File name:

adobe.zip

Full analysis: https://app.any.run/tasks/5430cffd-2170-4d36-b589-1200c24ffb9c
Verdict: Malicious activity
Threats:

The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes.

Analysis date: March 18, 2025, 11:22:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
autorun-startup
stealer
arechclient2
rat
backdoor
xor-url
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

8F36C3DB24DDD1DC408B3589ECFCDF70

SHA1:

72642E429546E5AB207633D3C6A7E2E70698EF65

SHA256:

1DA2B2004F63B11AB0D3F67CD1431742A1656460492BD4B42FD53D413E6E1570

SSDEEP:

98304:gPxiZ3OQiJdutltURE5UItShdEgjbX4S74a71ENsTBX48+Ag3XbnGPYR2UdxJoDO:kRxm+4aEvAg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • XORed URL has been found (YARA)

      • MSBuild.exe (PID: 1240)
    • ARECHCLIENT2 has been detected (YARA)

      • MSBuild.exe (PID: 1240)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 1240)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2136)
      • audiobit.exe (PID: 2040)
    • Starts CMD.EXE for commands execution

      • audiobit.exe (PID: 2040)
    • The process drops C-runtime libraries

      • audiobit.exe (PID: 2040)
    • Executable content was dropped or overwritten

      • audiobit.exe (PID: 2040)
    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 3956)
  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2136)
      • audiobit.exe (PID: 2040)
    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6148)
      • audiobit.exe (PID: 2040)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2136)
    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2240)
      • BackgroundTransferHost.exe (PID: 6272)
      • BackgroundTransferHost.exe (PID: 5756)
      • BackgroundTransferHost.exe (PID: 6148)
      • BackgroundTransferHost.exe (PID: 5800)
    • Checks supported languages

      • MSBuild.exe (PID: 1240)
      • audiobit.exe (PID: 2040)
      • ShellExperienceHost.exe (PID: 3956)
    • Create files in a temporary directory

      • audiobit.exe (PID: 2040)
    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6148)
      • slui.exe (PID: 1388)
    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6148)
      • slui.exe (PID: 1388)
      • slui.exe (PID: 6668)
    • Reads the computer name

      • audiobit.exe (PID: 2040)
      • ShellExperienceHost.exe (PID: 3956)
      • MSBuild.exe (PID: 1240)
    • Manual execution by a user

      • audiobit.exe (PID: 2040)
    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 1240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(1240) MSBuild.exe
Decrypted-URLs (3)http://dl.google.com/chrome/install/375.126/chrome_installer.exev
https://github.com
https://pastebin.com/raw/yraPuhAK
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:03:13 14:41:00
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: SoundBAND/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe rundll32.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs audiobit.exe cmd.exe no specs conhost.exe no specs #XOR-URL msbuild.exe shellexperiencehost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
732C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1240C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\cspvppsm
c:\windows\syswow64\mshtml.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
xor-url
(PID) Process(1240) MSBuild.exe
Decrypted-URLs (3)http://dl.google.com/chrome/install/375.126/chrome_installer.exev
https://github.com
https://pastebin.com/raw/yraPuhAK
1388C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1912C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2040"C:\Users\admin\Desktop\SoundBAND\audiobit.exe" C:\Users\admin\Desktop\SoundBAND\audiobit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\soundband\audiobit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
2136"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\adobe.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2240"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3956"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
4980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5072C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exeaudiobit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 422
Read events
7 397
Write events
25
Delete events
0

Modification events

(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\adobe.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
17
Suspicious files
11
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6148BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a55e4ded-70c7-4390-9ee5-0872085af901.down_data
MD5:
SHA256:
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\libpng16.dllexecutable
MD5:7895937099678CCF369519179B223016
SHA256:C162ED44FE43320EBEEA325EB25C6B33D5411DFBA9A260D186EBCB95478EF13C
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\audiobit.exeexecutable
MD5:E69917FA99F750A6C4E19523C3F2014B
SHA256:51DE0B104E9CED3028A41D01DEDF735809EB7F60888621027C7F00F0FCF9C834
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\vcruntime140.dllexecutable
MD5:E4ED441F0F6AFB0D8D55AF87900EC48F
SHA256:09D1E604E8CDD06176FCC3D3698861BE20638A4391F9F2D9E23F868C1576CA94
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\thrall.7zbinary
MD5:64B7225CCCFEACBBDDF9053B03AC7DDA
SHA256:CFEEC8F8B61E9959C79C6DF3489B600FAE3B394C0233613DE6BF7EF04F8AF98F
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\msvcp140.dllexecutable
MD5:4D157073A891D0832B9B05FB8ACA73A8
SHA256:718812ADB0D669EEA9606432202371E358C7DE6CDEAFEDDAD222C36AE0D3F263
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\tsarevitch.pptxbinary
MD5:534271551D1FB0D94286E5F16B5FFAA0
SHA256:F056FCFD57A2BDE4102B5A5E66A4D69EE270C644BB88AB45175905E99F8FC85A
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\wxmsw313u_core_vc_custom.dllexecutable
MD5:4E6F4AFFAC9E3241078E46D237B2DBF0
SHA256:DCF938002A46CA976E1166939BAF54EBDF6031288C0D33F1857AAE6929FDC39B
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\wxbase313u_vc_custom.dllexecutable
MD5:3799A93559FF05DD981819AEE0B77BA8
SHA256:6EAFC77E96C27E957DF9D07F4EC42E378F8028340E2A15FE43BE8470B4A5C806
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.26149\SoundBAND\jpeg8.dllexecutable
MD5:E4E335EA9F7D5824A1AA3ABCBC5F7DC9
SHA256:66C5FDDAF6AF0C0ECD0CE6923010C9D4F5EAB184E6B6CB3F5453D405281366A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
672
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
2984
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6148
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
2984
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
672
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
672
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.5
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.132
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
www.bing.com
  • 92.123.104.9
  • 92.123.104.22
  • 92.123.104.20
  • 92.123.104.13
  • 92.123.104.10
  • 92.123.104.12
  • 92.123.104.14
  • 92.123.104.21
  • 92.123.104.17
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info