| File name: | PL%2C_INV%2C_BL-PACKING_DOCUMENTS%2Cpdf(1).zip |
| Full analysis: | https://app.any.run/tasks/c5fd7a13-15a1-47f6-ae6e-0b659b171985 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | July 13, 2020, 02:17:38 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 17BF1D1EB30A1020C0CDAD5E393D12D9 |
| SHA1: | A25CDE38A2CB5C303D04FD95A9DC329D619815A8 |
| SHA256: | A6648EC6FE21E85A64A16F562655CDC1F48FE06B27157968F6AE431250366EE9 |
| SSDEEP: | 6144:sifGAonD7QlHaRYH8mcSMUBWgeINbx02IbpruB3IzXBMpI9f3aI:sifM70THBWgJbiMBKXBV1 |
MALICIOUS
Application was dropped or rewritten from another process
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2580)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3436)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2268)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2968)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2144)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3268)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 3424)
REMCOS was detected
- vbc.exe (PID: 292)
Uses Task Scheduler to run other applications
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3436)
SUSPICIOUS
Writes files like Keylogger logs
- vbc.exe (PID: 292)
Creates files in the user directory
- vbc.exe (PID: 292)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3436)
Executes scripts
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2580)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3436)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2268)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2968)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 2144)
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3268)
Executable content was dropped or overwritten
- PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3436)
- WinRAR.exe (PID: 180)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2020:07:12 09:11:19 |
| ZipCRC: | 0x27e3d489 |
| ZipCompressedSize: | 211515 |
| ZipUncompressedSize: | 303616 |
| ZipFileName: | PL, INV, BL-PACKING DOCUMENTS,pdf.exe |
Total processes
47
Monitored processes
14
Malicious processes
3
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 180 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\965bd4c8-0542-4376-821d-8f6f1cf027aa.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 292 | "{path}" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 14.7.3062.0 Modules
| |||||||||||||||
| 2144 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa180.21290\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.21290\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Tetris Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2268 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa180.4577\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.4577\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Tetris Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2436 | "{path}" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 1 Version: 14.7.3062.0 Modules
| |||||||||||||||
| 2564 | "{path}" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 1 Version: 14.7.3062.0 Modules
| |||||||||||||||
| 2580 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa180.4215\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.4215\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Tetris Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2652 | "{path}" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 1 Version: 14.7.3062.0 Modules
| |||||||||||||||
| 2968 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa180.17616\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.17616\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Tetris Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3072 | "{path}" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | — | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 1 Version: 14.7.3062.0 Modules
| |||||||||||||||
Total events
530
Read events
511
Write events
19
Delete events
0
Modification events
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\965bd4c8-0542-4376-821d-8f6f1cf027aa.zip | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
7
Suspicious files
0
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3436 | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | C:\Users\admin\AppData\Local\Temp\tmpBE9A.tmp | xml | |
MD5:— | SHA256:— | |||
| 180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.4577\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.17616\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 3436 | PL, INV, BL-PACKING DOCUMENTS,pdf.exe | C:\Users\admin\AppData\Roaming\bqrsxoTw.exe | executable | |
MD5:— | SHA256:— | |||
| 180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.4215\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.3318\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 292 | vbc.exe | C:\Users\admin\AppData\Roaming\remcos\logs.dat | text | |
MD5:— | SHA256:— | |||
| 180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.21290\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa180.23544\PL, INV, BL-PACKING DOCUMENTS,pdf.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
77
DNS requests
4
Threats
4
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
292 | vbc.exe | 185.244.30.19:1965 | jamesanderson68986.ddns.net | — | — | malicious |
— | — | 185.244.30.19:1965 | jamesanderson68986.ddns.net | — | — | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
jamesanderson68986.ddns.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1044 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
1044 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
1044 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
1044 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |