File name:

virus.rar

Full analysis: https://app.any.run/tasks/7388b0a5-3bf5-4c1e-8cb8-f12691b95068
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: July 19, 2024, 16:30:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
hijackloader
loader
asyncrat
rat
remote
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DA913E56C16EFFDDC6C3B9041146FFA4

SHA1:

A1AD230984C72E23D82CEC7893A3ABB3DF033D33

SHA256:

11CF35CA10BA07F602329C7ACBDCD76D5530DB731782038FE8931A8A78F4692F

SSDEEP:

98304:m6ihjw2ZzjQlZ9xQO2t7J3un3vwdr7WzpTNyQgLHn8rNqOf3ke5aUEcrgdwY5fO8:Fvrq20s4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • CITACION JUDICIAL.exe (PID: 7244)
      • WinRAR.exe (PID: 1032)
    • HIJACKLOADER has been detected (YARA)

      • cmd.exe (PID: 5936)
    • ASYNCRAT has been detected (SURICATA)

      • MSBuild.exe (PID: 5716)
    • ASYNCRAT has been detected (MUTEX)

      • MSBuild.exe (PID: 5716)
    • ASYNCRAT has been detected (YARA)

      • MSBuild.exe (PID: 5716)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 5716)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1032)
    • Executable content was dropped or overwritten

      • CITACION JUDICIAL.exe (PID: 7244)
    • Drops 7-zip archiver for unpacking

      • WinRAR.exe (PID: 1032)
    • Starts CMD.EXE for commands execution

      • CITACION JUDICIAL.exe (PID: 7244)
    • Connects to unusual port

      • MSBuild.exe (PID: 5716)
    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 5716)
  • INFO

    • Checks supported languages

      • CITACION JUDICIAL.exe (PID: 7244)
      • MSBuild.exe (PID: 5716)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1032)
    • Creates files or folders in the user directory

      • CITACION JUDICIAL.exe (PID: 7244)
    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 5716)
    • Reads the computer name

      • CITACION JUDICIAL.exe (PID: 7244)
      • MSBuild.exe (PID: 5716)
    • Create files in a temporary directory

      • CITACION JUDICIAL.exe (PID: 7244)
    • Reads Environment values

      • MSBuild.exe (PID: 5716)
    • Reads the software policy settings

      • MSBuild.exe (PID: 5716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(5716) MSBuild.exe
C2 (1)enviofinal.kozow.com
Ports (1)5051
Version| CRACKED BY https://t.me/xworm_v2
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAOQb7nA/hP/L1XXxqdDJNzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMwNTI1MDUyMTIyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIykAVxs0s6rZ/dwP6ujJtpnj6RSsCsZN6Cfj1InZxSIswX+zNiKJys8xyLlyexoya3ebLp5gOSz...
Server_SignatureH6CC69VFwMAeB1cvASWt6n66/K+g9J9WhTbw+OrBeCfv67skFd/CgT2QnjYsCUql0QIxTmCtG3tsuNetF0yVkv3Cwyfv/JwuEIXyyNW5ci5YatXq+T4ZhhUYhDdslTs9jBvwwvmIT6IsmdCuIQrcaKV62atj42oUEx58oydjFtMdlTcsls7eduiXagYuIyjPzk2hMthfGPT/QI9GuaQdOgo6P9bPSQAod0ieGoaHZ+0rI04u2JFlYxJkxWi8S0ZYf+bj9zggBzI7cwsgxUYvTM9Jr/1xh/lZSNp/oKZtejOr...
Keys
AESb4ef162c5c2b8858870784bad86f90094ed07701ead952ef99d12b829999f7e8
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe citacion judicial.exe #HIJACKLOADER cmd.exe no specs conhost.exe no specs slui.exe no specs #ASYNCRAT msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
1032"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\virus.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2252\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5340C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5716C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\rlemqbdetih
c:\windows\syswow64\mshtml.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
AsyncRat
(PID) Process(5716) MSBuild.exe
C2 (1)enviofinal.kozow.com
Ports (1)5051
Version| CRACKED BY https://t.me/xworm_v2
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAOQb7nA/hP/L1XXxqdDJNzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMwNTI1MDUyMTIyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIykAVxs0s6rZ/dwP6ujJtpnj6RSsCsZN6Cfj1InZxSIswX+zNiKJys8xyLlyexoya3ebLp5gOSz...
Server_SignatureH6CC69VFwMAeB1cvASWt6n66/K+g9J9WhTbw+OrBeCfv67skFd/CgT2QnjYsCUql0QIxTmCtG3tsuNetF0yVkv3Cwyfv/JwuEIXyyNW5ci5YatXq+T4ZhhUYhDdslTs9jBvwwvmIT6IsmdCuIQrcaKV62atj42oUEx58oydjFtMdlTcsls7eduiXagYuIyjPzk2hMthfGPT/QI9GuaQdOgo6P9bPSQAod0ieGoaHZ+0rI04u2JFlYxJkxWi8S0ZYf+bj9zggBzI7cwsgxUYvTM9Jr/1xh/lZSNp/oKZtejOr...
Keys
AESb4ef162c5c2b8858870784bad86f90094ed07701ead952ef99d12b829999f7e8
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
5936C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe
CITACION JUDICIAL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7244"C:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\CITACION JUDICIAL.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\CITACION JUDICIAL.exe
WinRAR.exe
User:
admin
Company:
madshi.net
Integrity Level:
MEDIUM
Description:
mad* home cinema control
Exit code:
1
Version:
1.1.21.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1032.43641\notificacion_proceso_judicial_demanda_juzgado_03_penal_del_circuito-09\citacion judicial.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
12 989
Read events
12 973
Write events
16
Delete events
0

