Find similar analyses in TI Lookup

Analysis date (UTC): 16 July 2020, 02:59Analysis environment: Windows 7 Pro, build 7601, x86

C:\Users\admin\AppData\Local\Temp\Rar$EXa1780.25675\NEW CONTRACT.exe

MD5:FCF4EDF16E4C173CF5290005298AF685

SHA1:13C03C0B40E362FE9ACBB62A695790EA436DFEE3

SHA256:675D56191139C3B24869C61F555619A98F807FB847184448DFF6E6E796037382

Analysis result

Threat level:Malicious activity

Tags:

trojanratstealeravemaria

Full analysis:Analysis C:\Users\admin\AppData\Local\Temp\Rar$EXa1780.25675\NEW CONTRACT.exe (MD5: FCF4EDF16E4C173CF5290005298AF685) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

AVEMARIA was detected

NEW CONTRACT.exe (PID: 2772)
WARZONE.exe (PID: 2712)

Runs app for hidden code execution

NEW CONTRACT.exe (PID: 2772)
WARZONE.exe (PID: 2712)

Writes to a start menu file

NEW CONTRACT.exe (PID: 2772)

Changes the autorun value in the registry

NEW CONTRACT.exe (PID: 2772)

Loads dropped or rewritten executable

dism.exe (PID: 608)
dism.exe (PID: 3840)

Runs injected code in another process

WARZONE.exe (PID: 2712)

Application was injected by another process

explorer.exe (PID: 392)

SUSPICIOUS

Starts CMD.EXE for commands execution

NEW CONTRACT.exe (PID: 2772)
WARZONE.exe (PID: 2712)
explorer.exe (PID: 392)

Creates files in the user directory

NEW CONTRACT.exe (PID: 2772)
powershell.exe (PID: 1744)

Executable content was dropped or overwritten

cmd.exe (PID: 1316)
NEW CONTRACT.exe (PID: 2772)
DllHost.exe (PID: 2640)
cmd.exe (PID: 1012)
DllHost.exe (PID: 3220)

Starts itself from another location

NEW CONTRACT.exe (PID: 2772)

Executed via COM

DllHost.exe (PID: 2640)
DllHost.exe (PID: 3220)

Executed via WMI

Roaming:ApplicationData (PID: 3284)

Executes PowerShell scripts

NEW CONTRACT.exe (PID: 2604)

Uses WMIC.EXE to create a new process

cmd.exe (PID: 3580)

INFO

Manual execution by user

explorer.exe (PID: 2916)

Threats

PID	Process	Class	Message
1048	svchost.exe	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.3utilities .com
1048	svchost.exe	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.3utilities .com
1048	svchost.exe	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.3utilities .com
1048	svchost.exe	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.3utilities .com
1048	svchost.exe	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.3utilities .com