analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Reymen.rar

Full analysis: https://app.any.run/tasks/b3af4783-a50f-4854-bac6-f4f0730117a1
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: January 17, 2020, 19:06:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

121B88ACF16A27E5E6D5639AA664FCDC

SHA1:

B7A73E947FB23ACAA58369539D2EB3254716ADD1

SHA256:

756F2D787921FEC59289B0E010BA82576CAB2FFFEBD565A50E7EF943C8D24653

SSDEEP:

98304:UiKQcO2KQzUk7IiNlrkc0HBfR+NbBQH1KLmDINiY/OH6FrOnSn2mkxx75ya:U32FQ3IiNlrkc0HP2+0WEOHhnSn2vP8a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Reymen Smartgaga v1.exe (PID: 2040)
      • ._cache_Reymen Smartgaga v1.exe (PID: 3212)
      • Reymen Smartgaga v1.exe (PID: 2612)
      • Synaptics.exe (PID: 2828)
      • ._cache_Reymen Smartgaga v1.exe (PID: 1724)
    • Changes the autorun value in the registry

      • Reymen Smartgaga v1.exe (PID: 2040)
    • Connects to CnC server

      • Synaptics.exe (PID: 2828)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 928)
      • Reymen Smartgaga v1.exe (PID: 2040)
      • Reymen Smartgaga v1.exe (PID: 2612)
    • Creates files in the program directory

      • Reymen Smartgaga v1.exe (PID: 2040)
    • Connects to unusual port

      • Synaptics.exe (PID: 2828)
  • INFO

    • Manual execution by user

      • Reymen Smartgaga v1.exe (PID: 2612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start winrar.exe reymen smartgaga v1.exe ._cache_reymen smartgaga v1.exe synaptics.exe reymen smartgaga v1.exe ._cache_reymen smartgaga v1.exe

Process information

PID
CMD
Path
Indicators
Parent process
928"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Reymen.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2040"C:\Users\admin\AppData\Local\Temp\Rar$EXa928.2043\Reymen Smartgaga v1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa928.2043\Reymen Smartgaga v1.exe
WinRAR.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
3212"C:\Users\admin\AppData\Local\Temp\Rar$EXa928.2043\._cache_Reymen Smartgaga v1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa928.2043\._cache_Reymen Smartgaga v1.exe
Reymen Smartgaga v1.exe
User:
admin
Company:
Reymen
Integrity Level:
MEDIUM
Description:
Reymen
Exit code:
3221225477
Version:
2.0.0.0
2828"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
Reymen Smartgaga v1.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
2612"C:\Users\admin\Desktop\Reymen Smartgaga v1.exe" C:\Users\admin\Desktop\Reymen Smartgaga v1.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
1724"C:\Users\admin\Desktop\._cache_Reymen Smartgaga v1.exe" C:\Users\admin\Desktop\._cache_Reymen Smartgaga v1.exe
Reymen Smartgaga v1.exe
User:
admin
Company:
Reymen
Integrity Level:
MEDIUM
Description:
Reymen
Exit code:
3221225477
Version:
2.0.0.0
Total events
1 048
Read events
943
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040Reymen Smartgaga v1.exeC:\ProgramData\Synaptics\RCXCF02.tmp
MD5:
SHA256:
928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa928.4549\Reymen Smartgaga v1.exe
MD5:
SHA256:
928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa928.2043\Reymen Smartgaga v1.exeexecutable
MD5:1078ACE0682FC16AC5F42186A563B72F
SHA256:1A5EBC9285DC0FDD4C646CF0557D3D66FEA193DB744C805F8F73E1EDAEC1E056
2040Reymen Smartgaga v1.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa928.2043\._cache_Reymen Smartgaga v1.exeexecutable
MD5:06A19B8040B673E2F69EFE324E79C6CB
SHA256:6728CDBFF5C8419E37BDFDBD37B159D71390161E542F99C6A9FC4C46DA2F9181
2040Reymen Smartgaga v1.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:0E97FC79B34E70090B469EE65FC10522
SHA256:37894BCDF10C7E8A54FFD2B978097C0E79A66822E35FF9B0E1F81C648684128C
2612Reymen Smartgaga v1.exeC:\Users\admin\Desktop\._cache_Reymen Smartgaga v1.exeexecutable
MD5:06A19B8040B673E2F69EFE324E79C6CB
SHA256:6728CDBFF5C8419E37BDFDBD37B159D71390161E542F99C6A9FC4C46DA2F9181
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2828
Synaptics.exe
GET
200
204.140.20.21:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
US
text
31 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2828
Synaptics.exe
101.86.170.36:1199
xred.mooo.com
China Telecom (Group)
CN
suspicious
2828
Synaptics.exe
204.140.20.21:80
freedns.afraid.org
Datacate Inc.
US
malicious

DNS requests

Domain
IP
Reputation
xred.mooo.com
  • 101.86.170.36
suspicious
freedns.afraid.org
  • 204.140.20.21
  • 50.23.197.94
whitelisted

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
2828
Synaptics.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Bloat-A
2 ETPRO signatures available at the full report
No debug info