Modification events

(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\virus.rar
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
8
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5936cmd.exeC:\Users\admin\AppData\Local\Temp\rlemqbdetih
MD5:
SHA256:
1032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\madHcNet32.dllexecutable
MD5:2BA4099EB6FBAC4EAAE2D6DFE71B4E18
SHA256:8BD3EDBF027972636BDB4CBB46037F0BE98CA233E19B003E860AF0BD7526A0AC
7244CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\madHcNet32.dllexecutable
MD5:2BA4099EB6FBAC4EAAE2D6DFE71B4E18
SHA256:8BD3EDBF027972636BDB4CBB46037F0BE98CA233E19B003E860AF0BD7526A0AC
1032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\Winrar\7z2301.exeexecutable
MD5:1CFB215A6FB373AC33A38B1DB320C178
SHA256:9B6682255BED2E415BFA2EF75E7E0888158D1AAF79370DEFAA2E2A5F2B003A59
1032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\unrar.dllexecutable
MD5:851C9E8CE9F94457CC36B66678F52494
SHA256:0891EDB0CC1C0208AF2E4BC65D6B5A7160642F89FD4B4DC321F79D2B5DFC2DCC
7244CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\sallow.mdbbinary
MD5:2556ACA0B94D623367029C5D5F89E98E
SHA256:B45A92A00018F7F4FE2C2C9FCC863292E232FC99CAA991D936ECF858692F69BF
7244CITACION JUDICIAL.exeC:\Users\admin\AppData\Local\Temp\a410d7febinary
MD5:1C816B42D9D2F56BCA65552427ACC1FF
SHA256:767F88548656901934704220095DCBD2CC2C0EDA3AA71DA51F3E64DA16028E7A
1032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\mvrSettings32.dllexecutable
MD5:D168F18B79F9F33690F011D1DEB1E7CF
SHA256:B7D3BC460A17E1B43C9FF09786E44EA4033710538BDB539400B55E5B80D0B338
5936cmd.exeC:\Users\admin\AppData\Local\Temp\kppenvrfdmqbinary
MD5:F68009F536C03818FC85A7992BEC21C6
SHA256:51E2E3DDDD5EA1D13F536C3B062E0225485188363FC3E3AFD7FBA3745F485F66
1032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1032.43641\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\CITACION JUDICIAL.exeexecutable
MD5:B841D408448F2A07F308CED1589E7673
SHA256:69A90665113BD73B30360D87F7F6ED2C789A90A67F3B6E86474E21273A64F699
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
33
DNS requests
15
Threats
6

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4716
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5620
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4032
svchost.exe
239.255.255.250:1900
whitelisted
7856
svchost.exe
52.230.59.222:443
MICROSOFT-CORP-MSN-AS-BLOCK
SG
unknown
4
System
192.168.100.255:138
whitelisted
2760
svchost.exe
40.113.110.67:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6120
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6032
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.23
  • 20.190.159.4
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.71
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 184.86.251.14
  • 184.86.251.4
  • 184.86.251.25
  • 184.86.251.30
  • 184.86.251.11
  • 184.86.251.27
  • 184.86.251.7
  • 184.86.251.9
  • 184.86.251.13
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
enviofinal.kozow.com
  • 45.32.175.194
malicious

Threats

PID
Process
Class
Message
2168
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.kozow .com Domain
5716
MSBuild.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
5716
MSBuild.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
5716
MSBuild.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
5716
MSBuild.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
1 ETPRO signatures available at the full report
No debug info