| File name: | Proxy Checker v0.2 By X-SLAYER.zip |
| Full analysis: | https://app.any.run/tasks/5eacd8c2-a8b8-4dab-ace4-a218cee0fb23 |
| Verdict: | Malicious activity |
| Threats: | Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS. |
| Analysis date: | December 20, 2018, 12:24:52 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | 710CB848CADA85990C093C24BE663153 |
| SHA1: | 04AFE4FBCBEA4806C26462D084D0DC3539735D40 |
| SHA256: | 71C67DBF56BA2AC3F4FAF16719139E12884B847A0D3C71C471D1A2D591098628 |
| SSDEEP: | 98304:7YnprQM38THBYTBpWT/bdIJwxJdqafvr9hbNl6NL45/r8NNkGbcYsz4uR:7YSMMbGePdPxjpH/bNl6NLcDk6GYL1 |
MALICIOUS
Application was dropped or rewritten from another process
- proxy.exe (PID: 2344)
- proxy.exe (PID: 3528)
- svchost.exe (PID: 2668)
- svchost.exe (PID: 3780)
- Proxy Checker v0.2 By X-SLAYER.exe (PID: 2620)
Changes the autorun value in the registry
- svchost.exe (PID: 3780)
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 692)
- Proxy Checker v0.2 By X-SLAYER.exe (PID: 2620)
NETWIRE was detected
- svchost.exe (PID: 3780)
Connects to CnC server
- svchost.exe (PID: 3780)
SUSPICIOUS
Executable content was dropped or overwritten
- Proxy Checker v0.2 By X-SLAYER .exe (PID: 2936)
- proxy.exe (PID: 3528)
- Proxy Checker v0.2 By X-SLAYER.exe (PID: 2620)
Creates files in the user directory
- proxy.exe (PID: 3528)
- svchost.exe (PID: 3780)
Application launched itself
- Proxy Checker v0.2 By X-SLAYER .exe (PID: 2304)
Creates executable files which already exist in Windows
- proxy.exe (PID: 3528)
Connects to unusual port
- svchost.exe (PID: 3780)
Uses NETSTAT.EXE to discover network connections
- cmd.exe (PID: 960)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2018:12:20 11:43:21 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Proxy Checker v0.2 By X-SLAYER/ |
Total processes
58
Monitored processes
13
Malicious processes
6
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 692 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 960 | "C:\Windows\System32\cmd.exe" | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2304 | "C:\Users\admin\Desktop\Proxy Checker v0.2 By X-SLAYER\Proxy Checker v0.2 By X-SLAYER .exe" | C:\Users\admin\Desktop\Proxy Checker v0.2 By X-SLAYER\Proxy Checker v0.2 By X-SLAYER .exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Checker By X-SLAYER Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2344 | "C:\Users\admin\AppData\Local\Temp\proxy.exe" 0 | C:\Users\admin\AppData\Local\Temp\proxy.exe | — | Proxy Checker v0.2 By X-SLAYER .exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2620 | "C:\Users\admin\AppData\Local\Temp\Proxy Checker v0.2 By X-SLAYER.exe" 0 | C:\Users\admin\AppData\Local\Temp\Proxy Checker v0.2 By X-SLAYER.exe | Proxy Checker v0.2 By X-SLAYER .exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Checker By X-SLAYER Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2668 | "C:\Users\admin\AppData\Roaming\Microsoft\Service\svchost.exe" | C:\Users\admin\AppData\Roaming\Microsoft\Service\svchost.exe | — | proxy.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2736 | "C:\Windows\regedit.exe" | C:\Windows\regedit.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Editor Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2936 | "C:\Users\admin\Desktop\Proxy Checker v0.2 By X-SLAYER\Proxy Checker v0.2 By X-SLAYER .exe" | C:\Users\admin\Desktop\Proxy Checker v0.2 By X-SLAYER\Proxy Checker v0.2 By X-SLAYER .exe | Proxy Checker v0.2 By X-SLAYER .exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Checker By X-SLAYER Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3064 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Proxy Checker v0.2 By X-SLAYER.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3528 | "C:\Users\admin\AppData\Local\Temp\proxy.exe" 0 | C:\Users\admin\AppData\Local\Temp\proxy.exe | proxy.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
1 140
Read events
1 114
Write events
26
Delete events
0
Modification events
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Proxy Checker v0.2 By X-SLAYER.zip | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2936) Proxy Checker v0.2 By X-SLAYER .exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2936) Proxy Checker v0.2 By X-SLAYER .exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
6
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3064.22050\Proxy Checker v0.2 By X-SLAYER\GeoIP.dat | — | |
MD5:— | SHA256:— | |||
| 3064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3064.22050\Proxy Checker v0.2 By X-SLAYER\Proxy Checker v0.2 By X-SLAYER .exe | — | |
MD5:— | SHA256:— | |||
| 3064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3064.22050\Proxy Checker v0.2 By X-SLAYER\SkinSoft.VisualStyler.dll | — | |
MD5:— | SHA256:— | |||
| 3064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3064.22050\Proxy Checker v0.2 By X-SLAYER\xNet.dll | — | |
MD5:— | SHA256:— | |||
| 2936 | Proxy Checker v0.2 By X-SLAYER .exe | C:\Users\admin\AppData\Local\Temp\proxy.exe | executable | |
MD5:— | SHA256:— | |||
| 2936 | Proxy Checker v0.2 By X-SLAYER .exe | C:\Users\admin\AppData\Local\Temp\Proxy Checker v0.2 By X-SLAYER.exe | executable | |
MD5:FEBBF9DF69EBE3D276A7F36B9A072685 | SHA256:8019C6F2D3B9B541097C958B9642DDCE07C598ABB421CD3675B159A91D486E51 | |||
| 2936 | Proxy Checker v0.2 By X-SLAYER .exe | C:\Users\admin\AppData\Local\Temp\xNet.dll | executable | |
MD5:3DF8D87A482EFAD957D83819ADB3020F | SHA256:2AC175B4D44245EE8E7AEE9CC36DF86925EF903D8516F20A2C51D84E35F23DA4 | |||
| 3780 | svchost.exe | C:\Users\admin\AppData\Roaming\Microsoft\Service\Settings.ini | binary | |
MD5:— | SHA256:— | |||
| 3528 | proxy.exe | C:\Users\admin\AppData\Roaming\Microsoft\Service\svchost.exe | executable | |
MD5:— | SHA256:— | |||
| 2936 | Proxy Checker v0.2 By X-SLAYER .exe | C:\Users\admin\AppData\Local\Temp\GeoIP.dat | binary | |
MD5:953C073031A08211D72DAEEC0551A20D | SHA256:6615E1E1D8E9EE5AE891DCC43FDD050787F28227369EED50AB3403B171A187F2 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
1
Threats
15
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3780 | svchost.exe | 54.37.235.82:8999 | playhardgopro.life | OVH SAS | FR | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
playhardgopro.life |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3780 | svchost.exe | A Network Trojan was detected | SC SPYWARE Spyware Weecnaw Win32 |
3780 | svchost.exe | A Network Trojan was detected | MALWARE [PTsecurity] Netwire.RAT |
3780 | svchost.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3780 | svchost.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3780 | svchost.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3780 | svchost.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3780 | svchost.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3780 | svchost.exe | A Network Trojan was detected | SC SPYWARE Spyware Weecnaw Win32 |
3780 | svchost.exe | A Network Trojan was detected | MALWARE [PTsecurity] Netwire.RAT |
3780 | svchost.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
1 ETPRO signatures available at the full report