File name:

Запит.rar

Full analysis: https://app.any.run/tasks/f69501cf-f1ce-45c7-b9f4-9ee6912252e0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 09, 2024, 13:59:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
rat
remcos
remote
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

782A42EA9749013B1A65E99D506FE932

SHA1:

4C356B3672EAF5ADC44E2A6A75747588506BC0AB

SHA256:

6DDEB2664B954665E4D38120A11FE4EC5E1FD5DF9C1E0A24B75ADC19A176F76B

SSDEEP:

49152:OHfdq+jLmx4xwg/y/nmSU14HKRzF9DiuBVAWEU3bWCZtZ3OjIr0trQFlc/gbBSiY:iVpfO4Xq/nmSI4KRzFp5BNpLZeIr2/OU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3060)

    • Create files in the Startup directory

      • cmd.exe (PID: 2544)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Запит документів.pdf.exe (PID: 1424)
      • wscript.exe (PID: 2868)
      • Beginners.pif (PID: 2532)

    • Starts CMD.EXE for commands execution

      • Запит документів.pdf.exe (PID: 1424)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 2688)

    • Get information on the list of running processes

      • cmd.exe (PID: 2688)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2688)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2688)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2688)
      • wscript.exe (PID: 2868)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2868)

  • INFO

    • Manual execution by a user

      • Запит документів.pdf.exe (PID: 1424)
      • WinRAR.exe (PID: 1544)
      • WinRAR.exe (PID: 2444)
      • cmd.exe (PID: 2544)
      • cmd.exe (PID: 3060)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2444)
      • Запит документів.pdf.exe (PID: 1424)
      • cmd.exe (PID: 2536)
      • Beginners.pif (PID: 2532)

    • Checks supported languages

      • Запит документів.pdf.exe (PID: 1424)
      • Beginners.pif (PID: 2532)
      • PixelCraft.pif (PID: 3200)

    • Reads the computer name

      • Запит документів.pdf.exe (PID: 1424)
      • Beginners.pif (PID: 2532)

    • Create files in a temporary directory

      • Запит документів.pdf.exe (PID: 1424)

    • Application launched itself

      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 2688)

    • Reads mouse settings

      • Beginners.pif (PID: 2532)
      • PixelCraft.pif (PID: 3200)

    • Creates files or folders in the user directory

      • Beginners.pif (PID: 2532)

    • Drops the AutoIt3 executable file

      • Beginners.pif (PID: 2532)
      • cmd.exe (PID: 2536)

    • The executable file from the user directory is run by the CMD process

      • Beginners.pif (PID: 2532)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 2868)

    • Reads Environment values

      • Beginners.pif (PID: 2532)

    • Reads the machine GUID from the registry

      • Beginners.pif (PID: 2532)

    • Checks proxy server information

      • Beginners.pif (PID: 2532)

    • Reads product name

      • Beginners.pif (PID: 2532)

    • REMCOS has been detected (SURICATA)

      • Beginners.pif (PID: 2532)

    • Connects to unusual port

      • Beginners.pif (PID: 2532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
20
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs winrar.exe no specs запит документів.pdf.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs findstr.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs #REMCOS beginners.pif ping.exe no specs cmd.exe cmd.exe no specs schtasks.exe no specs wscript.exe no specs pixelcraft.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
908cmd /c copy /b Punch + Springer + Xi 3539\x C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1196cmd /c mkdir 3539C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1424"C:\Users\admin\Desktop\Запит\Запит документів.pdf.exe" C:\Users\admin\Desktop\Запит\Запит документів.pdf.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\запит\запит документів.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1544"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Documents\Запит\Запит.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1860tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1992findstr /I "wrsa.exe"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2044"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Запит.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2444"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Запит\Запит документів.part1.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2452"C:\Windows\System32\cmd.exe" /k cmd < Ob & exitC:\Windows\System32\cmd.exe—Запит документів.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2520ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
4 654
Read events
4 565
Write events
89
Delete events
0

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1544) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
4
Suspicious files
10
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
1424Запит документів.pdf.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Xitext
MD5:9099B22EB9896CBB9DBC2A9BE93F3810
SHA256:045D7597AEA15FB8447EB8BDFC58596F6A2FB980998BC5156BAC0D263E5A5DA3
1544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1544.26689\Запит\Код доступу - 7358975.txttext
MD5:CF6009CB4990CBB84F5940682CE219F7
SHA256:19BB6E5ADAE685F0CADA2E162336B594272B3FAABD45473B8E53800ECB047892
1544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1544.26689\Запит\Запит документів.part2.rarcompressed
MD5:99224A1A5CD93F482C4522ED4E729888
SHA256:DBD0797BC22A0F84B00773DE7F818171DD95C8C47161FE3EBE91DCD75628C557
1544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1544.26689\Запит\Запит документів.part4.rarcompressed
MD5:4A22D3B0675D7114996D78513D15E9F0
SHA256:6197E6FB0DD386379182D03959FBCC86B867B8F4C6B221F36220E2384C29303B
1544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1544.26689\Запит\Запит документів.part5.rarcompressed
MD5:A6EF808648F0B37DC3FA45CE067C5B3A
SHA256:7C1F9160778107D27C7BC01DB5221D26B879696DBD84DDF10603AEEB50990203
1544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1544.26689\Запит\Запит документів.part3.rarcompressed
MD5:43EA723FE9F5703F5EFFAF110D4AF012
SHA256:637C0CF26B76D6EB8FFBACE5CBB9FAFDA4697C276FE6C51ED580DD9A86174ED5
1424Запит документів.pdf.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Punchtext
MD5:C7960898F8899CCD8C3567E82EDF2A2F
SHA256:0E983C0A842E14E5D800DA74B2D8C8C4DC8CCDB4FA0AD0DD796C5B535902F1BF
1424Запит документів.pdf.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Obtext
MD5:F33699C8BD2ED4F4D70C93BCBC7B9615
SHA256:D60A6C600830843FBE57C35E5137B1391AA54C1CE44EA8D285A81A778EA2F31D
1424Запит документів.pdf.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Princessbinary
MD5:D34AC59C2EB257FF9A04E424B53126E6
SHA256:6D3E063ABDBCF659CD3A29124956C19DADFD5F8DB5D24C9098A760FBF4B033F7
1544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1544.26689\Запит\Запит документів.part1.rarcompressed
MD5:BFE26D78DA78B4F914C438B9A3CA2243
SHA256:E858A5A166251F86E7B9CC1E8CC164ED2C4AA32489AB64D24FC1EF59C7AABF66
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2532
Beginners.pif
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
955 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2532
Beginners.pif
77.105.132.70:2404
—
Plus Telecom LLC
RU
unknown
2532
Beginners.pif
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious
2532
Beginners.pif
77.105.132.70:5651
—
Plus Telecom LLC
RU
unknown

DNS requests

Domain
IP
Reputation
gHgcksiaPezXgQNKDRBi.gHgcksiaPezXgQNKDRBi
  • —
unknown
geoplugin.net
  • 178.237.33.50
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2532
Beginners.pif
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2532
Beginners.pif
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Запит.rar