File name:

Mensajes en cuarentena (5).zip

Full analysis: https://app.any.run/tasks/25799bdc-a0ea-419f-b676-1ca04bf14d4f
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: July 23, 2024, 08:42:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
spam
rat
asyncrat
remote
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

03D25AED84A99AC9CF89A47F584045FD

SHA1:

5522C5822EB960492DCB235882B6055E8E5C0233

SHA256:

4D0647A021386A272F886018A43A7305ED758E36B3BF0571BF7C88F6619D4631

SSDEEP:

768:1wkN7gIrYHTI5qb4Gz3lzSbl32ak1xR5jq:WLIkHmKM1Rk1xzm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (SURICATA)

      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • ASYNCRAT has been detected (YARA)

      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 2340)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2340)
      • WinRAR.exe (PID: 3220)
      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • Contacting a server suspected of hosting an CnC

      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • Connects to unusual port

      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

  • INFO

    • Reads the computer name

      • TextInputHost.exe (PID: 5192)
      • identity_helper.exe (PID: 7768)
      • identity_helper.exe (PID: 6376)
      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • Checks supported languages

      • TextInputHost.exe (PID: 5192)
      • identity_helper.exe (PID: 7768)
      • identity_helper.exe (PID: 6376)
      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 2340)
      • msedge.exe (PID: 5500)
      • msedge.exe (PID: 5788)

    • Reads Environment values

      • identity_helper.exe (PID: 7768)
      • identity_helper.exe (PID: 6376)
      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • Checks proxy server information

      • slui.exe (PID: 6544)

    • The process uses the downloaded file

      • msedge.exe (PID: 3500)
      • msedge.exe (PID: 8016)
      • msedge.exe (PID: 308)
      • msedge.exe (PID: 5788)
      • WinRAR.exe (PID: 3220)

    • Application launched itself

      • msedge.exe (PID: 5500)
      • msedge.exe (PID: 5788)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3220)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3220)

    • Reads the machine GUID from the registry

      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)

    • Reads the software policy settings

      • RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe (PID: 2588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(2588) RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe
C2 (1)dxpam.duckdns.org
Ports (1)5999
Version1.0.7
Options
AutoRunfalse
MutexDcRatMutex_qwqdanchun
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureeROjiuz0PWs+xgxamB7sdm3kB9OKtq8I1pPHgtkdiF0h9pw4eJzyp0fCw7zAO7/Q6+ftDqxvY+0OnHCoiErkMARDy55VYX6/gB5S0xXaoVgAqsvboJJN7EtFrwNTMUTPnslStHIwjEI/4a7JpzD5BLO0KCD9qZ2yVxSo7MwJXPE=
Keys
AESd87cc52fc4e6f60c76fd8ad033716334d5af6e39f2297effe8fadd57c01941a5
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2024:07:23 08:41:54
ZipCRC: 0xd1158ec1
ZipCompressedSize: 4294967295
ZipUncompressedSize: 4294967295
ZipFileName: 8737c493-1294-440e-4754-08dcaaeb3fa5/93bbf5a7-b1d5-9615-8fa0-f1d5064639f5.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
65
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe slui.exe ai.exe no specs outlook.exe no specs textinputhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs outlook.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe #ASYNCRAT rad001a65247825014705151869862547982105862060662525875202154784782553 simit dirección nacional consulta tu estado de comparendos.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6360 --field-trial-handle=2252,i,6441862794338003378,9225566754858422173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
504"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2288 --field-trial-handle=2308,i,1839886577130165988,7961905520992105203,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6076 --field-trial-handle=2252,i,6441862794338003378,9225566754858422173,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?export=download&id=1byDY-1qt_URF7Qy6YDq1UYGjAcKMWMxXC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1256"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2524 --field-trial-handle=2308,i,1839886577130165988,7961905520992105203,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1756"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "663D8578-828C-4B98-A7EC-4DFE6A9E0D6C" "7DD1B651-6B18-4501-9840-3FF188FCF240" "6820"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
2340"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Mensajes en cuarentena (5).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2452"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2696 --field-trial-handle=2308,i,1839886577130165988,7961905520992105203,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2588"C:\Users\admin\AppData\Local\Temp\Rar$EXb3220.7854\RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3220.7854\RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3220.7854\rad001a65247825014705151869862547982105862060662525875202154784782553 simit dirección nacional consulta tu estado de comparendos.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
AsyncRat
(PID) Process(2588) RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe
C2 (1)dxpam.duckdns.org
Ports (1)5999
Version1.0.7
Options
AutoRunfalse
MutexDcRatMutex_qwqdanchun
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureeROjiuz0PWs+xgxamB7sdm3kB9OKtq8I1pPHgtkdiF0h9pw4eJzyp0fCw7zAO7/Q6+ftDqxvY+0OnHCoiErkMARDy55VYX6/gB5S0xXaoVgAqsvboJJN7EtFrwNTMUTPnslStHIwjEI/4a7JpzD5BLO0KCD9qZ2yVxSo7MwJXPE=
Keys
AESd87cc52fc4e6f60c76fd8ad033716334d5af6e39f2297effe8fadd57c01941a5
SaltDcRatByqwqdanchun
2628"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4736 --field-trial-handle=2252,i,6441862794338003378,9225566754858422173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
54 619
Read events
53 985
Write events
557
Delete events
77

