analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ZIP-Password-IS-951951______VmProtect.zip

Full analysis: https://app.any.run/tasks/f8d41113-dd73-4d61-b68c-ee94b82967b6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 02:52:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
redline
stealer
loader
raccoon
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EFE9E1BFE8405AE27DFADA0D189F44CA

SHA1:

EFD3770EDCEBC03E5437945B50C0D784576F29E9

SHA256:

659FE37447FF0D6A6B470144E321829140D3B4AAB03488AAC75C6571CAD87CED

SSDEEP:

98304:35W4nrEUX8K2qry24uzoTG04RPD9KRI0NBmDlWUKa+T4lmG+g8ILBVQaGKyHEsRw:35WW8QrFLJhKO0/0lxA4lm1acaykOwya

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 149_setupInstaller.exe (PID: 684)
      • 149_setupInstaller.exe (PID: 3628)
      • setup_installer.exe (PID: 760)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231ae18706_Sat028e900d3.exe (PID: 1304)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • setup_install.exe (PID: 3324)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe (PID: 3224)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 517A.tmp.exe (PID: 3364)
      • 57D4.tmp.exe (PID: 3172)
      • 53027.exe (PID: 4076)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)

    • Executes PowerShell scripts

      • cmd.exe (PID: 984)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 3324)
      • rundll32.exe (PID: 3148)
      • 57D4.tmp.exe (PID: 3172)

    • Changes settings of System certificates

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)

    • Actions looks like stealing of personal data

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • Stealing of credential data

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 57D4.tmp.exe (PID: 3172)

    • Steals credentials from Web Browsers

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • Connects to CnC server

      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • REDLINE was detected

      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Application was injected by another process

      • svchost.exe (PID: 924)

    • Runs injected code in another process

      • rundll32.exe (PID: 3148)

    • RACCOON was detected

      • 57D4.tmp.exe (PID: 3172)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2280)
      • 149_setupInstaller.exe (PID: 3628)
      • setup_installer.exe (PID: 760)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • powershell.exe (PID: 2736)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • setup_install.exe (PID: 3324)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • powershell.exe (PID: 2100)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe (PID: 3224)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 517A.tmp.exe (PID: 3364)
      • 53027.exe (PID: 4076)
      • 57D4.tmp.exe (PID: 3172)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Checks supported languages

      • setup_installer.exe (PID: 760)
      • WinRAR.exe (PID: 2280)
      • 149_setupInstaller.exe (PID: 3628)
      • setup_install.exe (PID: 3324)
      • cmd.exe (PID: 984)
      • cmd.exe (PID: 3648)
      • cmd.exe (PID: 3012)
      • cmd.exe (PID: 4012)
      • powershell.exe (PID: 2736)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • cmd.exe (PID: 1424)
      • cmd.exe (PID: 2236)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231ae18706_Sat028e900d3.exe (PID: 1304)
      • cmd.exe (PID: 4004)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 2724)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 3208)
      • cmd.exe (PID: 1500)
      • cmd.exe (PID: 3236)
      • cmd.exe (PID: 2136)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • cmd.exe (PID: 564)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • powershell.exe (PID: 2100)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe (PID: 3224)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 517A.tmp.exe (PID: 3364)
      • 57D4.tmp.exe (PID: 3172)
      • 53027.exe (PID: 4076)
      • cmd.exe (PID: 532)
      • cmd.exe (PID: 3808)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • cmd.exe (PID: 2664)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2280)
      • 149_setupInstaller.exe (PID: 3628)
      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 57D4.tmp.exe (PID: 3172)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 57D4.tmp.exe (PID: 3172)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 760)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 57D4.tmp.exe (PID: 3172)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3324)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 57D4.tmp.exe (PID: 3172)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 57D4.tmp.exe (PID: 3172)

    • Reads Environment values

      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 517A.tmp.exe (PID: 3364)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • Executes PowerShell scripts

      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)

    • Application launched itself

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)

    • Reads the Windows organization settings

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Reads Windows owner or organization settings

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Adds / modifies Windows certificates

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)

    • Reads default file associations for system extensions

      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2696)

    • Reads the cookies of Google Chrome

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Searches for installed software

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • Reads the cookies of Mozilla Firefox

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Creates files in the user directory

      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • rundll32.exe (PID: 3148)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3808)

    • Starts CMD.EXE for self-deleting

      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 57D4.tmp.exe (PID: 3172)

    • Executed via WMI

      • rundll32.exe (PID: 3148)

    • Starts itself from another location

      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)

    • Creates a directory in Program Files

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

  • INFO

    • Checks Windows Trust Settings

      • powershell.exe (PID: 2736)
      • powershell.exe (PID: 2100)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)

    • Reads settings of System Certificates

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • powershell.exe (PID: 2736)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)

    • Application was dropped or rewritten from another process

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)

    • Checks supported languages

      • rundll32.exe (PID: 1148)
      • control.exe (PID: 2696)
      • taskkill.exe (PID: 1520)
      • PING.EXE (PID: 3968)
      • msiexec.exe (PID: 3280)
      • rundll32.exe (PID: 3148)
      • timeout.exe (PID: 2632)

    • Loads dropped or rewritten executable

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)

    • Reads the computer name

      • control.exe (PID: 2696)
      • PING.EXE (PID: 3968)
      • taskkill.exe (PID: 1520)
      • rundll32.exe (PID: 3148)

    • Creates a software uninstall entry

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Creates files in the program directory

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2022:01:15 04:30:21
ZipCRC: 0x8f8191d0
ZipCompressedSize: 5835653
ZipUncompressedSize: 5847902
ZipFileName: 149_setupInstaller.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
61
Malicious processes
23
Suspicious processes
8

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject winrar.exe 149_setupinstaller.exe no specs 149_setupinstaller.exe setup_installer.exe setup_install.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs 61e231ab47792_sat02fb6439.exe no specs cmd.exe no specs cmd.exe no specs 61e231ad0641a_sat02817ac1e8.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 61e231ae18706_sat028e900d3.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 61e231b686514_sat020f28d97695.exe cmd.exe no specs 61e231b0801f9_sat02dabcd2901f.exe no specs 61e231b18bfb5_sat022d459aaa7.exe 61e231afbd0ff_sat0275ca378161.exe no specs 61e231b2a394a_sat02fc0e52.exe 61e231c431105_sat0296c511cdf.exe no specs 61e231c8a77c0_sat021d76eef2.exe 61e231c208b88_sat021d6cb0.exe 61e231c2c70ca_sat02e1a7ed.exe 61e231c7536eb_sat028b7251.exe 61e231b2a394a_sat02fc0e52.tmp powershell.exe no specs 61e231afbd0ff_sat0275ca378161.exe 61e231b2a394a_sat02fc0e52.exe #REDLINE 61e231b0801f9_sat02dabcd2901f.exe #REDLINE 61e231ab47792_sat02fb6439.exe 61e231b2a394a_sat02fc0e52.tmp control.exe no specs rundll32.exe no specs c2001101-5d15-47d7-997d-9d9bd627547e.exe 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe no specs #REDLINE dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe #REDLINE 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe 517a.tmp.exe no specs #RACCOON 57d4.tmp.exe 53027.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs taskkill.exe no specs msiexec.exe no specs rundll32.exe svchost.exe #REDLINE 61e231c208b88_sat021d6cb0.exe cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2280"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ZIP-Password-IS-951951______VmProtect.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\comdlg32.dll
684"C:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2280.29416\149_setupinstaller.exe
c:\windows\system32\ntdll.dll
3628"C:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2280.29416\149_setupinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
760"C:\Users\admin\AppData\Local\Temp\setup_installer.exe" C:\Users\admin\AppData\Local\Temp\setup_installer.exe
149_setupInstaller.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Setup SFX
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\setup_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3324"C:\Users\admin\AppData\Local\Temp\7zS8F245514\setup_install.exe" C:\Users\admin\AppData\Local\Temp\7zS8F245514\setup_install.exe
setup_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7zs8f245514\setup_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\temp\7zs8f245514\libwinpthread-1.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\users\admin\appdata\local\temp\7zs8f245514\libcurlpp.dll
984C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting DisableC:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4012C:\Windows\system32\cmd.exe /c 61e231ab47792_Sat02fb6439.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\usp10.dll
3648C:\Windows\system32\cmd.exe /c 61e231ad0641a_Sat02817ac1e8.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2736powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting DisableC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3012C:\Windows\system32\cmd.exe /c 61e231ae18706_Sat028e900d3.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225477
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\kernelbase.dll
Total events
66 910
Read events
66 232
Write events
0
Delete events
0

