File name:

Note d_information.pdf.bin.zip

Full analysis: https://app.any.run/tasks/b1dc5602-3129-4838-ac92-a89ed88d1ced
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: May 15, 2019, 15:39:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
rat
remcos
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

37240381D523AFD3F81117FA811B12C2

SHA1:

5F7EBA0E0447D5A0869CD29F1C87E3A700B43F15

SHA256:

7DB8D65D4F313AC1572D4AF08E1FC6187E81D76A1B804FE7994D5D6ED9291E53

SSDEEP:

6144:WkvTJbJVjNQL3e2YC6mLs4uBdN3DrgZ6SsWE8+RxGa:WcTJFVxQLO+lL24677xGa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Note d_information.pdf.exe (PID: 3624)
    • Detected logs from REMCOS RAT

      • nslookup.exe (PID: 2888)
    • Loads dropped or rewritten executable

      • Note d_information.pdf.exe (PID: 3624)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3004)
      • Note d_information.pdf.exe (PID: 3624)
    • Creates files in the user directory

      • nslookup.exe (PID: 2888)
    • Writes files like Keylogger logs

      • nslookup.exe (PID: 2888)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:05:13 15:47:08
ZipCRC: 0x9971c403
ZipCompressedSize: 309118
ZipUncompressedSize: 688798
ZipFileName: Note d_information.pdf.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe note d_information.pdf.exe #REMCOS nslookup.exe

Process information

PID
CMD
Path
Indicators
Parent process
2888"C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe
Note d_information.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\ed46c336.tmp
c:\windows\system32\nslookup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3004"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Note d_information.pdf.bin.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3624"C:\Users\admin\Desktop\Note d_information.pdf.exe" C:\Users\admin\Desktop\Note d_information.pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\note d_information.pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
709
Read events
687
Write events
22
Delete events
0

Modification events

(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Note d_information.pdf.bin.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
4
Suspicious files
1
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3624Note d_information.pdf.exeC:\Users\admin\AppData\Local\Temp\ed46c336.tmp
MD5:
SHA256:
3624Note d_information.pdf.exeC:\Users\admin\AppData\Local\Temp\nsu5109.tmp
MD5:
SHA256:
3004WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3004.32360\Note d_information.pdf.binexecutable
MD5:
SHA256:
3624Note d_information.pdf.exeC:\Users\admin\AppData\Local\Temp\Knowledgebinary
MD5:
SHA256:
3624Note d_information.pdf.exeC:\Users\admin\AppData\Local\Temp\westernism.dllexecutable
MD5:
SHA256:
2888nslookup.exeC:\Users\admin\AppData\Local\Temp\ed54379a.lnklnk
MD5:
SHA256:
2888nslookup.exeC:\Users\admin\AppData\Roaming\windowse\logs.dattext
MD5:
SHA256:
3624Note d_information.pdf.exeC:\Users\admin\AppData\Local\Temp\vmmouse.sysexecutable
MD5:
SHA256:
3624Note d_information.pdf.exeC:\Users\admin\AppData\Local\Temp\nso5138.tmp\System.dllexecutable
MD5:FBE295E5A1ACFBD0A6271898F885FE6A
SHA256:A1390A78533C47E55CC364E97AF431117126D04A7FAED49390210EA3E89DD0E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
24
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2888
nslookup.exe
83.97.18.132:2404
driver.eimaragon.org
unknown

DNS requests

Domain
IP
Reputation
driver.eimaragon.org
  • 83.97.18.132
malicious

Threats

No threats detected
No debug info