analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Payment Draft.cab

Full analysis: https://app.any.run/tasks/f4f138f2-76a8-443b-9dd7-e47342ef4931
Verdict: Malicious activity
Threats:

Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS.

Malware Trends Tracker     >>>
Analysis date: February 21, 2020, 16:15:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
rat
netwire
trojan
Indicators:
MIME: application/vnd.ms-cab-compressed
File info: Microsoft Cabinet archive data, 1228569 bytes, 1 file
MD5:

2EE7627EE56D2B11D10D7D780D235F92

SHA1:

CF3469D31AB8FAC7FCA9B6D4513E57455310B410

SHA256:

6A80B05A4A59B8EE0E1985754F0FEA95D877E114C6B6BAE720CDDB57E8257874

SSDEEP:

24576:FY9vvaLd7j3tz4fTWjv+gEURlWACSf3bNiCWAXz6h3Bo661d7c/1RMWaMP3af0on:y9vvI7zyfTuxEUQCWSmhxo661dw/XMxX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Payment Draft.exe (PID: 3524)
      • hkub.pif (PID: 3820)
      • RegSvcs.exe (PID: 2560)

    • Connects to CnC server

      • RegSvcs.exe (PID: 2560)

    • Changes the autorun value in the registry

      • hkub.pif (PID: 3820)

    • NETWIRE was detected

      • RegSvcs.exe (PID: 2560)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • Payment Draft.exe (PID: 3524)

    • Drop AutoIt3 executable file

      • Payment Draft.exe (PID: 3524)

    • Executable content was dropped or overwritten

      • Payment Draft.exe (PID: 3524)
      • WinRAR.exe (PID: 3028)
      • hkub.pif (PID: 3820)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.cab | Microsoft Cabinet Archive (100)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe payment  draft.exe hkub.pif #NETWIRE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
3028"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Payment Draft.cab"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3524"C:\Users\admin\AppData\Local\Temp\Rar$EXa3028.27342\Payment Draft.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3028.27342\Payment Draft.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3820"C:\Users\admin\AppData\Local\Temp\62474426\hkub.pif" porrql.ihcC:\Users\admin\AppData\Local\Temp\62474426\hkub.pif
Payment Draft.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 8, 1
2560"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe
hkub.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.7.3062.0 built by: NET472REL1
Total events
811
Read events
791
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
66
Unknown types
0

Dropped files

PID
Process
Filename
Type
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\porrql.ihc —
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\hlnhlf.exetext
MD5:C92B19115CE190DF81249FA8C797FF38
SHA256:3F1D9E8120BC82ADEBEC6CBBE8DA8B7D78A43577B0570A29A48F8455AB435F0C
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\vnmavfrx.cpltext
MD5:091B59805E812B76F3BFE05DCED969EA
SHA256:AFFE5C7AFE96488747F39623DD283D2CF691B352906F6266B310C403034E1DA7
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\sgbsmesxam.docxtext
MD5:3140EF50B25684CFB1D409FEE9A5505D
SHA256:7B617A55339C4BBE7A506DA66AA634EF411C2C4D4A0365E7544560896FBD477A
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\humecw.docxtext
MD5:4F6F0B8CA7270B7E1142D97CB9922D56
SHA256:C027992330CB6A2BA2DED920833516F690532149A55461F346053112A61B6EC1
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\vsgwk.dlltext
MD5:B6E017F6019751AB8940E84020FDDE3F
SHA256:B7BC678084C316D60962AFB8743E67BF4944F2FC33523B0C0F50685D6E2ECC0F
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\swco.icmtext
MD5:4C9D402C46A621FBA9D23B78E0BCB1A3
SHA256:53517F381FA528F5122B930464E923FB0D9AD30C4775E61CDAA2C92B882EC231
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3028.27342\Payment Draft.exeexecutable
MD5:A794516C77B3BB049C463C1BDC5D5D3E
SHA256:4CE5136B29D5792C2CE74226D80CEB122CE4FF76AA787BD16C1D333F4085D952
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\fiiim.dlltext
MD5:3949E7E22791D564FBA0BD3000BAD974
SHA256:7F7FBA8AC1144A8241AC17649E7384C882D027B38F7EEE3BEC1C3827D6D4A864
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\ambh.icmtext
MD5:19A55CB62675833EECACCADBACFC67B4
SHA256:5FF947E046BD2AD453FA3C5DBC6F7E4A0C25EC970EE9C535F0663C2DAB645AAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2560
RegSvcs.exe
91.189.180.213:3365
—
ServeTheWorld AS
NO
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2560
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Draft.cab