URL:

http://www.splashsoft.de/wp-content/uploads/freeware/RidNacs-2.0.3-Setup.exe

Full analysis: https://app.any.run/tasks/6ff7cdff-8537-40fd-8cfd-2f1ee566d0b5
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 16:46:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

63D5221595210FE4FF050B79EBC68C58

SHA1:

ACC39B725F7E71A826A5E7458B57B5492B963D36

SHA256:

AC536B20780B402B0D2D1C5538A819210FC13CAE99C1AA8C6FDACB14BB86D397

SSDEEP:

3:N1KJS41KvGEAQy00QKixLPn2aA:Cc4AHAZFQHNv2aA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RidNacs-2.0.3-Setup[1].exe (PID: 3832)
      • RidNacs.exe (PID: 3752)
      • RidNacs-2.0.3-Setup[1].exe (PID: 3204)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RidNacs-2.0.3-Setup[1].exe (PID: 3832)
      • RidNacs-2.0.3-Setup[1].tmp (PID: 2288)
      • iexplore.exe (PID: 2984)
      • RidNacs-2.0.3-Setup[1].exe (PID: 3204)
      • iexplore.exe (PID: 3264)

    • Creates files in the user directory

      • RidNacs-2.0.3-Setup[1].tmp (PID: 2288)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2984)

    • Application was dropped or rewritten from another process

      • RidNacs-2.0.3-Setup[1].tmp (PID: 2288)
      • RidNacs-2.0.3-Setup[1].tmp (PID: 2268)

    • Loads dropped or rewritten executable

      • RidNacs-2.0.3-Setup[1].tmp (PID: 2288)

    • Creates files in the program directory

      • RidNacs-2.0.3-Setup[1].tmp (PID: 2288)

    • Creates a software uninstall entry

      • RidNacs-2.0.3-Setup[1].tmp (PID: 2288)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 2984)

    • Creates files in the user directory

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 2984)

    • Changes internet zones settings

      • iexplore.exe (PID: 2984)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start iexplore.exe iexplore.exe ridnacs-2.0.3-setup[1].exe ridnacs-2.0.3-setup[1].tmp no specs ridnacs-2.0.3-setup[1].exe ridnacs-2.0.3-setup[1].tmp ridnacs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2268"C:\Users\admin\AppData\Local\Temp\is-UN6BQ.tmp\RidNacs-2.0.3-Setup[1].tmp" /SL5="$401B8,454723,54272,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exe" C:\Users\admin\AppData\Local\Temp\is-UN6BQ.tmp\RidNacs-2.0.3-Setup[1].tmp—RidNacs-2.0.3-Setup[1].exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.51.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-un6bq.tmp\ridnacs-2.0.3-setup[1].tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2288"C:\Users\admin\AppData\Local\Temp\is-51KLK.tmp\RidNacs-2.0.3-Setup[1].tmp" /SL5="$301EA,454723,54272,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exe" /SPAWNWND=$201EC /NOTIFYWND=$401B8 C:\Users\admin\AppData\Local\Temp\is-51KLK.tmp\RidNacs-2.0.3-Setup[1].tmp
RidNacs-2.0.3-Setup[1].exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.51.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-51klk.tmp\ridnacs-2.0.3-setup[1].tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2984"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3204"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exe
iexplore.exe
User:
admin
Company:
Stephan Plath
Integrity Level:
MEDIUM
Description:
RidNacs Setup
Exit code:
0
Version:
2.0.3.459
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\r9zewh8d\ridnacs-2.0.3-setup[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3264"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2984 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3752"C:\Program Files\RidNacs\RidNacs.exe"C:\Program Files\RidNacs\RidNacs.exe
RidNacs-2.0.3-Setup[1].tmp
User:
admin
Company:
Stephan Plath
Integrity Level:
MEDIUM
Description:
Disk Space Usage Analyzer
Exit code:
0
Version:
2.0.3.459
Modules
Images
c:\program files\ridnacs\ridnacs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3832"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exe" /SPAWNWND=$201EC /NOTIFYWND=$401B8 C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exe
RidNacs-2.0.3-Setup[1].tmp
User:
admin
Company:
Stephan Plath
Integrity Level:
HIGH
Description:
RidNacs Setup
Exit code:
0
Version:
2.0.3.459
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\r9zewh8d\ridnacs-2.0.3-setup[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
1 744
Read events
1 660
Write events
81
Delete events
3

Modification events

(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{E7E40A39-3465-11E9-AA93-5254004A04AF}
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E30702000200130010002E001F006300
Executable files
8
Suspicious files
0
Text files
20
Unknown types
9

Dropped files

PID
Process
Filename
Type
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\RidNacs-2.0.3-Setup[1].exeexecutable
MD5:—
SHA256:—
2288RidNacs-2.0.3-Setup[1].tmpC:\Program Files\RidNacs\is-0QPEH.tmp —
MD5:—
SHA256:—
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\RidNacs-2.0.3-Setup[1].exeexecutable
MD5:—
SHA256:—
2288RidNacs-2.0.3-Setup[1].tmpC:\Program Files\RidNacs\is-Q58Q1.tmp —
MD5:—
SHA256:—
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\dnserror[1]html
MD5:68E03ED57EC741A4AFBBCD11FAB1BDBE
SHA256:1FF3334C3EB27033F8F37029FD72F648EDD4551FCE85FC1F5159FEAEA1439630
2288RidNacs-2.0.3-Setup[1].tmpC:\Program Files\RidNacs\is-4OG1Q.tmp —
MD5:—
SHA256:—
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\ErrorPageTemplate[1]text
MD5:F4FE1CB77E758E1BA56B8A8EC20417C5
SHA256:8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
2288RidNacs-2.0.3-Setup[1].tmpC:\Program Files\RidNacs\is-290FV.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3264
iexplore.exe
GET
301
89.107.184.121:80
http://www.splashsoft.de/wp-content/uploads/freeware/RidNacs-2.0.3-Setup.exe
DE
html
285 b
malicious
2984
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2984
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2984
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3264
iexplore.exe
89.107.184.121:80
www.splashsoft.de
TelemaxX Telekommunikation GmbH
DE
malicious
3264
iexplore.exe
89.107.184.121:443
www.splashsoft.de
TelemaxX Telekommunikation GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.splashsoft.de
  • 89.107.184.121
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3264
iexplore.exe
A Network Trojan was detected
ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious
Process
Message
RidNacs.exe
FastMM has been installed.
RidNacs.exe
error - Couldn't read configuration file "C:\Program Files\RidNacs\log.cfg" - Cannot open file C:\Program Files\RidNacs\log.cfg
RidNacs.exe
error - Ignoring configuration file "C:\Program Files\RidNacs\log.cfg"
RidNacs.exe
OnCreate: 0.168 s
RidNacs.exe
26
RidNacs.exe
26
RidNacs.exe
26
RidNacs.exe
TShellSpecialFolderThread: 0.297 s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.splashsoft.de/wp-content/uploads/freeware/RidNacs-2.0.3-Setup.exe