File name:

Neshta Ramnit.7z

Full analysis: https://app.any.run/tasks/966edfe2-1967-464a-8122-d4d0b54c9b21
Verdict: Malicious activity
Threats:

Ramnit is a highly modular banking trojan and worm that evolved from a file-infecting virus into a powerful cybercrime tool. It specializes in financial fraud, credential theft, remote access, and malware delivery, being a serious threat to businesses and individuals. First spotted in 2010, Ramnit became popular after the 2014 takedown of the GameOver Zeus botnet, as cybercriminals sought alternatives for banking fraud.

Malware Trends Tracker     >>>
Analysis date: August 18, 2021, 16:07:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ramnit
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

207760DEA1A3B48B3BD79465DC017CE9

SHA1:

627EEA291560284A26F60C951BB3E30D784E5A93

SHA256:

785AD0E8D224280B8A2A1282B1C671CC5C008353F13A711AD4BA47AD3A3B5889

SSDEEP:

196608:Nz6l1xJ0RV0MkBr9tDRz4X/s66WzIXbPAjG4zcV44mzH43zti1ZzFOo:56l1ERevZt4XV6WQbPch46Hwi5Oo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Neshta - (1).exe (PID: 1300)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (1).exe (PID: 3492)
      • Neshta - (3).exe (PID: 2740)
      • Neshta - (1).exe (PID: 3500)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (2).exe (PID: 2012)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (7).exe (PID: 2444)
      • Neshta - (8).exe (PID: 2212)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (10).exe (PID: 2120)
      • Neshta - (12).exe (PID: 2072)
      • Ramnit - (1).exe (PID: 3560)
      • Neshta - (3).exe (PID: 3668)
      • Ramnit - (1).exe (PID: 1936)
      • Neshta - (4).exe (PID: 1588)
      • Neshta - (13).exe (PID: 1568)
      • Ramnit - (2).exe (PID: 1232)
      • Ramnit - (2).exe (PID: 564)
      • Neshta - (6).exe (PID: 3248)
      • Ramnit - (3).exe (PID: 3640)
      • Ramnit - (3).exe (PID: 3368)
      • sfseunjd.exe (PID: 3276)
      • Neshta - (5).exe (PID: 588)
      • Ramnit - (4).exe (PID: 2316)
      • Ramnit - (4).exe (PID: 3256)
      • Ramnit - (5).exe (PID: 3228)
      • Ramnit - (5).exe (PID: 3032)
      • Ramnit - (6).exe (PID: 740)
      • Neshta - (7).exe (PID: 2384)
      • Ramnit - (6).exe (PID: 2080)
      • Ramnit - (7).exe (PID: 2904)
      • Neshta - (12).exe (PID: 2768)
      • Neshta - (12).exe (PID: 3748)
      • Neshta - (9).exe (PID: 2656)
      • Neshta - (11).exe (PID: 3960)
      • Neshta - (13).exe (PID: 1456)
      • alawsixx.exe (PID: 3580)
      • JRuler.exe (PID: 2696)
      • sfseunjd.exe (PID: 2892)
      • JRuler.exe (PID: 384)
      • JRuler.exe (PID: 3108)
      • Notepad2_4.2.25_x86.exe (PID: 2876)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • Notepad2_4.2.25_x86.exe (PID: 3700)
      • JRuler.exe (PID: 2824)
      • wrar602.exe (PID: 3668)
      • wrar602.exe (PID: 1344)
      • wrar602.exe (PID: 1532)
      • uninstall.exe (PID: 568)
      • desktoptimer.exe (PID: 740)
      • desktoptimer.exe (PID: 2112)
      • desktoptimer.exe (PID: 732)
      • DesktopTimer.exe (PID: 3968)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 568)
      • JRuler.exe (PID: 1792)
      • JRuler.exe (PID: 3620)

