Analysis date (UTC): 17 April 2025, 14:10Analysis environment: Windows 10 Pro, build 19044, x64

https://chrome.browser.com.se/

MD5:69E69EB236F7C5338A70C42CB84E5C3F

SHA1:3F1DEEBE48343C7F0824AE2E0209358512636205

SHA256:0386F0C592E9AD8A054482918FEAAA7CD7EDCC65C5C3D7C7F62ECDDA7E3C9FB1

Analysis result

Threat level:Malicious activity

Tags:

arch-execstealerratarechclient2backdoorqrcode

Full analysis:Analysis https://chrome.browser.com.se/ Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Gets path to any of the special folders (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Accesses environment variables (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Copies file to a new location (SCRIPT)

wscript.exe (PID: 5740)

Opens a text file (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Gets a file object corresponding to the file in a specified path (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Run PowerShell with an invisible window

powershell.exe (PID: 6940)
powershell.exe (PID: 6640)
powershell.exe (PID: 1748)

Gets %appdata% folder path (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Deletes a file (SCRIPT)

wscript.exe (PID: 7208)

Changes Windows Defender settings

wscript.exe (PID: 7208)

Creates internet connection object (SCRIPT)

wscript.exe (PID: 7208)

Adds path to the Windows Defender exclusion list

wscript.exe (PID: 7208)

Opens an HTTP connection (SCRIPT)

wscript.exe (PID: 7208)

Uses Task Scheduler to autorun other applications

cmd.exe (PID: 7312)

Sends HTTP request (SCRIPT)

wscript.exe (PID: 7208)

Executing a file with an untrusted certificate

app1.exe (PID: 1532)
app1.exe (PID: 6960)
stickies.exe (PID: 728)

Checks whether a specified folder exists (SCRIPT)

wscript.exe (PID: 7208)

Creates a new folder (SCRIPT)

wscript.exe (PID: 7208)

Create files in the Startup directory

app1.tmp (PID: 5232)

Changes the autorun value in the registry

setup.exe (PID: 5988)

Actions looks like stealing of personal data

InstallUtil.exe (PID: 2236)

ARECHCLIENT2 has been detected (SURICATA)

InstallUtil.exe (PID: 2236)

SUSPICIOUS

Executable content was dropped or overwritten

Chrоmе-x64.exe (PID: 8136)
updater.exe (PID: 6080)
updater.exe (PID: 1760)
app1.tmp (PID: 1600)
wscript.exe (PID: 7208)
app1.exe (PID: 6960)
app1.exe (PID: 1532)
app1.tmp (PID: 5232)
135.0.7049.95_chrome_installer.exe (PID: 6876)
setup.exe (PID: 5988)

Reads security settings of Internet Explorer

6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
Chrоmе-x64.exe (PID: 8136)
updater.exe (PID: 6080)
app1.tmp (PID: 1600)

The process executes VB scripts

Chrоmе-x64.exe (PID: 8136)
cmd.exe (PID: 5256)

Creates FileSystem object to access computer's file system (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Starts POWERSHELL.EXE for commands execution

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Runs shell command (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Gets full path of the running script (SCRIPT)

wscript.exe (PID: 5740)
wscript.exe (PID: 7208)

Application launched itself

6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
updater.exe (PID: 6080)
updater.exe (PID: 1760)
updater.exe (PID: 1812)
setup.exe (PID: 5988)
setup.exe (PID: 2596)
updater.exe (PID: 8792)

Starts process via Powershell

powershell.exe (PID: 6940)

Executes as Windows Service

updater.exe (PID: 1760)
updater.exe (PID: 1812)
updater.exe (PID: 8792)

Starts CMD.EXE for commands execution

powershell.exe (PID: 6940)
wscript.exe (PID: 7208)

Script adds exclusion path to Windows Defender

wscript.exe (PID: 7208)

Hides command output

cmd.exe (PID: 7312)
cmd.exe (PID: 1512)

Deletes scheduled task without confirmation

schtasks.exe (PID: 924)

Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

wscript.exe (PID: 7208)

Writes binary data to a Stream object (SCRIPT)

wscript.exe (PID: 7208)

Saves data to a binary file (SCRIPT)

wscript.exe (PID: 7208)

Reads the Windows owner or organization settings

app1.tmp (PID: 1600)
app1.tmp (PID: 5232)

Creates a Folder object (SCRIPT)

wscript.exe (PID: 7208)

Process drops legitimate windows executable

app1.tmp (PID: 5232)

