File name: | loader.rar |
Full analysis: | https://app.any.run/tasks/812aa9ab-8a64-402d-829f-3a17eaca7bc2 |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 13:50:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 7BC892D109ECE72C9AD4FEC7AA57BA80 |
SHA1: | 04875DDD3E90305C3751F977040FE87B4325FBB4 |
SHA256: | 92D7354B6BA641E4056C2EBBEE837409160E35D623EBB0981612425B54CBE5E0 |
SSDEEP: | 6144:eYMkveZ0gROPc/kRSLIJQy8jHTCvVdtMUQZZfvPxNm69BSKF+jxfJt2Kp+:evZ01Mkv8jHWLtQZx5Nm6LS9p+ |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
960 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\loader.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 Modules
| |||||||||||||||
3140 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3956 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | ||||||||||||
User: admin Company: pasters.cc/User-root Integrity Level: MEDIUM Description: LuminaryLoader Version: 1.0.0.0 Modules
| |||||||||||||||
1448 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | ||||||||||||
User: admin Company: pasters.cc/User-root Integrity Level: MEDIUM Description: LuminaryLoader Version: 1.0.0.0 Modules
| |||||||||||||||
3176 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | ||||||||||||
User: admin Company: pasters.cc/User-root Integrity Level: HIGH Description: LuminaryLoader Version: 1.0.0.0 Modules
|
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\loader.rar | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (960) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\system32\notepad.exe,-469 |
Value: Text Document | |||
(PID) Process: | (3140) SearchProtocolHost.exe | Key: | HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US |
PID | Process | Filename | Type | |
---|---|---|---|---|
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\ReadME_PL.txt | text | |
MD5:B2B2F92619A8C5F41FFB7B90559F4F38 | SHA256:B9F2919D30BA619045EFAA9116BFE232236C00F7FC46F4A3A4676679799D81B2 | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\configs\Legit.ini | text | |
MD5:D8A7DD5C069CCC3D182079EF5327EBF9 | SHA256:05D4B36813082DEC4C90491B878241A61F7CB567C1FCD16435F9DA121DF0FC2E | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\configs\Rage.ini | text | |
MD5:1ACA0A69819A3012017B57A7C18170AD | SHA256:429754621DA48182269D80113A9586A90C08492276DE898C7BAFB6FB7FB5A324 | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\Authed.dll | executable | |
MD5:DA5404D098B1FC3F40D8E473E9676656 | SHA256:88D03EBEBB16BD8F1311D8C03E238C5579CF3ABA8828751F5B35E36F110A7E99 | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\jose-jwt.dll | executable | |
MD5:77FF6F4DA066FD54EC20777FBD9154FA | SHA256:11D733CE3C48EC116AB81F23E0A6232332C55BCDEFB10386C1E0400EE5A0464A | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\configs\Configs.txt | text | |
MD5:A0A5433C4F8B187BB6DA7E933FF5E6F6 | SHA256:2D59D541BD4C87FAE630F17DA44F6699BE42DDDA5610943AEC006A3BF9A09D74 | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\LuminaryLoader.exe | executable | |
MD5:24D7EC9F1E948558161643971B1BB46C | SHA256:FFF4F24EA4EEED478126B2A010CD7F760A5E8F4324A729DF5E38E169837801DC | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\ReadME_ENG.txt | text | |
MD5:CBD34450E4B28A28C4BC978359A048D0 | SHA256:7129FD5BEA38A888D05B1C237F0C6A77E22AABCB5ACF1724B3458FAC984DF40E | |||
960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa960.27195\Newtonsoft.Json.dll | executable | |
MD5:C53737821B861D454D5248034C3C097C | SHA256:575E30F98E4EA42C9E516EDC8BBB29AD8B50B173A3E6B36B5BA39E133CCE9406 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1448 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
3176 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
3956 | LuminaryLoader.exe | 104.24.112.5:443 | authed.io | Cloudflare Inc | US | shared |
3956 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
authed.io |
| suspicious |