File name:

LCM.rar

Full analysis: https://app.any.run/tasks/f18cdd3a-86c0-43e2-aea7-ffc274580a25
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: September 11, 2019, 07:06:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
rat
nanocore
trojan
remcos
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

63F958DF81A489D497AD2AA53911E888

SHA1:

A9A019C0C89675DED0169CAEABFAB56024654CD9

SHA256:

DCFB8B09BC3C452C697115F77EA646387A9553AED083F747127CBAB70BBF0929

SSDEEP:

12288:qcO9kmU9rgoC71t9CvfKpCsKEGVI0Wf6rpVNA8xJWLeobcth3bu4UmyQmkJIDR:qiS6vSwsKZQfwz68xJWiRNEmLp+V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 2420)
      • sek.exe (PID: 2836)
      • sek.exe (PID: 2952)
      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)
      • win-server.exe (PID: 2520)

    • Known privilege escalation attack

      • sek.exe (PID: 2952)
      • sek.exe (PID: 2836)

    • NANOCORE was detected

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)

    • Changes the autorun value in the registry

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)
      • sek.exe (PID: 2836)
      • win-server.exe (PID: 2520)
      • iexplore.exe (PID: 3184)

    • Uses SVCHOST.EXE for hidden code execution

      • iexplore.exe (PID: 3184)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1348)
      • schtasks.exe (PID: 2376)

    • Connects to CnC server

      • iexplore.exe (PID: 3184)
      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)

    • Detected logs from REMCOS RAT

      • iexplore.exe (PID: 3184)

    • REMCOS was detected

      • iexplore.exe (PID: 3184)

    • Uses Task Scheduler to run other applications

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3020)
      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)
      • sek.exe (PID: 2836)

    • Writes files like Keylogger logs

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)
      • sek.exe (PID: 2836)
      • iexplore.exe (PID: 3184)

    • Modifies the open verb of a shell class

      • sek.exe (PID: 2952)
      • sek.exe (PID: 2836)

    • Creates files in the user directory

      • sek.exe (PID: 2836)
      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 936)
      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)

    • Starts Internet Explorer

      • win-server.exe (PID: 2520)

    • Starts CMD.EXE for self-deleting

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 3276)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2224)

    • Executes scripts

      • sek.exe (PID: 2836)

  • INFO

    • Manual execution by user

      • REVISED FINAL CARGO MANIFEST COPY_pdf.exe (PID: 2420)

    • Creates files in the user directory

      • iexplore.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
17
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe revised final cargo manifest copy_pdf.exe no specs #NANOCORE revised final cargo manifest copy_pdf.exe sek.exe no specs eventvwr.exe no specs eventvwr.exe sek.exe wscript.exe no specs cmd.exe no specs win-server.exe #REMCOS iexplore.exe svchost.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs taskkill.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304taskkill /f /im "REVISED FINAL CARGO MANIFEST COPY_pdf.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
936"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\System32\WScript.exe—sek.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1348"schtasks.exe" /delete /f /tn "TCP Monitor"C:\Windows\system32\schtasks.exe—REVISED FINAL CARGO MANIFEST COPY_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2224"cmd.exe" /C taskkill /f /im "REVISED FINAL CARGO MANIFEST COPY_pdf.exe" & ping -n 1 -w 3000 1.1.1.1 & type nul > "C:\Users\admin\Desktop\REVISED FINAL CARGO MANIFEST COPY_pdf.exe" & del /f /q "C:\Users\admin\Desktop\REVISED FINAL CARGO MANIFEST COPY_pdf.exe"C:\Windows\system32\cmd.exe—REVISED FINAL CARGO MANIFEST COPY_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2292"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—sek.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\systemroot\system32\ntdll.dll
2376"schtasks.exe" /delete /f /tn "TCP Monitor Task"C:\Windows\system32\schtasks.exe—REVISED FINAL CARGO MANIFEST COPY_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2420"C:\Users\admin\Desktop\REVISED FINAL CARGO MANIFEST COPY_pdf.exe" C:\Users\admin\Desktop\REVISED FINAL CARGO MANIFEST COPY_pdf.exe—explorer.exe
User:
admin
Company:
sMArT
Integrity Level:
MEDIUM
Description:
atwain
Exit code:
0
Version:
1.03.0002
Modules
Images
c:\users\admin\desktop\revised final cargo manifest copy_pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2520C:\Users\admin\AppData\Roaming\System\win-server.exeC:\Users\admin\AppData\Roaming\System\win-server.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3
Modules
Images
c:\users\admin\appdata\roaming\system\win-server.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2732ping -n 1 -w 3000 1.1.1.1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2836"C:\Users\admin\sek.exe" C:\Users\admin\sek.exe
eventvwr.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\sek.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 336
Read events
1 124
Write events
208
Delete events
4

Modification events

(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3020) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\LCM.rar
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3020) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3276) REVISED FINAL CARGO MANIFEST COPY_pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
4
Suspicious files
3
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
3020WinRAR.exeC:\Users\admin\Desktop\REVISED FINAL CARGO MANIFEST COPY_pdf.exeexecutable
MD5:—
SHA256:—
3276REVISED FINAL CARGO MANIFEST COPY_pdf.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:—
SHA256:—
3276REVISED FINAL CARGO MANIFEST COPY_pdf.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:—
SHA256:—
3184iexplore.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:—
SHA256:—
3276REVISED FINAL CARGO MANIFEST COPY_pdf.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:—
SHA256:—
3276REVISED FINAL CARGO MANIFEST COPY_pdf.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:—
SHA256:—
2420REVISED FINAL CARGO MANIFEST COPY_pdf.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\win.initext
MD5:D2A2412BDDBA16D60EC63BD9550D933F
SHA256:79FF2254E38192BE1626D05BEC6C82E10C85E1CF91DF7440C4C443380A1E877A
2836sek.exeC:\Users\admin\AppData\Roaming\System\win-server.exeexecutable
MD5:DEA5FB09BD2FF353DE5681E3C672CD75
SHA256:723AFA2FBD250D4985062091D10952F7E2A5CB8A2826BF32D9A7FCAFCD811BDE
3276REVISED FINAL CARGO MANIFEST COPY_pdf.exeC:\Users\admin\sek.exeexecutable
MD5:DEA5FB09BD2FF353DE5681E3C672CD75
SHA256:723AFA2FBD250D4985062091D10952F7E2A5CB8A2826BF32D9A7FCAFCD811BDE
2836sek.exeC:\Users\admin\AppData\Local\Temp\install.vbsbinary
MD5:4E1CDF73CB95B9DF95353AB21C1CFEF6
SHA256:27B901C33C0300CF4C0F52706A329113CCCCDF1D7CD3875DCC85417B479F8545
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
14
DNS requests
4
Threats
106

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
10.153.35.10:30089
—
—
—
unknown
3184
iexplore.exe
185.165.153.92:3434
—
—
NL
malicious
—
—
8.8.8.8:53
—
Google Inc.
US
malicious
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
185.165.153.35:30089
madss.hopto.org
—
NL
malicious
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
8.8.8.8:53
—
Google Inc.
US
malicious

DNS requests

Domain
IP
Reputation
madss.hopto.org
  • 185.165.153.35
malicious

Threats

PID
Process
Class
Message
3184
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3276
REVISED FINAL CARGO MANIFEST COPY_pdf.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
67 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LCM.rar