File name:

NitroChecker.rar

Full analysis: https://app.any.run/tasks/9a0f7196-12a0-4482-b8a0-f037c93e68ea
Verdict: Malicious activity
Analysis date: August 08, 2020, 15:32:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

923258D156C73408096E4460495A5F51

SHA1:

FB2B59ABB19FA5436ABCD5E86A4736032AD309AD

SHA256:

FA6120A66024635548A04C7DD26E8A5429B6790D28B732A441A1BF0A3CD41B03

SSDEEP:

6144:2GagEoL3CyjsZR24Rfo70YXyfQgN+Nq1eJirDjL4TNg0LoWpW5gS:2ebsbfo7ZXyfJVoJtO4WmS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3460)

    • Application was dropped or rewritten from another process

      • NitroChecker.exe (PID: 2724)
      • NitroChecker.exe (PID: 1816)
      • NitroChecker.exe (PID: 1164)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2496)

  • INFO

    • Manual execution by user

      • NitroChecker.exe (PID: 2724)
      • NitroChecker.exe (PID: 1816)
      • NitroChecker.exe (PID: 1164)
      • chrome.exe (PID: 1008)

    • Application launched itself

      • chrome.exe (PID: 1008)

    • Reads the hosts file

      • chrome.exe (PID: 1008)
      • chrome.exe (PID: 3652)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
19
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs nitrochecker.exe no specs nitrochecker.exe no specs nitrochecker.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1024,16611159132903271309,6160504393698400242,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=6133851492125886814 --mojo-platform-channel-handle=1048 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1008"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1164"C:\Users\admin\Desktop\NitroChecker.exe" C:\Users\admin\Desktop\NitroChecker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NitroChecker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\nitrochecker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1024,16611159132903271309,6160504393698400242,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7889362230039667039 --mojo-platform-channel-handle=3508 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1500"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,16611159132903271309,6160504393698400242,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3551821457269662182 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1816"C:\Users\admin\Desktop\NitroChecker.exe" C:\Users\admin\Desktop\NitroChecker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NitroChecker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\nitrochecker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2488"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,16611159132903271309,6160504393698400242,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10175090953825074083 --mojo-platform-channel-handle=3436 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2496"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NitroChecker.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2648"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2608 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2724"C:\Users\admin\Desktop\NitroChecker.exe" C:\Users\admin\Desktop\NitroChecker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NitroChecker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\nitrochecker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
818
Read events
724
Write events
89
Delete events
5

Modification events

(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2496) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2496) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NitroChecker.rar
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2496) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
3
Suspicious files
34
Text files
83
Unknown types
9

Dropped files

PID
Process
Filename
Type
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old —
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFed954.TMP —
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2b13e2d1-89a8-4030-9094-337f5c7d799e.tmp —
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RFed964.TMPtext
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RFed993.TMPtext
MD5:—
SHA256:—
1008chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\000001.dbtmp —
MD5:—
SHA256:—
2496WinRAR.exeC:\Users\admin\Desktop\NitroChecker.exeexecutable
MD5:040536308A4C4C4D6AA3CCB33B812BFD
SHA256:81677B68BDA1A004A55664B4A27055E892D0DD05BEB79C4193E951F87818EB6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3652
chrome.exe
GET
200
104.31.73.96:80
http://kekma.net/
US
html
1.24 Kb
malicious
3652
chrome.exe
GET
200
104.31.73.96:80
http://kekma.net/naggars.gif
US
image
468 Kb
malicious
3652
chrome.exe
GET
200
104.31.73.96:80
http://kekma.net/styles.css
US
text
435 b
malicious
3652
chrome.exe
GET
—
104.31.73.96:80
http://kekma.net/zzart.mp4
US
—
—
malicious
3652
chrome.exe
GET
200
104.31.73.96:80
http://kekma.net/button.jpg
US
image
31.4 Kb
malicious
3652
chrome.exe
GET
200
104.31.73.96:80
http://kekma.net/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
US
html
655 b
malicious
3652
chrome.exe
GET
—
104.31.73.96:80
http://kekma.net/zzart.mp4
US
—
—
malicious
3652
chrome.exe
GET
—
104.31.73.96:80
http://kekma.net/scream.mp3
US
—
—
malicious
3652
chrome.exe
GET
404
104.31.73.96:80
http://kekma.net/favicon.ico
US
html
193 b
malicious
3652
chrome.exe
GET
206
104.31.73.96:80
http://kekma.net/rape.mp3
US
mp3
284 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3652
chrome.exe
172.217.18.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3652
chrome.exe
172.217.23.132:443
www.google.com
Google Inc.
US
whitelisted
3652
chrome.exe
216.58.207.74:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3652
chrome.exe
172.217.18.163:443
www.gstatic.com
Google Inc.
US
whitelisted
3652
chrome.exe
172.217.18.13:443
accounts.google.com
Google Inc.
US
whitelisted
3652
chrome.exe
209.197.3.24:443
code.jquery.com
Highwinds Network Group, Inc.
US
malicious
3652
chrome.exe
172.217.23.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3652
chrome.exe
216.58.210.3:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3652
chrome.exe
172.217.23.142:443
clients2.google.com
Google Inc.
US
whitelisted
3652
chrome.exe
104.31.73.96:80
kekma.net
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.18.99
whitelisted
accounts.google.com
  • 172.217.18.13
shared
www.google.com
  • 172.217.23.132
malicious
fonts.googleapis.com
  • 216.58.207.74
whitelisted
www.gstatic.com
  • 172.217.18.163
whitelisted
fonts.gstatic.com
  • 216.58.210.3
whitelisted
apis.google.com
  • 216.58.208.46
whitelisted
ogs.google.com
  • 172.217.22.78
whitelisted
ssl.gstatic.com
  • 172.217.22.67
whitelisted
clients2.google.com
  • 172.217.23.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NitroChecker.rar