File name:

er.rar

Full analysis: https://app.any.run/tasks/a439d875-bff3-40df-a6dc-15e5e2e3e5b7
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: October 01, 2021, 17:07:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5391FCB6423ECCC4E7EF484758F57872

SHA1:

D512EFE087291C01B39317A6A642F1B43AC54AB5

SHA256:

F0B6F56CE411A89F6BD85E216EB2E9039304E271C2D3D558E62AC87BB3394843

SSDEEP:

384:Qt3/yb+c2zXKxSQxwgckvD1mfoXdoXB7PRYfFIezdusrR76r4rCN35YNpQA8+C:iNLbQGgckvCxmfFIepusrEr4rCB5YLVC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • er.exe (PID: 3648)

    • Application was dropped or rewritten from another process

      • er.exe (PID: 3648)
      • Catgame.exe (PID: 3964)

    • Uses Task Scheduler to run other applications

      • Catgame.exe (PID: 3964)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1452)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3308)
      • er.exe (PID: 3648)
      • cmd.exe (PID: 3652)
      • Catgame.exe (PID: 3964)

    • Reads the computer name

      • er.exe (PID: 3648)
      • Catgame.exe (PID: 3964)
      • WinRAR.exe (PID: 3308)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3308)
      • er.exe (PID: 3648)

    • Starts CMD.EXE for commands execution

      • er.exe (PID: 3648)

    • Uses RUNDLL32.EXE to load library

      • er.exe (PID: 3648)

    • Reads Environment values

      • Catgame.exe (PID: 3964)

    • Creates files in the user directory

      • rundll32.exe (PID: 792)

  • INFO

    • Reads settings of System Certificates

      • Catgame.exe (PID: 3964)

    • Checks supported languages

      • timeout.exe (PID: 3404)
      • schtasks.exe (PID: 1452)
      • rundll32.exe (PID: 792)

    • Reads the computer name

      • rundll32.exe (PID: 792)
      • schtasks.exe (PID: 1452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe er.exe rundll32.exe cmd.exe no specs timeout.exe no specs catgame.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
792C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {5edb1ddd-6a21-414f-bc6e-e6e5379b875c};C:\Users\admin\AppData\Local\Temp\Rar$EXb3308.23304\er.exe;3648C:\Windows\system32\rundll32.exe
er.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1452"C:\Windows\System32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /IC:\Windows\System32\schtasks.exe—Catgame.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3308"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\er.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3404timeout 3 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3648"C:\Users\admin\AppData\Local\Temp\Rar$EXb3308.23304\er.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3308.23304\er.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.3.7
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3308.23304\er.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3652C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmpEBC9.tmp.bat""C:\Windows\system32\cmd.exe—er.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3964"C:\Users\admin\AppData\Local\Temp\Catgame.exe" C:\Users\admin\AppData\Local\Temp\Catgame.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.3.7
Modules
Images
c:\users\admin\appdata\local\temp\catgame.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
7 013
Read events
6 943
Write events
70
Delete events
0

Modification events

(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3308) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\171\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\er.rar
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
2
Suspicious files
3
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
792rundll32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\ER�.lnklnk
MD5:—
SHA256:—
3648er.exeC:\Users\admin\AppData\Local\Temp\tmpEBC9.tmp.battext
MD5:—
SHA256:—
3964Catgame.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:—
SHA256:—
3648er.exeC:\Users\admin\AppData\Local\Temp\Catgame.exeexecutable
MD5:—
SHA256:—
3964Catgame.exeC:\Users\admin\AppData\Local\Temp\Tar632D.tmpcat
MD5:—
SHA256:—
3964Catgame.exeC:\Users\admin\AppData\Local\Temp\Cab632C.tmpcompressed
MD5:—
SHA256:—
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3308.23304\er.exeexecutable
MD5:—
SHA256:—
792rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\GameExplorer\{B0FBDBBD-F6AD-4C4E-9427-12344405BD1C}\PlayTasks\0\Play.lnklnk
MD5:—
SHA256:—
3964Catgame.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
167
DNS requests
4
Threats
86

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
792
rundll32.exe
GET
—
65.55.5.170:80
http://movie.metaservices.microsoft.com/locater/WMServiceLocater.asmx/GetServiceLocationsForClient?locale=en-US&clientType=VISTA_GAMES&clientVersion=6.1.2
US
—
—
whitelisted
792
rundll32.exe
GET
302
104.111.242.51:80
http://go.microsoft.com/fwlink?linkid=30219&locale=en-US&clientType=VISTA_GAMES&clientVersion=6.1.2
NL
—
—
whitelisted
3964
Catgame.exe
GET
200
23.32.238.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?46125dc37b3091ab
US
compressed
59.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
792
rundll32.exe
104.111.242.51:80
go.microsoft.com
Akamai International B.V.
NL
unknown
792
rundll32.exe
65.55.5.170:80
movie.metaservices.microsoft.com
Microsoft Corporation
US
whitelisted
3964
Catgame.exe
3.22.53.161:10097
2.tcp.ngrok.io
—
US
malicious
3964
Catgame.exe
23.32.238.226:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
3964
Catgame.exe
85.10.195.175:80
—
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.111.242.51
whitelisted
movie.metaservices.microsoft.com
  • 65.55.5.170
whitelisted
2.tcp.ngrok.io
  • 3.22.53.161
malicious
ctldl.windowsupdate.com
  • 23.32.238.226
  • 23.32.238.208
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
3964
Catgame.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 2
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
er.rar