analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

QUATATION PAID.ace

Full analysis: https://app.any.run/tasks/4b4282c1-2db3-4c18-9505-2a81ef6ec2d5
Verdict: Malicious activity
Threats:

Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS.

Malware Trends Tracker     >>>
Analysis date: April 24, 2019, 06:24:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
netwire
trojan
Indicators:
MIME: application/octet-stream
File info: ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid
MD5:

8A0F4E30AEB06C587639D29E7015A099

SHA1:

DC63B5811718C2D3DE99D58C6FB3E2B4A6F21BCE

SHA256:

99DADD8757FC9ED6B61297E4EED2D874B31802BB5FC5E4077567559FD6B7EE5F

SSDEEP:

6144:fYPRTTDMr/NL3lAQScogB2YFa9lL1q5qKvUb1jse1VhCGdH5+YLvh:QPNIzMQrL2Y89lhqYKcpiGdH5zh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • QUATATION PAID.exe (PID: 1968)
      • QUATATION PAID.exe (PID: 2104)
      • Host.exe (PID: 3592)
      • Host.exe (PID: 2980)

    • NETWIRE was detected

      • Host.exe (PID: 3592)

    • Changes the autorun value in the registry

      • Host.exe (PID: 3592)

    • Connects to CnC server

      • Host.exe (PID: 3592)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • QUATATION PAID.exe (PID: 1968)
      • WinRAR.exe (PID: 2580)

    • Creates files in the user directory

      • QUATATION PAID.exe (PID: 1968)

    • Application launched itself

      • QUATATION PAID.exe (PID: 2104)
      • Host.exe (PID: 2980)

    • Starts itself from another location

      • QUATATION PAID.exe (PID: 1968)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2580)
      • QUATATION PAID.exe (PID: 1968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ace | ACE compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe quatation paid.exe no specs quatation paid.exe host.exe no specs #NETWIRE host.exe

Process information

PID
CMD
Path
Indicators
Parent process
2580"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\QUATATION PAID.ace"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2104"C:\Users\admin\Desktop\QUATATION PAID.exe" C:\Users\admin\Desktop\QUATATION PAID.exe—explorer.exe
User:
admin
Company:
IRRECONCILIABLY
Integrity Level:
MEDIUM
Description:
Samala
Exit code:
0
Version:
1.09.0009
1968C:\Users\admin\Desktop\QUATATION PAID.exe" C:\Users\admin\Desktop\QUATATION PAID.exe
QUATATION PAID.exe
User:
admin
Company:
IRRECONCILIABLY
Integrity Level:
MEDIUM
Description:
Samala
Exit code:
0
Version:
1.09.0009
2980"C:\Users\admin\AppData\Roaming\Install\Host.exe"C:\Users\admin\AppData\Roaming\Install\Host.exe—QUATATION PAID.exe
User:
admin
Company:
IRRECONCILIABLY
Integrity Level:
MEDIUM
Description:
Samala
Exit code:
0
Version:
1.09.0009
3592C:\Users\admin\AppData\Roaming\Install\Host.exe"C:\Users\admin\AppData\Roaming\Install\Host.exe
Host.exe
User:
admin
Company:
IRRECONCILIABLY
Integrity Level:
MEDIUM
Description:
Samala
Version:
1.09.0009
Total events
443
Read events
424
Write events
19
Delete events
0

Modification events

(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2580) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\QUATATION PAID.ace
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0
Operation:writeName:Count
Value:
0
(PID) Process:(2580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0
Operation:writeName:Name
Value:
542D4B42647265644B76737A7E794B566767537663764B5B7874767B4B43727A674B4642564356435E58593747565E53397674721717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171700
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1968QUATATION PAID.exeC:\Users\admin\AppData\Roaming\Install\Host.exeexecutable
MD5:145890A566EFFE77E017E50F1F0DC344
SHA256:E5D29DFF5DC227A3B4446BABAA6D41CC82B89F738232B4935847FA923114EAF8
2580WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2580.8853\QUATATION PAID.exeexecutable
MD5:145890A566EFFE77E017E50F1F0DC344
SHA256:E5D29DFF5DC227A3B4446BABAA6D41CC82B89F738232B4935847FA923114EAF8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3592
Host.exe
91.192.100.57:32144
duc1234.duckdns.org
SOFTplus Entwicklungen GmbH
CH
malicious

DNS requests

Domain
IP
Reputation
duc1234.duckdns.org
  • 91.192.100.57
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3592
Host.exe
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
3592
Host.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
3592
Host.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
3592
Host.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
3592
Host.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
3592
Host.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
QUATATION PAID.ace