File name:

Roexec.zip

Full analysis: https://app.any.run/tasks/382d5899-7d3a-4ed1-9272-adee4b3d658d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 27, 2024, 00:42:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
smartloader
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

86711D8E3A8E9373C52040DB6D438789

SHA1:

A9A42FAF7EAD5847D727F7DD378822D656D58DBF

SHA256:

D0D6CABAB10E62F0261E2CA13DAA453B4EC38C9F81880A55D1ACA04C8AE5A3FA

SSDEEP:

24576:mA4Xfal5DM5oskVSSmGSJFN/qS7r78pTLDdhAgKn:mA4Xyl5DM5oskVSWSJFN/qS7XeTLDdhm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2648)
      • compiler.exe (PID: 2900)

    • SMARTLOADER has been detected (SURICATA)

      • compiler.exe (PID: 2900)

    • Connects to the CnC server

      • compiler.exe (PID: 2900)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 2908)
      • compiler.exe (PID: 2900)
      • powershell.exe (PID: 3152)
      • wscript.exe (PID: 1972)

    • The process executes VB scripts

      • cmd.exe (PID: 2908)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2908)
      • cmd.exe (PID: 3308)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1972)
      • Setup.exe (PID: 884)
      • cmd.exe (PID: 3016)

    • Reads security settings of Internet Explorer

      • compiler.exe (PID: 2900)

    • Reads settings of System Certificates

      • compiler.exe (PID: 2900)

    • Checks Windows Trust Settings

      • compiler.exe (PID: 2900)

    • Checks for external IP

      • compiler.exe (PID: 2900)

    • Adds/modifies Windows certificates

      • compiler.exe (PID: 2900)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3152)

    • Executing commands from ".cmd" file

      • Setup.exe (PID: 884)

    • Connects to the server without a host name

      • compiler.exe (PID: 2900)

    • Starts POWERSHELL.EXE for commands execution

      • compiler.exe (PID: 2900)

    • Application launched itself

      • cmd.exe (PID: 3016)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1972)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1972)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 2908)
      • Setup.exe (PID: 884)
      • Setup.exe (PID: 3236)
      • Nzc3.exe (PID: 3920)

    • Reads the computer name

      • compiler.exe (PID: 2900)

    • Creates files or folders in the user directory

      • compiler.exe (PID: 2900)

    • Reads the machine GUID from the registry

      • compiler.exe (PID: 2900)

    • Reads the software policy settings

      • compiler.exe (PID: 2900)

    • Creates files in the program directory

      • compiler.exe (PID: 2900)

    • Checks supported languages

      • Nzc3.exe (PID: 3416)
      • Nzc3.exe (PID: 3920)
      • compiler.exe (PID: 2900)

    • Create files in a temporary directory

      • compiler.exe (PID: 2900)

    • Checks proxy server information

      • compiler.exe (PID: 2900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2018:01:23 12:34:48
ZipCRC: 0x14b96436
ZipCompressedSize: 49548
ZipUncompressedSize: 91136
ZipFileName: compiler.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe cacls.exe no specs #SMARTLOADER compiler.exe schtasks.exe no specs powershell.exe no specs setup.exe no specs setup.exe cmd.exe no specs cmd.exe no specs nzc3.exe no specs nzc3.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
884"C:\Windows\System32\oobe\Setup.exe" C:\Windows\System32\oobe\Setup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Installation and Setup
Exit code:
31
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\oobe\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1576"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"C:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1972"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\getadmin.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2176schtasks /create /sc daily /st 10:25 /f /tn WindowsSetup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highestC:\Windows\System32\schtasks.exe—compiler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2648"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Roexec.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2900compiler.exe configC:\Users\admin\Desktop\compiler.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\lua51.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2908C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Launcher.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3016C:\Windows\system32\cmd.exe /c C:\Windows\Setup\Scripts\ErrorHandler.cmdC:\Windows\System32\cmd.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3048cmd /c ""C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\Nzc3.exe" "C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\config""C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3152powershell -Command "Register-ScheduledTask -TaskName 'YWVzNzc3' -Action (New-ScheduledTaskAction -Execute 'C:\Users\admin\AppData\Roaming\tmp\bin\aes.exe') -Trigger (New-ScheduledTaskTrigger -At (Get-Date).AddMinutes(1) -Once) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable) -Force"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—compiler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
16 710
Read events
16 608
Write events
89
Delete events
13

Modification events

(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2648) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Roexec.zip
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2648) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
6
Text files
5
Unknown types
12

Dropped files

PID
Process
Filename
Type
2648WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2648.14595\compiler.exeexecutable
MD5:—
SHA256:—
2648WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2648.14595\configbinary
MD5:—
SHA256:—
2648WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2648.14595\Launcher.battext
MD5:—
SHA256:—
2648WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2648.14595\lua51.dllexecutable
MD5:—
SHA256:—
2908cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:—
SHA256:—
2900compiler.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].jsonbinary
MD5:—
SHA256:—
2900compiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2900compiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:—
SHA256:—
2900compiler.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:—
SHA256:—
2900compiler.exeC:\Users\admin\Pictures\90059C37132041A4B58D2B75A9850D2Fbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
17
DNS requests
11
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2900
compiler.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
unknown
—
—
unknown
2900
compiler.exe
GET
304
178.79.238.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?140959807b46f2ee
unknown
—
—
unknown
2900
compiler.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
2900
compiler.exe
PUT
200
147.45.67.15:80
http://147.45.67.15/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
unknown
1080
svchost.exe
GET
200
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89bca2e7018c82c0
unknown
—
—
unknown
2900
compiler.exe
GET
301
140.82.121.4:80
http://github.com/dockur/windows/files/14763779/1.log
unknown
—
—
unknown
2900
compiler.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
unknown
2900
compiler.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
unknown
2900
compiler.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
unknown
2900
compiler.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2900
compiler.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
2900
compiler.exe
95.101.149.131:443
www.microsoft.com
Akamai International B.V.
NL
unknown
2900
compiler.exe
178.79.238.128:80
ctldl.windowsupdate.com
LLNW
FR
unknown
2900
compiler.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2900
compiler.exe
147.45.67.15:80
—
OOO FREEnet Group
RU
unknown
1080
svchost.exe
87.248.205.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
2900
compiler.exe
140.82.121.4:80
github.com
GITHUB
US
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
www.microsoft.com
  • 95.101.149.131
whitelisted
ctldl.windowsupdate.com
  • 178.79.238.128
  • 87.248.205.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
github.com
  • 140.82.121.4
shared
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
objects.githubusercontent.com
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2900
compiler.exe
A Network Trojan was detected
ET MALWARE SmartLoader CnC Exfil (screen.bmp)
2900
compiler.exe
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
—
—
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roexec.zip