Modification events

(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Mensajes en cuarentena (5).zip
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2340) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-157
Value:
E-mail Message
(PID) Process:(2340) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
2
Suspicious files
130
Text files
95
Unknown types
9

Dropped files

PID
Process
Filename
Type
6820OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
2340WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2340.45821\93bbf5a7-b1d5-9615-8fa0-f1d5064639f5.eml:OECustomPropertybinary
MD5:E335945F18C7C4D3F315A6E3FD1FFD58
SHA256:C202BEC37F6DDAC41250778AE57DE886922F1CF82C361987DC2B0610B9CB1C2F
2340WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2340.45821\93bbf5a7-b1d5-9615-8fa0-f1d5064639f5.emlbinary
MD5:F13BD1C4EE1575E6F5A32059161B2A8F
SHA256:A7C101B3E3232C3014043A5CA88DE87F96D8E7BD7656351FAC194604F7D9EB60
6820OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:46BE928930F887EC6B1F86C774378C63
SHA256:112D8D2F0C62295B204D55BEEC263A96DCB7FBE26E36B10F522B7DB646CE36FE
6820OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:A3FA6499631D7387AF9D7FF8AD61D460
SHA256:B29179779D14BD4D03118DD46665D9F3C7DBB33A460B56E97066B89133CA6AF8
5500msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFeb64b.TMP —
MD5:—
SHA256:—
6820OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmabr
MD5:165BD152C8FB119E71297D7DBCFA1689
SHA256:CF07C3FC5B25CDDB78BF9438458E15ED3E5A023E043D22E5B9930185288C243E
2340WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_2340.46790compressed
MD5:D3934095B6D61D810BE0CED5F80AE276
SHA256:B48B60B94117E005760B0DEEF5A2A928E13764B914BD209D2B0FBC5B242E92FF
5500msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFeb64b.TMP —
MD5:—
SHA256:—
5500msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
95
DNS requests
74
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3148
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3056
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3360
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6012
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
184.86.251.31:443
—
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4204
svchost.exe
4.209.33.156:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3360
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6112
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
omex.cdn.office.net
  • 23.48.23.42
  • 23.48.23.30
  • 23.48.23.52
  • 23.48.23.45
  • 23.48.23.62
  • 23.48.23.43
  • 23.48.23.63
  • 23.48.23.38
  • 23.48.23.65
whitelisted
messaging.lifecycle.office.com
  • 52.111.243.12
whitelisted
www.bing.com
  • 184.86.251.16
  • 184.86.251.11
  • 184.86.251.15
  • 184.86.251.9
  • 184.86.251.8
  • 184.86.251.10
  • 184.86.251.13
  • 184.86.251.4
  • 184.86.251.14
  • 2.23.209.155
  • 2.23.209.147
  • 2.23.209.158
  • 2.23.209.149
  • 2.23.209.153
  • 2.23.209.154
  • 2.23.209.156
  • 2.23.209.150
  • 2.23.209.157
  • 2.23.209.186
  • 2.23.209.189
  • 2.23.209.181
  • 2.23.209.180
  • 2.23.209.182
  • 2.23.209.191
  • 2.23.209.185
  • 2.23.209.183
  • 2.23.209.188
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.136
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
2284
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2284
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2284
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2284
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2588
RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
2588
RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
2588
RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mensajes en cuarentena (5).zip