    • Drops executable file immediately after starts

      • Neshta - (1).exe (PID: 1300)
      • Neshta - (3).exe (PID: 2740)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (7).exe (PID: 2444)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (12).exe (PID: 2072)
      • Ramnit - (1).exe (PID: 1936)
      • Neshta - (13).exe (PID: 1568)
      • Ramnit - (2).exe (PID: 1232)
      • Ramnit - (3).exe (PID: 3640)
      • Ramnit - (3).exe (PID: 3368)
      • sfseunjd.exe (PID: 3276)
      • svchost.exe (PID: 3220)
      • Ramnit - (4).exe (PID: 2316)
      • Ramnit - (5).exe (PID: 3228)
      • iexplore.exe (PID: 3760)
      • Explorer.EXE (PID: 1724)
      • JRuler.exe (PID: 2824)
      • JRuler.exe (PID: 2696)
      • Notepad2_4.2.25_x86.exe (PID: 3700)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • wrar602.exe (PID: 3668)
      • desktoptimer.exe (PID: 740)
      • desktoptimer.exe (PID: 732)
      • desktoptimer.exe (PID: 2112)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 1792)

    • Uses SVCHOST.EXE for hidden code execution

      • sfseunjd.exe (PID: 3276)
      • sfseunjd.exe (PID: 2892)

    • Writes to a start menu file

      • svchost.exe (PID: 3220)
      • iexplore.exe (PID: 3760)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 3220)
      • Explorer.EXE (PID: 1724)
      • alawsixx.exe (PID: 3580)
      • desktoptimer.tmp (PID: 3276)

    • Runs injected code in another process

      • iexplore.exe (PID: 2384)
      • Neshta - (12).exe (PID: 2768)

    • Application was injected by another process

      • taskeng.exe (PID: 432)
      • Dwm.exe (PID: 1004)
      • ctfmon.exe (PID: 1488)
      • DllHost.exe (PID: 2504)
      • Explorer.EXE (PID: 1724)
      • DllHost.exe (PID: 3480)
      • DllHost.exe (PID: 2848)
      • DllHost.exe (PID: 2868)
      • SearchProtocolHost.exe (PID: 2432)

    • Connects to CnC server

      • svchost.exe (PID: 3220)
      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 3760)

    • Changes Security Center notification settings

      • alawsixx.exe (PID: 3580)

    • UAC/LUA settings modification

      • alawsixx.exe (PID: 3580)

    • Changes the login/logoff helper path in the registry

      • iexplore.exe (PID: 960)
      • alawsixx.exe (PID: 3580)

    • Modifies Windows Defender service settings

      • alawsixx.exe (PID: 3580)

    • Changes firewall settings

      • alawsixx.exe (PID: 3580)

    • Modifies Windows security services settings

      • alawsixx.exe (PID: 3580)

    • RAMNIT was detected

      • svchost.exe (PID: 3220)
      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 3760)

    • Changes Image File Execution Options

      • Notepad2_4.2.25_x86.exe (PID: 3856)

    • Loads dropped or rewritten executable

      • WinRAR.exe (PID: 688)
      • chrome.exe (PID: 384)
      • svchost.exe (PID: 1772)
      • chrome.exe (PID: 2860)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 688)
      • Neshta - (1).exe (PID: 1300)
      • Neshta - (1).exe (PID: 3500)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (2).exe (PID: 2012)
      • Neshta - (3).exe (PID: 2740)
      • Neshta - (3).exe (PID: 3668)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (4).exe (PID: 1588)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (6).exe (PID: 3248)
      • Neshta - (8).exe (PID: 2212)
      • Neshta - (7).exe (PID: 2444)
      • Neshta - (7).exe (PID: 2384)
      • dw20.exe (PID: 2684)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (10).exe (PID: 2120)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (12).exe (PID: 2072)
      • Neshta - (12).exe (PID: 3748)
      • Ramnit - (1).exe (PID: 1936)
      • Neshta - (13).exe (PID: 1568)
      • Neshta - (12).exe (PID: 2768)
      • Neshta - (13).exe (PID: 1456)
      • Ramnit - (1).exe (PID: 3560)
      • Ramnit - (2).exe (PID: 1232)
      • Ramnit - (2).exe (PID: 564)
      • Ramnit - (3).exe (PID: 3640)
      • Ramnit - (3).exe (PID: 3368)
      • sfseunjd.exe (PID: 3276)
      • Ramnit - (4).exe (PID: 2316)
      • Ramnit - (5).exe (PID: 3228)
      • Ramnit - (4).exe (PID: 3256)
      • Ramnit - (5).exe (PID: 3032)
      • Ramnit - (6).exe (PID: 740)
      • Ramnit - (6).exe (PID: 2080)
      • Ramnit - (7).exe (PID: 2904)
      • cmd.exe (PID: 2284)
      • alawsixx.exe (PID: 3580)
      • sfseunjd.exe (PID: 2892)
      • JRuler.exe (PID: 2696)
      • JRuler.exe (PID: 384)
      • JRuler.exe (PID: 2824)
      • JRuler.exe (PID: 3108)
      • Notepad2_4.2.25_x86.exe (PID: 2876)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • Notepad2_4.2.25_x86.exe (PID: 3700)
      • wrar602.exe (PID: 3668)
      • wrar602.exe (PID: 1532)
      • desktoptimer.exe (PID: 740)
      • uninstall.exe (PID: 568)
      • desktoptimer.tmp (PID: 1392)
      • desktoptimer.exe (PID: 2112)
      • desktoptimer.exe (PID: 732)
      • DesktopTimer.exe (PID: 3968)
      • desktoptimer.tmp (PID: 3276)
      • JRuler.exe (PID: 568)
      • JRuler.exe (PID: 1792)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 3620)

