File name:

4708+00000000000906F8.cortex-xdr-payload.rar

Full analysis: https://app.any.run/tasks/81543193-9917-4edf-bb08-55e7bd552a0d
Verdict: Malicious activity
Analysis date: March 30, 2021, 10:50:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A45C9B2EC20A41D56859C668F978C4C8

SHA1:

56F9A05F304D2E6398F318FAC91102CDDF0BAB55

SHA256:

C7AC5E124DD773027168EEA4EBC307CE39D7D093347EAA8E19A638A0E6403EC2

SSDEEP:

393216:5a3/FjAP/M0DNf62Dkrx8Fvn4DLl1Z03s2h8aywoVn5:50/Fekf++89qR1C3flE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)
      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1424)

    • Loads dropped or rewritten executable

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1424)

    • Drops executable file immediately after starts

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2776)
      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Drops a file with a compile date too recent

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Drops a file with too old compile date

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Application launched itself

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Drops a file that was compiled in debug mode

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Loads Python modules

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1424)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)

    • Manual execution by user

      • 4708+00000000000906F8.cortex-xdr-payload.exe (PID: 1076)
      • NOTEPAD.EXE (PID: 1880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 4708+00000000000906f8.cortex-xdr-payload.exe 4708+00000000000906f8.cortex-xdr-payload.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1076"C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe" C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe
explorer.exe
User:
admin
Company:
Palo Alto Networks
Integrity Level:
HIGH
Description:
Cortex XDR Payload
Exit code:
0
Version:
3.0.10
Modules
Images
c:\users\admin\desktop\4708+00000000000906f8.cortex-xdr-payload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
1424"C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe" C:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exe—4708+00000000000906F8.cortex-xdr-payload.exe
User:
admin
Company:
Palo Alto Networks
Integrity Level:
HIGH
Description:
Cortex XDR Payload
Exit code:
0
Version:
3.0.10
Modules
Images
c:\users\admin\desktop\4708+00000000000906f8.cortex-xdr-payload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
1880"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\cortex-xdr-payload.logC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2776"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4708+00000000000906F8.cortex-xdr-payload.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
482
Read events
460
Write events
22
Delete events
0

Modification events

(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2776) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2776) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\4708+00000000000906F8.cortex-xdr-payload.rar
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2776) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
90
Suspicious files
2
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
2776WinRAR.exeC:\Users\admin\Desktop\4708+00000000000906F8.cortex-xdr-payload.exeexecutable
MD5:—
SHA256:—
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_sqlite3.pydexecutable
MD5:218DA11C9B2295D5C645ECB7629CD44D
SHA256:5987B2FCCA0698710F3572F222A6AEF3EFD9A6A32C002A11DD33C816BD9B58D8
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_multiprocessing.pydexecutable
MD5:05AB494CF791A50E4F8D2FFE1D3E1F3C
SHA256:4959342924E22B6A16EBC5C1ED39552E981515401EDA770E4AC87FD12ACF53F8
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_decimal.pydexecutable
MD5:5596249B64C074374EAA1D4084E336C3
SHA256:673BD4CACF3B5F8DA67C9C84E03E238961CA98683483DE78D0A6410200F7ABA6
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_lzma.pydexecutable
MD5:F91A9F1F2EFEE2F5DBAE42EA5D5D7153
SHA256:1F82BB06C79B6B392C92CAD87FFA736377FA25CD6D10DA8D61441D42C0D0101E
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_queue.pydexecutable
MD5:234F63AE981F5A8E87DBABDA8CEEA32A
SHA256:3E1304AFDCD900748F62D15F93005E65457B9466454E322D065852603C510AC8
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_socket.pydexecutable
MD5:B3AF79BBFD7D5C5285660819792A3A9C
SHA256:EB6132B253C40D7C3E00B2BBB392A1573075F8BBC0B2D59E2B077D2CFE8B028C
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_ssl.pydexecutable
MD5:2825BAE93CD459D835B74892C9BD80DB
SHA256:AF4379FDC8BD41F7A8A4B509DE949202CCDB5E4825797D7A5DDDD5E77671382C
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\_hashlib.pydexecutable
MD5:4F51ED287BBAE386090A9BCC3531B2B8
SHA256:5B6DA4B43C258B459159C4FBC7AD3521B387C377C058FE77AD74BA000606D72E
10764708+00000000000906F8.cortex-xdr-payload.exeC:\Users\admin\Desktop\_MEI10762\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:B951011BA021C374455E8D1E18AF84D2
SHA256:1C057286BDF0CB90F7DD1FECF5E8AFBCFF1E27F2A94612967C0634AE639CA43D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4708+00000000000906F8.cortex-xdr-payload.rar