File name:

Password - 444.rar

Full analysis: https://app.any.run/tasks/7e3085f9-7768-4d28-b6ff-8ba27f046edf
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: May 31, 2021, 03:18:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

CC80687B98E2FF939FBCD393865FE892

SHA1:

C884C4ECF16B1B9D8F14836E2EA9819037E2EAF9

SHA256:

47698DCECF5BFEC4EC2A326F9ED6FE802CCB504DF5189B7ED08DF3F0534AE818

SSDEEP:

1536:ACLDrbCtgjYaJ4ahosaUorbkVnMMb+xKb9sfS/nSzGjkKkCHfCo:fvU/Al+saTkVMMbdb9tazgkC/Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Installer.exe (PID: 4024)
      • 2057518790.exe (PID: 2744)
      • service.exe (PID: 812)
      • Installer.exe (PID: 2576)
    • REDLINE was detected

      • Installer.exe (PID: 4024)
      • Installer.exe (PID: 2576)
    • Changes settings of System certificates

      • Installer.exe (PID: 2576)
    • Actions looks like stealing of personal data

      • Installer.exe (PID: 2576)
      • Installer.exe (PID: 4024)
    • Steals credentials from Web Browsers

      • Installer.exe (PID: 2576)
      • Installer.exe (PID: 4024)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2736)
      • schtasks.exe (PID: 2008)
    • Drops executable file immediately after starts

      • 2057518790.exe (PID: 2744)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 3788)
  • SUSPICIOUS

    • Reads Environment values

      • Installer.exe (PID: 2576)
      • Installer.exe (PID: 4024)
    • Reads the cookies of Google Chrome

      • Installer.exe (PID: 2576)
      • Installer.exe (PID: 4024)
    • Adds / modifies Windows certificates

      • Installer.exe (PID: 2576)
    • Reads the cookies of Mozilla Firefox

      • Installer.exe (PID: 2576)
      • Installer.exe (PID: 4024)
    • Drops a file with a compile date too recent

      • Installer.exe (PID: 4024)
      • 2057518790.exe (PID: 2744)
    • Creates files in the user directory

      • 2057518790.exe (PID: 2744)
    • Executable content was dropped or overwritten

      • 2057518790.exe (PID: 2744)
      • Installer.exe (PID: 4024)
    • Executed via Task Scheduler

      • service.exe (PID: 812)
    • Starts CMD.EXE for commands execution

      • 2057518790.exe (PID: 2744)
      • service.exe (PID: 812)
    • Searches for installed software

      • Installer.exe (PID: 2576)
      • Installer.exe (PID: 4024)
  • INFO

    • Manual execution by user

      • Installer.exe (PID: 4024)
      • Installer.exe (PID: 2576)
    • Reads settings of System Certificates

      • Installer.exe (PID: 4024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
9
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs #REDLINE installer.exe #REDLINE installer.exe 2057518790.exe cmd.exe no specs schtasks.exe no specs service.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
812C:\Users\admin\AppData\Roaming\service.exe C:\Users\admin\AppData\Roaming\service.exetaskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\service.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2008schtasks /create /tn MyApp /tr C:\Users\admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fC:\Windows\system32\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Password - 444.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2576"C:\Users\admin\Desktop\Installer.exe" C:\Users\admin\Desktop\Installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Steam
Exit code:
0
Version:
2.10.91.91
Modules
Images
c:\users\admin\desktop\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2736schtasks /create /tn MyApp /tr C:\Users\admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fC:\Windows\system32\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2744"C:\Users\Public\2057518790.exe" C:\Users\Public\2057518790.exe
Installer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\2057518790.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3788"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fC:\Windows\System32\cmd.exeservice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3900"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fC:\Windows\System32\cmd.exe2057518790.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4024"C:\Users\admin\Desktop\Installer.exe" C:\Users\admin\Desktop\Installer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Steam
Exit code:
0
Version:
2.10.91.91
Modules
Images
c:\users\admin\desktop\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 563
Read events
1 494
Write events
69
Delete events
0

Modification events

(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Password - 444.rar
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
2
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2120.44833\Installer.exe
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp91E6.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp91F7.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp9207.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp9208.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp9286.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp9287.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp9298.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp9299.tmp
MD5:
SHA256:
4024Installer.exeC:\Users\admin\AppData\Local\Temp\tmp92AA.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
8
DNS requests
3
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4024
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
150 b
malicious
4024
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
920 b
malicious
2576
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
920 b
malicious
2576
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
150 b
malicious
4024
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
4.83 Kb
malicious
2576
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
4.83 Kb
malicious
4024
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
145 b
malicious
4024
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
145 b
malicious
2576
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
145 b
malicious
2576
Installer.exe
POST
200
62.182.159.35:1656
http://62.182.159.35:1656//
unknown
text
145 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4024
Installer.exe
62.182.159.35:1656
malicious
4024
Installer.exe
104.26.13.31:443
api.ip.sb
Cloudflare Inc
US
suspicious
2576
Installer.exe
62.182.159.35:1656
malicious
2576
Installer.exe
104.26.13.31:443
api.ip.sb
Cloudflare Inc
US
suspicious
4024
Installer.exe
217.107.34.191:443
94gl.magicnow24.ru
JSC RTComm.RU
RU
malicious
2576
Installer.exe
217.107.34.191:443
94gl.magicnow24.ru
JSC RTComm.RU
RU
malicious

DNS requests

Domain
IP
Reputation
api.ip.sb
  • 104.26.13.31
  • 104.26.12.31
  • 172.67.75.172
whitelisted
94gl.magicnow24.ru
  • 217.107.34.191
malicious
kx.hellomir.ru
  • 217.107.34.191
malicious

Threats

PID
Process
Class
Message
4024
Installer.exe
Potentially Bad Traffic
ET INFO POST to Double Slash in URI
4024
Installer.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
4024
Installer.exe
Potentially Bad Traffic
ET INFO POST to Double Slash in URI
2576
Installer.exe
Potentially Bad Traffic
ET INFO POST to Double Slash in URI
2576
Installer.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
2576
Installer.exe
Potentially Bad Traffic
ET INFO POST to Double Slash in URI
4024
Installer.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
4024
Installer.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
2576
Installer.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
4024
Installer.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
9 ETPRO signatures available at the full report
No debug info