    • Reads the computer name

      • WinRAR.exe (PID: 688)
      • Neshta - (1).exe (PID: 1300)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (2).exe (PID: 2012)
      • Neshta - (3).exe (PID: 2740)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (6).exe (PID: 3248)
      • Neshta - (7).exe (PID: 2444)
      • dw20.exe (PID: 2684)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (12).exe (PID: 2072)
      • Ramnit - (1).exe (PID: 1936)
      • Neshta - (13).exe (PID: 1568)
      • Ramnit - (2).exe (PID: 1232)
      • Ramnit - (3).exe (PID: 3640)
      • Ramnit - (3).exe (PID: 3368)
      • sfseunjd.exe (PID: 3276)
      • Ramnit - (2).exe (PID: 564)
      • Ramnit - (4).exe (PID: 2316)
      • Ramnit - (5).exe (PID: 3228)
      • Ramnit - (5).exe (PID: 3032)
      • Ramnit - (4).exe (PID: 3256)
      • Ramnit - (6).exe (PID: 740)
      • Neshta - (3).exe (PID: 3668)
      • Ramnit - (6).exe (PID: 2080)
      • Ramnit - (7).exe (PID: 2904)
      • Ramnit - (1).exe (PID: 3560)
      • alawsixx.exe (PID: 3580)
      • sfseunjd.exe (PID: 2892)
      • JRuler.exe (PID: 384)
      • JRuler.exe (PID: 2696)
      • JRuler.exe (PID: 2824)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • JRuler.exe (PID: 3108)
      • Notepad2_4.2.25_x86.exe (PID: 3700)
      • Notepad2_4.2.25_x86.exe (PID: 2876)
      • wrar602.exe (PID: 3668)
      • wrar602.exe (PID: 1532)
      • uninstall.exe (PID: 568)
      • desktoptimer.exe (PID: 732)
      • desktoptimer.tmp (PID: 1392)
      • desktoptimer.exe (PID: 740)
      • desktoptimer.tmp (PID: 3276)
      • DesktopTimer.exe (PID: 3968)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 568)
      • JRuler.exe (PID: 1792)
      • JRuler.exe (PID: 3620)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 688)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (7).exe (PID: 2444)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (13).exe (PID: 1568)
      • wrar602.exe (PID: 3668)
      • wrar602.exe (PID: 1532)
      • desktoptimer.tmp (PID: 3276)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 688)
      • Neshta - (1).exe (PID: 1300)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (13).exe (PID: 1568)
      • Ramnit - (1).exe (PID: 3560)
      • Ramnit - (5).exe (PID: 3228)
      • iexplore.exe (PID: 3760)
      • JRuler.exe (PID: 2696)
      • JRuler.exe (PID: 2824)
      • desktoptimer.exe (PID: 732)
      • desktoptimer.exe (PID: 740)
      • desktoptimer.tmp (PID: 3276)
      • desktoptimer.exe (PID: 2112)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 1792)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 688)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (1).exe (PID: 1300)
      • Neshta - (3).exe (PID: 2740)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (7).exe (PID: 2444)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (12).exe (PID: 2072)
      • Ramnit - (1).exe (PID: 1936)
      • Neshta - (13).exe (PID: 1568)
      • Ramnit - (2).exe (PID: 1232)
      • Ramnit - (1).exe (PID: 3560)
      • Ramnit - (3).exe (PID: 3640)
      • Ramnit - (3).exe (PID: 3368)
      • sfseunjd.exe (PID: 3276)
      • svchost.exe (PID: 3220)
      • Ramnit - (4).exe (PID: 2316)
      • Ramnit - (5).exe (PID: 3228)
      • iexplore.exe (PID: 3760)
      • Explorer.EXE (PID: 1724)
      • JRuler.exe (PID: 2696)
      • JRuler.exe (PID: 2824)
      • Notepad2_4.2.25_x86.exe (PID: 3700)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • wrar602.exe (PID: 1532)
      • wrar602.exe (PID: 3668)
      • desktoptimer.exe (PID: 740)
      • desktoptimer.exe (PID: 732)
      • desktoptimer.exe (PID: 2112)
      • desktoptimer.tmp (PID: 3276)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 1792)

