analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

t846338_Protected.zip

Full analysis: https://app.any.run/tasks/56ec3624-9caa-4a40-94af-dde389a3a806
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 22, 2019, 17:27:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
imminent
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

07BA6F9B1FA97AB9FF386BE19C3C19A9

SHA1:

5F816459E536016E87E4C8963FC5D0D1CF01159D

SHA256:

93646138515465CE5C2087FC1370CB1BE039D968D90665B432F54702DE875645

SSDEEP:

24576:dc7QBPgzgtwGSow/jIl4UPJMq8Voa6NS3eQ5OI8:dJWzVV/jIl4UPJMq8VoLqgf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • t846338_Protected.exe (PID: 2416)
      • t846338_Protected.exe (PID: 1448)
      • t846338_Protected.exe (PID: 296)
      • mstsc.exe (PID: 3076)
      • mstsc.exe (PID: 3944)
      • mstsc.exe (PID: 2284)
      • mstsc.exe (PID: 1076)
      • mstsc.exe (PID: 3980)
      • mstsc.exe (PID: 2916)

    • Known privilege escalation attack

      • t846338_Protected.exe (PID: 296)
      • mstsc.exe (PID: 3076)
      • mstsc.exe (PID: 2284)
      • mstsc.exe (PID: 3980)

    • Detected Imminent RAT

      • RegAsm.exe (PID: 2864)

    • Uses Task Scheduler to run other applications

      • t846338_Protected.exe (PID: 1448)
      • mstsc.exe (PID: 3944)
      • mstsc.exe (PID: 1076)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2344)
      • schtasks.exe (PID: 3068)
      • schtasks.exe (PID: 2600)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3580)
      • t846338_Protected.exe (PID: 1448)

    • Modifies the open verb of a shell class

      • t846338_Protected.exe (PID: 296)
      • mstsc.exe (PID: 3076)
      • mstsc.exe (PID: 3980)
      • mstsc.exe (PID: 2284)

    • Creates files in the user directory

      • RegAsm.exe (PID: 2864)
      • t846338_Protected.exe (PID: 1448)

    • Connects to unusual port

      • RegAsm.exe (PID: 2864)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:01:21 11:00:13
ZipCRC: 0x481017e1
ZipCompressedSize: 1032008
ZipUncompressedSize: 1739264
ZipFileName: t846338_Protected.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
27
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe t846338_protected.exe no specs eventvwr.exe no specs eventvwr.exe t846338_protected.exe t846338_protected.exe no specs #IMMINENT regasm.exe wmiapsrv.exe no specs schtasks.exe no specs mstsc.exe no specs eventvwr.exe no specs eventvwr.exe mstsc.exe no specs regasm.exe no specs schtasks.exe no specs mstsc.exe no specs eventvwr.exe no specs eventvwr.exe mstsc.exe no specs wmiapsrv.exe no specs regasm.exe no specs schtasks.exe no specs mstsc.exe no specs eventvwr.exe no specs eventvwr.exe mstsc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3008"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\t846338_Protected.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3580"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\t846338_Protected.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
296"C:\Users\admin\Desktop\0122\t846338_Protected.exe" C:\Users\admin\Desktop\0122\t846338_Protected.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3700"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—t846338_Protected.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2280"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
t846338_Protected.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1448"C:\Users\admin\Desktop\0122\t846338_Protected.exe" C:\Users\admin\Desktop\0122\t846338_Protected.exe
eventvwr.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2416"C:\Users\admin\Desktop\0122\t846338_Protected.exe" C:\Users\admin\Desktop\0122\t846338_Protected.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2864"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
t846338_Protected.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2776C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2344"C:\Windows\System32\schtasks.exe" /create /tn catsrvut /tr "C:\Users\admin\AppData\Roaming\getmac\mstsc.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—t846338_Protected.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 356
Read events
1 266
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
7
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2864RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Monitoring\network.datbinary
MD5:D1ECB7465B241C95C759B2AC281CE5F9
SHA256:3135DF94423568A639F8E50F69855BB3F2A00337D1A57D7E658C1D9BB3A057C7
2864RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Monitoring\system.datbinary
MD5:EABFFF19BB43EA23D159E190492CCE8A
SHA256:7C6B289AD5C1FF2C8D83F38F29D05EDB5D42048C495C997F2743E5E877BF64CB
1448t846338_Protected.exeC:\Users\admin\AppData\Roaming\getmac\mstsc.exeexecutable
MD5:7E29A05CE775329081C812E53E961233
SHA256:A2DA36A15C4DB8B45A5ECD3D21FA7823214DA877970EF18D08D75D9F89842F45
3580WinRAR.exeC:\Users\admin\Desktop\0122\t846338_Protected.exeexecutable
MD5:7E29A05CE775329081C812E53E961233
SHA256:A2DA36A15C4DB8B45A5ECD3D21FA7823214DA877970EF18D08D75D9F89842F45
2864RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Logs\22-01-2019text
MD5:33BE604F8044D5984E8E3E3B694D710A
SHA256:3F785F1CC535B0987139623200C7910B2B28F92DFE3309E8E071C091D0CE7313
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
78
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2864
RegAsm.exe
185.125.205.81:7999
newyearonly.duckdns.org
—
DE
suspicious

DNS requests

Domain
IP
Reputation
newyearonly.duckdns.org
  • 185.125.205.81
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
t846338_Protected.zip