jxV15PQ:UgqLRvffsRs2/EnuRh8npenc20kn1V1O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • DOCU-MENT-0349439059934-340934-43-PDF.exe (PID: 2236)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2260)
      • mmc.exe (PID: 3060)

    • Application was dropped or rewritten from another process

      • DOCU-MENT-0349439059934-340934-43-PDF.exe (PID: 2236)

    • LODA was detected

      • RegAsm.exe (PID: 3004)

    • Connects to CnC server

      • RegAsm.exe (PID: 3004)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • RegAsm.exe (PID: 3004)

    • Creates files in the user directory

      • RegAsm.exe (PID: 3004)
      • rundll32.exe (PID: 3108)

    • Application launched itself

      • WinRAR.exe (PID: 2956)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3208)

    • Connects to unusual port

      • RegAsm.exe (PID: 3004)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 3108)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: /
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:03:18 10:13:27
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe docu-ment-0349439059934-340934-43-pdf.exe no specs #LODA regasm.exe schtasks.exe no specs rundll32.exe no specs mmc.exe no specs mmc.exe

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AAAMZ1uciHS1GLDaVA9lJNzDa.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3208"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2956.42178\DOCU-MENT-0349439059934-340934-43-PDF.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2236"C:\Users\admin\AppData\Local\Temp\Rar$EXa3208.42382\DOCU-MENT-0349439059934-340934-43-PDF.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3208.42382\DOCU-MENT-0349439059934-340934-43-PDF.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3004"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
DOCU-MENT-0349439059934-340934-43-PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2260"C:\Windows\System32\schtasks.exe" /create /tn makecab /tr "C:\Users\admin\AppData\Local\Temp\VSSVC\BdeSysprep.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—DOCU-MENT-0349439059934-340934-43-PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3108"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4056"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3060"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 108
Read events
1 048
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
8
Unknown types
3

Dropped files

PID
Process
Filename
Type
2956WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2956.42178\DOCU-MENT-0349439059934-340934-43-PDF.zipcompressed
MD5:E6DE1E710483A38CD40AC0E4140888D9
SHA256:D63FD72E5CDEFD8560B069C4507C6C02EB130A0819A41E64B1939836B686D55E
3108rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:A1E9C98EEE3588B8BC17A233736CDE00
SHA256:47D27B9B955DF692B3A4ECAA21C4422BAB7DE477C256E0823BF04767447F03D3
3108rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3108rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UOI5HOD4\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3208WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3208.42382\DOCU-MENT-0349439059934-340934-43-PDF.exeexecutable
MD5:C8BC43E79E71023D4FBB73F09C3CC50E
SHA256:E4A0EA3D3C6CA0A9CC94A44AD36965860F58E068E0183C5CAFA6EEAD2365433D
3108rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FG5YYDPL\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3108rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3108rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3004RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ipapi[1].txttext
MD5:B70A203BD05A261F7C0606221FC6A323
SHA256:924379F3AFDA434A5314859C24DD23A901440B1F863510B5454E3A2564AD65E5
3004RegAsm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\json[1]text
MD5:2B1A23FEA84D8DAB830D787C11CCA042
SHA256:03BC0447886FC881C0A822F01E9DA6942681F86854124D114613D8D744E411E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3004
RegAsm.exe
104.25.210.99:443
ipapi.co
Cloudflare Inc
US
shared
3004
RegAsm.exe
192.253.242.196:5000
monopak.dns-cloud.net
SoftLayer Technologies Inc.
AU
malicious

DNS requests

Domain
IP
Reputation
ipapi.co
  • 104.25.210.99
  • 104.25.209.99
shared
monopak.dns-cloud.net
  • 192.253.242.196
malicious

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (ipapi .co in DNS lookup)
3004
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loda Logger CnC Request
3004
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loda Logger CnC Beacon
2 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AAAMZ1uciHS1GLDaVA9lJNzDa