Malware analysis tmp.zip Malicious activity | ANY.RUN

Add for printing

File name:	tmp.zip
Full analysis:	https://app.any.run/tasks/5830aacd-6ee7-4b4e-8a35-5c20998791d7
Verdict:	Malicious activity
Threats:	The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes. A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. Malware Trends Tracker >>>
Analysis date:	October 02, 2024, 12:17:30
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arechclient2 backdoor xor-url generic
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:	76AE0DB80E1B7907ECB1674F42625B8D
SHA1:	2E5578D70BEC5969D6820A9B445E2AF0DA1A03CF
SHA256:	5D54B99ED38527E7D79FB88D612DA2347CFA5E69A88F1B6516B80E40A16D8F1C
SSDEEP:	49152:xwo1WwDXzhhShSE9rzuXxxG0ai3aa2CYhIMXKyUId15IiIkPuTIYJN3LYsT4/ywz:CoAwT8SEH0Xqa2CIIvociSI83LYA4/ae

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Connects to the CnC server
  - InstallUtil.exe (PID: 5732)
- ARECHCLIENT2 has been detected (SURICATA)
  - InstallUtil.exe (PID: 5732)
- XORed URL has been found (YARA)
  - InstallUtil.exe (PID: 5732)
SUSPICIOUS
- Contacting a server suspected of hosting an CnC
  - InstallUtil.exe (PID: 5732)
- Connects to unusual port
  - InstallUtil.exe (PID: 5732)
INFO
- Manual execution by a user
  - cmd.exe (PID: 5084)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 5508)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

xor-url

(PID) Process(5732) InstallUtil.exe

Decrypted-URLs (3)http://dl.google.com/chrome/install/375.126/chrome_installer.exe

https://github.com

https://pastebin.com/raw/eB8bmiVA

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	Deflated
ZipModifyDate:	2024:10:02 09:44:22
ZipCRC:	0x879b4719
ZipCompressedSize:	475045
ZipUncompressedSize:	947288
ZipFileName:	AutoIt3.exe

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

832

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

—

AutoIt3.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

.NET Framework installation utility

Exit code:

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

5084

"C:\WINDOWS\system32\cmd.exe"

C:\Windows\System32\cmd.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll

5220

AutoIt3.exe dchhbfa.a3x

C:\dfadakh\AutoIt3.exe

—

cmd.exe

User:

admin

Company:

AutoIt Team

Integrity Level:

MEDIUM

Description:

AutoIt v3 Script

Exit code:

Version:

3, 3, 16, 1

Modules

Images
c:\dfadakh\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll

5508

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\tmp.zip

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

5732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

AutoIt3.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

.NET Framework installation utility

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll

xor-url

(PID) Process(5732) InstallUtil.exe

Decrypted-URLs (3)http://dl.google.com/chrome/install/375.126/chrome_installer.exe

https://github.com

https://pastebin.com/raw/eB8bmiVA

Add for printing

Total events

4 157

Read events

4 126

Write events

Delete events

Modification events


(PID) Process:	(5508) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(5508) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\tmp.zip
(PID) Process:	(5508) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(5508) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(5508) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(5508) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(5220) AutoIt3.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:	write	Name:	dchhbfa
Value: "C:\dfadakh\AutoIt3.exe" C:\dfadakh\dchhbfa.a3x
(PID) Process:	(5732) InstallUtil.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(5732) InstallUtil.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(5732) InstallUtil.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\nimda\llg\content.js		text
		MD5:FEFC21602C9CB58C46919F0E9A48B57A	SHA256:F48069A8DC9737C9437AB0D02261747EA0A3063EE80A11372F70358C1CE6C606
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\Temp\tmpD510.tmp		sqlite
		MD5:06AD9E737639FDC745B3B65312857109	SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\nimda\llg\icon.png		image
		MD5:2C905A6E4A21A3FA14ADC1D99B7CBC03	SHA256:CC3631CED23F21AE095C1397770E685F12F6AD788C8FA2F15487835A77A380FB
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\Temp\tmpD511.tmp		sqlite
		MD5:06AD9E737639FDC745B3B65312857109	SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\Temp\tmpD50F.tmp		sqlite
		MD5:06AD9E737639FDC745B3B65312857109	SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\Temp\tmp4CE2.tmp		sqlite
		MD5:06AD9E737639FDC745B3B65312857109	SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\Temp\tmp4CC1.tmp		binary
		MD5:06AD9E737639FDC745B3B65312857109	SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5508	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa5508.31189\dchhbfa.a3x		binary
		MD5:54A4AE586596C6C4F02F454E20DA2F15	SHA256:1231833EA78A813B8FCCDCF14D1A8D28EE7AA50ED5ECB4716D4B5328EE3FE8DD
5732	InstallUtil.exe	C:\Users\admin\AppData\Local\Temp\tmp4D21.tmp		sqlite
		MD5:46D9FCA6032297F8AEE08D73418312BA	SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4
5508	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa5508.31189\AutoIt3.exe		executable
		MD5:0ADB9B817F1DF7807576C2D7068DD931	SHA256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2120	MoUsoCoreWorker.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5880	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted
2512	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
2512	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
1232	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5732	InstallUtil.exe	GET	200	45.141.87.50:9000	http://45.141.87.50:9000/wbinjget?q=EF680CC9EFE0A8BCEC05D07897760CE8	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5388	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	88.221.169.152:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5388	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5880	svchost.exe	20.190.159.71:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5880	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
3260	svchost.exe	40.115.3.253:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59	whitelisted
www.microsoft.com	88.221.169.152 184.30.21.171	whitelisted
google.com	142.250.185.142	whitelisted
login.live.com	20.190.159.71 20.190.159.23 20.190.159.64 40.126.31.67 20.190.159.2 20.190.159.75 40.126.31.73 20.190.159.4	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
client.wns.windows.com	40.115.3.253	whitelisted
browser.pipe.aria.microsoft.com	20.189.173.17	whitelisted
go.microsoft.com	23.35.238.131	whitelisted
www.bing.com	2.23.209.156 2.23.209.143 2.23.209.144 2.23.209.149 2.23.209.142 2.23.209.154 2.23.209.150 2.23.209.158 2.23.209.157	whitelisted
th.bing.com	2.23.209.157 2.23.209.156 2.23.209.143 2.23.209.144 2.23.209.149 2.23.209.142 2.23.209.154 2.23.209.150 2.23.209.158	whitelisted

Threats

PID	Process	Class	Message
5732	InstallUtil.exe	Malware Command and Control Activity Detected	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init
5732	InstallUtil.exe	A Network Trojan was detected	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity
5732	InstallUtil.exe	A Network Trojan was detected	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Add for printing

No debug info

General Info

tmp.zip

76AE0DB80E1B7907ECB1674F42625B8D

2E5578D70BEC5969D6820A9B445E2AF0DA1A03CF

5D54B99ED38527E7D79FB88D612DA2347CFA5E69A88F1B6516B80E40A16D8F1C

49152:xwo1WwDXzhhShSE9rzuXxxG0ai3aa2CYhIMXKyUId15IiIkPuTIYJN3LYsT4/ywz:CoAwT8SEH0Xqa2CIIvociSI83LYA4/ae

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Connects to the CnC server

ARECHCLIENT2 has been detected (SURICATA)

XORed URL has been found (YARA)

SUSPICIOUS

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Manual execution by a user

Executable content was dropped or overwritten

Malware configuration

xor-url

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Malware configuration

xor-url

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings