File name:

Re-Loader Activator 1.6 Final.zip

Full analysis: https://app.any.run/tasks/d4dceb09-5773-4f4c-831a-8085b8cd41b4
Verdict: Malicious activity
Analysis date: June 24, 2024, 20:29:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

213C227DF1EBB8B614A3CFDD97ACF482

SHA1:

7FE698AEDB011F921FA0213CFB5C3967BEA59A20

SHA256:

F4DB66DEB94BC51EB6181A3F8BDEBC1B507158127270AE223D416C2A2650D74E

SSDEEP:

49152:dmiq2ZODhcb3IGYjpjXrFb9+k7MWIHYM94M4UUcSlIPMyCawxfjiwgW68fmKDIT7:siNOF8IVZZbQCMWfMS5ClJCamjiwo8fq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3332)
      • Re-LoaderByR@1n.exe (PID: 3100)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3332)
      • Re-LoaderByR@1n.exe (PID: 3100)

    • Reads the Internet Settings

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1808)

    • Searches for installed software

      • dllhost.exe (PID: 1680)

    • Process drops legitimate windows executable

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Executable content was dropped or overwritten

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Starts a Microsoft application from unusual location

      • brset.exe (PID: 3408)
      • bootsect.exe (PID: 2064)

  • INFO

    • Checks supported languages

      • Re-LoaderByR@1n.exe (PID: 3100)
      • Re-LoaderByR@1n.exe (PID: 596)
      • bootsect.exe (PID: 2064)
      • brset.exe (PID: 3408)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3332)

    • Reads Microsoft Office registry keys

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Reads the machine GUID from the registry

      • Re-LoaderByR@1n.exe (PID: 3100)
      • Re-LoaderByR@1n.exe (PID: 596)

    • Reads the computer name

      • Re-LoaderByR@1n.exe (PID: 3100)
      • Re-LoaderByR@1n.exe (PID: 596)

    • Reads Environment values

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Reads product name

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Create files in a temporary directory

      • Re-LoaderByR@1n.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2015:12:18 20:52:00
ZipCRC: 0x4467c54e
ZipCompressedSize: 5691
ZipUncompressedSize: 16287
ZipFileName: Re-Loader Activator 1.6 Final/Leggimi.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe re-loaderbyr@1n.exe no specs re-loaderbyr@1n.exe re-loaderbyr@1n.exe no specs re-loaderbyr@1n.exe SPPSurrogate no specs vssvc.exe no specs brset.exe no specs bootsect.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
596"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.32094\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1680C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1808C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2064"C:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\bootsect.exe" /nt52 SYS /forceC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\bootsect.exe—Re-LoaderByR@1n.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Sector Manipulation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\re-loader\oem\bootsect.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2864"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.32094\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
3100"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.31244\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3272"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.31244\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
3332"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Re-Loader Activator 1.6 Final.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3408"C:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\brset.exe" /nt60 SYS /forceC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\brset.exe—Re-LoaderByR@1n.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Sector Manipulation Tool
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\users\admin\appdata\local\temp\re-loader\oem\brset.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 988
Read events
5 826
Write events
162
Delete events
0

Modification events

(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3332) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Re-Loader Activator 1.6 Final.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
5
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1680dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3408brset.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
2064bootsect.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Leggimi.txttext
MD5:CCD71B530AAF28D23EB5ABA10EEABCBF
SHA256:D3192C50503738528934D4B60033C4E8A18E22D193D181EAFF4B77929FA5749D
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exeexecutable
MD5:292FF22AEC228B1AC75730C25080CEAD
SHA256:5F5A97FD1EA82BCB87215A804574A51ECCD399B0290FBC6CFE6DDD708DE92DAA
3100Re-LoaderByR@1n.exeC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\brset.exeexecutable
MD5:E1921DEA226B244F83AC5F59681D48A2
SHA256:780FF245C050C839348807EAA0030828DB36C4156A911C0BB785AE57176241EC
1680dllhost.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:4D83F4DF44F4FE3BA34775A5DB1EF37D
SHA256:207E2ABA433373C4E90AEEAE2DB2A82336C88BE3E0CF0DB12F2CABF9D90B0A1C
3100Re-LoaderByR@1n.exeC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\bootsect.exeexecutable
MD5:E5E4EAD82CF4418D2C1A0F50F4C40798
SHA256:C824984BAD38033B797783158A570CFED8F38B078CF337B11054CBFACC6D3A3E
1680dllhost.exeC:\System Volume Information\SPP\OnlineMetadataCache\{2e714177-457b-4081-ad92-7301e2c39c0a}_OnDiskSnapshotPropbinary
MD5:4D83F4DF44F4FE3BA34775A5DB1EF37D
SHA256:207E2ABA433373C4E90AEEAE2DB2A82336C88BE3E0CF0DB12F2CABF9D90B0A1C
3100Re-LoaderByR@1n.exeC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\CustomSLIC\NYW4Ubinary
MD5:4908E7A4441A380EF07E30D5F0AC48D1
SHA256:D8A3ECD656EF4901CBEB822CDFB71A46D707331C60166DBF53DA2FFB2FBA1326
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
43.152.26.221:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
—
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
43.152.26.221:80
ctldl.windowsupdate.com
ACE
DE
unknown
1372
svchost.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
1372
svchost.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 43.152.26.221
  • 43.152.26.197
  • 43.152.26.58
  • 43.152.26.151
  • 43.152.26.154
  • 43.152.26.104
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.24
  • 2.16.164.40
  • 2.16.164.32
  • 2.16.164.120
  • 2.16.164.51
  • 2.16.164.97
  • 2.16.164.106
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.218.209.163
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Re-Loader Activator 1.6 Final.zip