    • Application launched itself

      • Neshta - (12).exe (PID: 3748)
      • Notepad2_4.2.25_x86.exe (PID: 2876)

    • Starts itself from another location

      • Ramnit - (3).exe (PID: 3368)
      • Ramnit - (6).exe (PID: 2080)

    • Creates files in the user directory

      • svchost.exe (PID: 3220)
      • Explorer.EXE (PID: 1724)
      • Notepad2_4.2.25_x86.exe (PID: 3856)

    • Creates files in the program directory

      • svchost.exe (PID: 3220)
      • Ramnit - (7).exe (PID: 2904)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • wrar602.exe (PID: 1532)

    • Creates files in the Windows directory

      • sdbinst.exe (PID: 2212)
      • sdbinst.exe (PID: 3108)
      • Notepad2_4.2.25_x86.exe (PID: 3856)

    • Creates a software uninstall entry

      • sdbinst.exe (PID: 2212)
      • sdbinst.exe (PID: 3108)
      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • uninstall.exe (PID: 568)

    • Starts Internet Explorer

      • Ramnit - (5).exe (PID: 3032)
      • Explorer.EXE (PID: 1724)
      • Ramnit - (7).exe (PID: 2904)
      • desktoptimer.tmp (PID: 3276)

    • Starts CMD.EXE for commands execution

      • sfseunjd.exe (PID: 3276)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 1724)

    • Removes files from Windows directory

      • sdbinst.exe (PID: 3108)

    • Creates a directory in Program Files

      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • desktoptimer.tmp (PID: 3276)

    • Reads Microsoft Outlook installation path

      • wrar602.exe (PID: 1532)
      • iexplore.exe (PID: 4060)

    • Reads internet explorer settings

      • wrar602.exe (PID: 1532)

    • Changes default file association

      • Notepad2_4.2.25_x86.exe (PID: 3856)
      • uninstall.exe (PID: 568)

    • Creates/Modifies COM task schedule object

      • uninstall.exe (PID: 568)

    • Searches for installed software

      • uninstall.exe (PID: 568)

    • Reads Windows owner or organization settings

      • desktoptimer.tmp (PID: 3276)

    • Reads the Windows organization settings

      • desktoptimer.tmp (PID: 3276)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2068)