Searches for installed software

setup.exe (PID: 5988)

Creates a software uninstall entry

setup.exe (PID: 5988)
chrome.exe (PID: 6708)

Connects to unusual port

InstallUtil.exe (PID: 2236)

INFO

Reads Environment values

identity_helper.exe (PID: 8188)

Reads the computer name

Chrоmе-x64.exe (PID: 8136)
identity_helper.exe (PID: 8188)
6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
updater.exe (PID: 6080)
6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
updater.exe (PID: 1760)
updater.exe (PID: 1812)
app1.tmp (PID: 1600)
app1.tmp (PID: 5232)
135.0.7049.95_chrome_installer.exe (PID: 6876)
setup.exe (PID: 5988)
setup.exe (PID: 2596)
stickies.exe (PID: 728)
InstallUtil.exe (PID: 2236)
elevation_service.exe (PID: 3768)
updater.exe (PID: 8792)

Application launched itself

msedge.exe (PID: 7352)
chrome.exe (PID: 6708)

Checks supported languages

identity_helper.exe (PID: 8188)
Chrоmе-x64.exe (PID: 8136)
6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
updater.exe (PID: 2240)
updater.exe (PID: 6080)
updater.exe (PID: 1760)
updater.exe (PID: 6652)
updater.exe (PID: 1812)
updater.exe (PID: 2088)
app1.exe (PID: 1532)
app1.tmp (PID: 1600)
app1.exe (PID: 6960)
app1.tmp (PID: 5232)
135.0.7049.95_chrome_installer.exe (PID: 6876)
setup.exe (PID: 5988)
setup.exe (PID: 7312)
setup.exe (PID: 5600)
setup.exe (PID: 2596)
stickies.exe (PID: 728)
InstallUtil.exe (PID: 2236)
elevation_service.exe (PID: 3768)
updater.exe (PID: 8792)
updater.exe (PID: 6044)

Executable content was dropped or overwritten

msedge.exe (PID: 7352)
msedge.exe (PID: 6876)

Creates files in the program directory

Chrоmе-x64.exe (PID: 8136)
6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
updater.exe (PID: 2240)
updater.exe (PID: 6080)
updater.exe (PID: 1760)
updater.exe (PID: 1812)
setup.exe (PID: 2596)
setup.exe (PID: 5988)
updater.exe (PID: 8792)

Checks proxy server information

Chrоmе-x64.exe (PID: 8136)
updater.exe (PID: 6080)
wscript.exe (PID: 7208)
InstallUtil.exe (PID: 2236)
slui.exe (PID: 2288)

Reads the software policy settings

Chrоmе-x64.exe (PID: 8136)
updater.exe (PID: 6080)
updater.exe (PID: 1812)
slui.exe (PID: 2284)
slui.exe (PID: 2288)
updater.exe (PID: 8792)

Create files in a temporary directory

Chrоmе-x64.exe (PID: 8136)
updater.exe (PID: 6080)
app1.tmp (PID: 1600)
app1.exe (PID: 6960)
app1.exe (PID: 1532)
app1.tmp (PID: 5232)

The sample compiled with english language support

Chrоmе-x64.exe (PID: 8136)
updater.exe (PID: 6080)
updater.exe (PID: 1760)
app1.tmp (PID: 5232)
setup.exe (PID: 5988)
135.0.7049.95_chrome_installer.exe (PID: 6876)
msedge.exe (PID: 6876)

Process checks computer location settings

Chrоmе-x64.exe (PID: 8136)
6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
app1.tmp (PID: 1600)

Process checks whether UAC notifications are on

updater.exe (PID: 6080)
updater.exe (PID: 1760)
updater.exe (PID: 1812)
updater.exe (PID: 8792)

Reads the machine GUID from the registry

updater.exe (PID: 6080)
stickies.exe (PID: 728)
InstallUtil.exe (PID: 2236)

Creates files or folders in the user directory

updater.exe (PID: 6080)
app1.tmp (PID: 5232)

Checks if a key exists in the options dictionary (POWERSHELL)

powershell.exe (PID: 6640)
powershell.exe (PID: 1748)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 1748)
powershell.exe (PID: 6640)

Manual execution by a user

chrome.exe (PID: 6708)

Executes as Windows Service

elevation_service.exe (PID: 3768)

Disables trace logs

InstallUtil.exe (PID: 2236)

Threats

PID	Process	Class	Message
2236	InstallUtil.exe	A Network Trojan was detected	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET)
2236	InstallUtil.exe	A Network Trojan was detected	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)