File name:

4708+00000000000906F8.cortex-xdr-payload.rar

Full analysis: https://app.any.run/tasks/81543193-9917-4edf-bb08-55e7bd552a0d
Verdict: Malicious activity
Analysis date: March 30, 2021, 10:50:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A45C9B2EC20A41D56859C668F978C4C8

SHA1:

56F9A05F304D2E6398F318FAC91102CDDF0BAB55

SHA256:

C7AC5E124DD773027168EEA4EBC307CE39D7D093347EAA8E19A638A0E6403EC2

SSDEEP:

393216:5a3/FjAP/M0DNf62Dkrx8Fvn4DLl1Z03s2h8aywoVn5:50/Fekf++89qR1C3flE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)
      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1424)

    • Drops executable file immediately after starts

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Loads dropped or rewritten executable

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1424)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2776)
      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Application launched itself

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Drops a file with too old compile date

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Loads Python modules

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1424)

    • Drops a file with a compile date too recent

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Drops a file that was compiled in debug mode

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

  • INFO

    • Manual execution by user

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)
      • NOTEPAD.EXE (PID: 1880)

    • Dropped object may contain Bitcoin addresses

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 4708+00000000000906f8.cortex-xdr-payload.exe 4708+00000000000906f8.cortex-xdr-payload.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1076"C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe" C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe
explorer.exe
User:
admin
Company:
Palo Alto Networks
Integrity Level:
HIGH
Description:
Cortex XDR Payload
Exit code:
0
Version:
3.0.10
Modules
Images
c:\users\admin\desktop\4708+00000000000906f8.cortex-xdr-payload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
1424"C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe" C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe—4708+00000000000906F8.cortex-xdr-payload.exe
User:
admin
Company:
Palo Alto Networks
Integrity Level:
HIGH
Description:
Cortex XDR Payload
Exit code:
0
Version:
3.0.10
Modules
Images
c:\users\admin\desktop\4708+00000000000906f8.cortex-xdr-payload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
1880"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\cortex-xdr-payload.logC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2776"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4708+00000000000906F8.cortex-xdr-payload.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
482
Read events
460
Write events
22
Delete events
0

Modification events

(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2776) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2776) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\4708+00000000000906F8.cortex-xdr-payload.rar
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
90
Suspicious files
2
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
2776WinRAR.exeC:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exeexecutable
MD5:—
SHA256:—
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_decimal.pydexecutable
MD5:5596249B64C074374EAA1D4084E336C3
SHA256:673BD4CACF3B5F8DA67C9C84E03E238961CA98683483DE78D0A6410200F7ABA6
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_ctypes.pydexecutable
MD5:10861D3FA19D7DC3B41EB6F837340782
SHA256:6255BAB0B7F3E2209A9C8B89A3E1EC1BBC7A29849A18E70C0CF582A63C90BED1
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_cffi_backend.cp37-win32.pydexecutable
MD5:9C57FA6BD22B8DCA861E767384E428E4
SHA256:2DBA673A4701D68FB85054F64A22C4C249C4FB8C7BA0B8CAE8383BBCC9F8D762
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\VCRUNTIME140.dllexecutable
MD5:CFC08FCA16C3647A42E78EF7556E4090
SHA256:0B08756920415C5F087E65C85DA1FBC7A1FAFC0D91038E0425CD339C0D903910
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_elementtree.pydexecutable
MD5:390552274C5F71C7EBD1F343BB74446C
SHA256:D6C7EA93CDEFE1973239A3DEC0F49A1027E943F1DE07E21FF378978CC6A438BC
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_hashlib.pydexecutable
MD5:4F51ED287BBAE386090A9BCC3531B2B8
SHA256:5B6DA4B43C258B459159C4FBC7AD3521B387C377C058FE77AD74BA000606D72E
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_lzma.pydexecutable
MD5:F91A9F1F2EFEE2F5DBAE42EA5D5D7153
SHA256:1F82BB06C79B6B392C92CAD87FFA736377FA25CD6D10DA8D61441D42C0D0101E
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_bz2.pydexecutable
MD5:1C52BA084A3723940C0778AB5186893A
SHA256:CB008E0A6C65DDB5F20AB96E65285DEE874468DF203FAEAFCA5E9B4A9F2918DC
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_queue.pydexecutable
MD5:234F63AE981F5A8E87DBABDA8CEEA32A
SHA256:3E1304AFDCD900748F62D15F93005E65457B9466454E322D065852603C510AC8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4708+00000000000906F8.cortex-xdr-payload.rar