  • INFO

    • Checks supported languages

      • DllHost.exe (PID: 2504)
      • svchost.exe (PID: 696)
      • svchost.exe (PID: 3220)
      • sdbinst.exe (PID: 2212)
      • iexplore.exe (PID: 2384)
      • iexplore.exe (PID: 3760)
      • iexplore.exe (PID: 3316)
      • iscsicli.exe (PID: 4084)
      • iexplore.exe (PID: 960)
      • sdbinst.exe (PID: 3720)
      • DllHost.exe (PID: 3480)
      • svchost.exe (PID: 3256)
      • sdbinst.exe (PID: 3108)
      • iscsicli.exe (PID: 1344)
      • sdbinst.exe (PID: 2180)
      • svchost.exe (PID: 2292)
      • DllHost.exe (PID: 2848)
      • DllHost.exe (PID: 2868)
      • iexplore.exe (PID: 4060)
      • SearchProtocolHost.exe (PID: 2432)
      • iexplore.exe (PID: 2368)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 1632)
      • chrome.exe (PID: 1648)
      • chrome.exe (PID: 560)
      • chrome.exe (PID: 3564)
      • chrome.exe (PID: 2512)
      • chrome.exe (PID: 1984)
      • chrome.exe (PID: 3104)
      • chrome.exe (PID: 1456)
      • chrome.exe (PID: 2672)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 384)
      • chrome.exe (PID: 188)
      • chrome.exe (PID: 1176)
      • chrome.exe (PID: 1824)
      • chrome.exe (PID: 3000)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 2540)
      • chrome.exe (PID: 2860)
      • chrome.exe (PID: 2292)
      • chrome.exe (PID: 2576)
      • svchost.exe (PID: 1772)
      • chrome.exe (PID: 360)
      • chrome.exe (PID: 3396)

    • Reads the computer name

      • DllHost.exe (PID: 2504)
      • svchost.exe (PID: 3220)
      • svchost.exe (PID: 696)
      • iexplore.exe (PID: 3760)
      • iexplore.exe (PID: 2384)
      • iexplore.exe (PID: 960)
      • iscsicli.exe (PID: 4084)
      • iexplore.exe (PID: 3316)
      • DllHost.exe (PID: 3480)
      • svchost.exe (PID: 2292)
      • svchost.exe (PID: 3256)
      • iscsicli.exe (PID: 1344)
      • DllHost.exe (PID: 2848)
      • DllHost.exe (PID: 2868)
      • iexplore.exe (PID: 2368)
      • iexplore.exe (PID: 4060)
      • SearchProtocolHost.exe (PID: 2432)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 1632)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 560)
      • chrome.exe (PID: 1456)
      • chrome.exe (PID: 384)
      • chrome.exe (PID: 2860)
      • chrome.exe (PID: 2292)
      • chrome.exe (PID: 3396)

    • Manual execution by user

      • Neshta - (1).exe (PID: 1300)
      • Neshta - (2).exe (PID: 4016)
      • Neshta - (3).exe (PID: 2740)
      • Neshta - (4).exe (PID: 2848)
      • Neshta - (5).exe (PID: 2496)
      • Neshta - (6).exe (PID: 2792)
      • Neshta - (7).exe (PID: 2444)
      • Neshta - (8).exe (PID: 2212)
      • Neshta - (9).exe (PID: 3356)
      • Neshta - (11).exe (PID: 3824)
      • Neshta - (10).exe (PID: 2120)
      • Neshta - (12).exe (PID: 2072)
      • Ramnit - (1).exe (PID: 1936)
      • Neshta - (13).exe (PID: 1568)
      • Ramnit - (2).exe (PID: 1232)
      • Ramnit - (3).exe (PID: 3640)
      • Ramnit - (4).exe (PID: 2316)
      • Ramnit - (5).exe (PID: 3228)
      • Ramnit - (6).exe (PID: 740)
      • Ramnit - (7).exe (PID: 2904)
      • iexplore.exe (PID: 3316)
      • JRuler.exe (PID: 2696)
      • JRuler.exe (PID: 2824)
      • Notepad2_4.2.25_x86.exe (PID: 3700)
      • wrar602.exe (PID: 3668)
      • desktoptimer.exe (PID: 740)
      • JRuler.exe (PID: 340)
      • JRuler.exe (PID: 1792)
      • chrome.exe (PID: 2068)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 688)
      • chrome.exe (PID: 2068)

    • Reads settings of System Certificates

      • Neshta - (2).exe (PID: 2012)
      • Neshta - (6).exe (PID: 3248)
      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 2368)
      • chrome.exe (PID: 560)

    • Checks Windows Trust Settings

      • Neshta - (2).exe (PID: 2012)
      • Neshta - (6).exe (PID: 3248)
      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 2368)