Modification events

No data
Executable files
102
Suspicious files
18
Text files
21
Unknown types
28

Dropped files

PID
Process
Filename
Type
3628149_setupInstaller.exeC:\Users\admin\AppData\Local\Temp\nsi1E93.tmp —
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231b2a394a_Sat02fc0e52.exeexecutable
MD5:996061FE21353BF63874579CC6C090CC
SHA256:B9DAD89B3DE1D7F9A4B73A5D107C74F716A6E2E89D653C48AB47108B37AD699A
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231b0801f9_Sat02dabcd2901f.exeexecutable
MD5:2D44954853F3E92224B63CF7F7167F94
SHA256:F751D17574983AE5F9A1B9E8F4385421B3742D63445358ED90C297713F9AE3E1
2280WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exeexecutable
MD5:0A05D389853187296C0052984B606112
SHA256:D00D68B4427FE3317CA214B9BBA6E686005E52D0E5A2EB1B3BED8A8CE80D8CB9
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231ae18706_Sat028e900d3.exeexecutable
MD5:32FB5C7255772327D5FBE5C608BAEFAD
SHA256:7D0345717D865C97BB0C46E47674F1FFD60979E6F11AAE25D544251C7FF2148F
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231ad0641a_Sat02817ac1e8.exeexecutable
MD5:243E257AB5A5DB0E1B249BDC2ABC4CFB
SHA256:3382B220421A7F7AFA30D6936DA856741C278167B1E67DB70A1B5BE4894D8F80
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231af132e7_Sat020ee35cf.exeexecutable
MD5:29FA0D00300D275C04B2D0CC3B969C57
SHA256:28314E224DCBAE977CBF7DEC0CDA849E4A56CEC90B3568A29B6BBD9234B895AA
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\16422138324989.exetext
MD5:F9497731DE40DEFDDFCB721C59671C8A
SHA256:5A0B9495F165A8E0B337C357895AA760BE82B4812ABE175CC43800B72D6E49E9
3628149_setupInstaller.exeC:\Users\admin\AppData\Local\Temp\setup_installer.exeexecutable
MD5:52AE12984522B8D30237BA4085835529
SHA256:63B0460AB54AA4799B8FB9AE97E308B15D58FED495031B69431E6009DD95BD2C
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231b686514_Sat020f28d97695.exeexecutable
MD5:257B02D3E3B214638FFBBC3A97035701
SHA256:5DCB3935AB6201AEF474AC8C43748F5DA13D48D068EBA604EE1F7FAC7E882F4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
84
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1688
61e231b2a394a_Sat02fc0e52.tmp
HEAD
200
93.189.42.32:80
http://noplayboy.com/77.exe
RU
—
—
malicious
2608
61e231c7536eb_Sat028b7251.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D
US
der
471 b
whitelisted
2608
61e231c7536eb_Sat028b7251.exe
GET
200
93.184.220.29:80
http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D
US
der
471 b
whitelisted
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
400
212.193.30.45:80
http://212.193.30.45/proxies.txt
RU
html
301 b
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
400
2.56.59.42:80
http://2.56.59.42/base/api/statistics.php
unknown
html
326 b
malicious
3436
61e231c2c70ca_Sat02e1a7ed.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?516a7ec72d606910
US
compressed
59.9 Kb
whitelisted
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
400
45.144.225.57:80
http://45.144.225.57/server.txt
unknown
html
301 b
malicious
3412
61e231b686514_Sat020f28d97695.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43c1a155bc578b0f
US
compressed
59.9 Kb
whitelisted
3412
61e231b686514_Sat020f28d97695.exe
GET
301
91.107.126.191:80
http://web-stat.biz/connection
RU
html
162 b
malicious
2920
61e231ad0641a_Sat02817ac1e8.exe
GET
200
92.123.224.113:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPRApfVsPmQefP8%2BOlu%2BSG2vQ%3D%3D
unknown
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2920
61e231ad0641a_Sat02817ac1e8.exe
148.251.234.83:443
iplogger.org
Hetzner Online GmbH
DE
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
212.193.30.45:80
—
—
RU
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
104.23.98.190:443
pastebin.com
Cloudflare Inc
US
malicious
3324
setup_install.exe
172.67.164.34:80
kelenxz.xyz
—
US
malicious
2608
61e231c7536eb_Sat028b7251.exe
149.28.253.196:443
www.listincode.com
—
US
suspicious
1324
61e231afbd0ff_Sat0275ca378161.exe
172.67.188.70:443
v.xyzgamev.com
—
US
suspicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
45.144.225.57:80
—
—
—
malicious
2608
61e231c7536eb_Sat028b7251.exe
13.107.4.50:80
ctldl.windowsupdate.com
Microsoft Corporation
US
whitelisted
3436
61e231c2c70ca_Sat02e1a7ed.exe
104.21.88.113:443
dpcapps.me
Cloudflare Inc
US
unknown
3412
61e231b686514_Sat020f28d97695.exe
91.107.126.191:443
web-stat.biz
Domain names registrar REG.RU, Ltd
RU
malicious

DNS requests

Domain
IP
Reputation
kelenxz.xyz
  • 172.67.164.34
  • 104.21.50.158
malicious
www.listincode.com
  • 149.28.253.196
whitelisted
v.xyzgamev.com
  • 172.67.188.70
  • 104.21.40.196
suspicious
iplogger.org
  • 148.251.234.83
shared
web-stat.biz
  • 91.107.126.191
  • 37.220.10.229
malicious
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
shared
whatisart.top
  • —
suspicious
noplayboy.com
  • 93.189.42.32
malicious
dpcapps.me
  • 104.21.88.113
  • 172.67.177.36
malicious
ctldl.windowsupdate.com
  • 13.107.4.50
  • 209.197.3.8
whitelisted

Threats

PID
Process
Class
Message
3324
setup_install.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
3520
61e231b18bfb5_Sat022d459aaa7.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3520
61e231b18bfb5_Sat022d459aaa7.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
3520
61e231b18bfb5_Sat022d459aaa7.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
3412
61e231b686514_Sat020f28d97695.exe
A Network Trojan was detected
ET TROJAN GCleaner Downloader Activity M5
2080
61e231c8a77c0_Sat021d76eef2.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2080
61e231c8a77c0_Sat021d76eef2.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
125 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ZIP-Password-IS-951951______VmProtect.zip