    • Creates files in the user directory

      • iexplore.exe (PID: 3760)
      • iexplore.exe (PID: 3316)
      • iexplore.exe (PID: 4060)

    • Loads dropped or rewritten executable

      • desktoptimer.tmp (PID: 3276)

    • Creates files in the program directory

      • desktoptimer.tmp (PID: 3276)

    • Creates a software uninstall entry

      • desktoptimer.tmp (PID: 3276)

    • Application was dropped or rewritten from another process

      • desktoptimer.tmp (PID: 1392)
      • desktoptimer.tmp (PID: 3276)

    • Changes internet zones settings

      • iexplore.exe (PID: 2368)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4060)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4060)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4060)

    • Application launched itself

      • iexplore.exe (PID: 2368)
      • chrome.exe (PID: 2068)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2368)
      • chrome.exe (PID: 2860)

    • Reads the hosts file

      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
122
Malicious processes
46
Suspicious processes
10

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject inject inject inject inject inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe neshta - (1).exe neshta - (1).exe no specs neshta - (1).exe neshta - (2).exe neshta - (2).exe no specs neshta - (3).exe neshta - (3).exe no specs neshta - (4).exe neshta - (4).exe no specs neshta - (5).exe neshta - (5).exe no specs neshta - (6).exe neshta - (6).exe neshta - (7).exe neshta - (7).exe no specs neshta - (8).exe no specs dw20.exe no specs neshta - (9).exe neshta - (9).exe no specs neshta - (10).exe no specs neshta - (11).exe neshta - (11).exe no specs neshta - (12).exe neshta - (12).exe no specs neshta - (12).exe no specs neshta - (13).exe neshta - (13).exe no specs ramnit - (1).exe ramnit - (1).exe ramnit - (2).exe ramnit - (2).exe no specs ramnit - (3).exe ramnit - (3).exe sfseunjd.exe #RAMNIT svchost.exe svchost.exe no specs sdbinst.exe no specs ramnit - (4).exe ramnit - (4).exe no specs ramnit - (5).exe sdbinst.exe iscsicli.exe no specs ramnit - (5).exe no specs #RAMNIT iexplore.exe iexplore.exe no specs ramnit - (6).exe no specs taskeng.exe dwm.exe ctfmon.exe Thumbnail Cache Class Factory for Out of Proc Server ramnit - (6).exe no specs ramnit - (7).exe explorer.exe iexplore.exe no specs iscsicli.exe #RAMNIT iexplore.exe sdbinst.exe no specs sdbinst.exe cmd.exe alawsixx.exe Thumbnail Cache Class Factory for Out of Proc Server sfseunjd.exe no specs svchost.exe no specs svchost.exe no specs sdbinst.exe no specs sdbinst.exe iscsicli.exe no specs iscsicli.exe sdbinst.exe no specs sdbinst.exe jruler.exe jruler.exe no specs jruler.exe jruler.exe no specs notepad2_4.2.25_x86.exe notepad2_4.2.25_x86.exe no specs notepad2_4.2.25_x86.exe wrar602.exe wrar602.exe no specs wrar602.exe uninstall.exe no specs Thumbnail Cache Class Factory for Out of Proc Server desktoptimer.exe desktoptimer.exe desktoptimer.tmp no specs desktoptimer.exe desktoptimer.tmp desktoptimer.exe no specs iexplore.exe iexplore.exe DllHost.exe searchprotocolhost.exe jruler.exe jruler.exe no specs jruler.exe jruler.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs svchost.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,6317281003166757808,15949580386602241053,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3252 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
340"C:\Users\admin\Desktop\JRuler.exe" C:\Users\admin\Desktop\JRuler.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\jruler.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
360"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1052,6317281003166757808,15949580386602241053,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
384"C:\Users\admin\AppData\Local\Temp\3582-490\JRuler.exe" C:\Users\admin\AppData\Local\Temp\3582-490\JRuler.exe—JRuler.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\jruler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1052,6317281003166757808,15949580386602241053,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
432taskeng.exe {E7C81B1A-34CA-46B5-933E-02C92A917A9F}C:\Windows\system32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1052,6317281003166757808,15949580386602241053,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1328 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
564"C:\Users\admin\AppData\Local\Temp\3582-490\Ramnit - (2).exe" C:\Users\admin\AppData\Local\Temp\3582-490\Ramnit - (2).exe—Ramnit - (2).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\ramnit - (2).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
568"C:\Program Files\WinRAR\uninstall.exe" /setupC:\Program Files\WinRAR\uninstall.exe—wrar602.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
Uninstall WinRAR
Exit code:
0
Version:
6.2.0
Modules
Images
c:\program files\winrar\uninstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
568"C:\Users\admin\AppData\Local\Temp\3582-490\JRuler.exe" C:\Users\admin\AppData\Local\Temp\3582-490\JRuler.exe—JRuler.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\jruler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
75 875
Read events
74 262
Write events
1 585
Delete events
28

Modification events

(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(688) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\171\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Neshta Ramnit.7z
(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1724) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(1724) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
100
Suspicious files
111
Text files
313
Unknown types
66

Dropped files

PID
Process
Filename
Type
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (10).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (11).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (13).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (6).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (12).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (2).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (1).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (3).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (4).exeexecutable
MD5:—
SHA256:—
688WinRAR.exeC:\Users\admin\Desktop\Fileinfectors\Neshta - (9).exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
107
DNS requests
111
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4060
iexplore.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/freedesktoptimerlike.html
DE
html
6.01 Kb
suspicious
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/menubackgroundside2.jpg
DE
image
1.35 Kb
suspicious
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/slider/slider.js
DE
text
3.00 Kb
suspicious
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/bodybackground.png
DE
image
11.6 Kb
suspicious
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/button.css
DE
text
2.71 Kb
suspicious
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/slider/slider.css
DE
text
6.40 Kb
suspicious
4060
iexplore.exe
GET
200
78.46.117.95:80
http://freedesktopsoft.com/images/menubackground2.jpg
DE
image
16.4 Kb
suspicious
4060
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8dead6c8fdcc44a6
US
compressed
4.70 Kb
whitelisted
4060
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?68f1314e50399902
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3220
svchost.exe
63.251.235.76:443
jugapqqyejdhysgdymv.com
Voxel Dot Net, Inc.
US
malicious
3760
iexplore.exe
52.16.225.15:447
tvrstrynyvwstrtve.com
Amazon.com, Inc.
IE
whitelisted
3760
iexplore.exe
18.235.92.123:447
wqerveybrstyhcerveantbe.com
—
US
malicious
3760
iexplore.exe
45.55.36.236:447
rtvwerjyuver.com
Digital Ocean, Inc.
US
malicious
4060
iexplore.exe
78.46.117.95:80
freedesktopsoft.com
Hetzner Online GmbH
DE
suspicious
4060
iexplore.exe
172.217.22.206:443
www.google-analytics.com
Google Inc.
US
whitelisted
4060
iexplore.exe
142.250.185.98:443
pagead2.googlesyndication.com
Google Inc.
US
shared
3248
Neshta - (6).exe
205.185.216.42:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3560
Ramnit - (1).exe
42.51.7.143:2014
—
Henan Telcom Union Technology Co., LTD
CN
unknown
3220
svchost.exe
142.250.184.238:80
google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
  • 93.184.221.240
whitelisted
google.com
  • 142.250.184.238
malicious
supnewdmn.com
  • 82.112.184.197
malicious
revivalresumed.com
  • —
malicious
uhhoatxt.com
  • —
malicious
yijlxkulyqfcgfecneu.com
  • 195.201.179.207
malicious
vxasusphxwkdktm.com
  • —
malicious
yractfrwrctboagip.com
  • —
unknown
hvkteatvnctsgrie.com
  • —
malicious
rkwqxdlhwsbpsoiipkl.com
  • —
unknown

Threats

PID
Process
Class
Message
3220
svchost.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
—
—
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
960
iexplore.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
3220
svchost.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
960
iexplore.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
3760
iexplore.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
3760
iexplore.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
3220
svchost.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
3220
svchost.exe
A Network Trojan was detected
ET TROJAN Win32/Ramnit Checkin
Process
Message
alawsixx.exe
CheckBypassed ok
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Neshta Ramnit.7z