File name:

ss.ps1

Full analysis: https://app.any.run/tasks/031d98bb-3696-4369-8202-2130e87f93d3
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 17, 2023, 20:16:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
quasar
asyncrat
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

970ACA768E68FAA580F758A1A379686B

SHA1:

6A93921485CBD83382EB5A47315B1F0A67BCF684

SHA256:

6C1E62385D660CA43E024D461154FBB4805E429CDF7850D19510D7F69533739E

SSDEEP:

49152:CY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+s:E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual connection from system programs

      • RegAsm.exe (PID: 2404)

    • Connects to the CnC server

      • RegAsm.exe (PID: 2404)

    • QUASAR detected by memory dumps

      • RegAsm.exe (PID: 2404)

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 2404)

    • QUASAR was detected

      • RegAsm.exe (PID: 2404)

    • ASYNCRAT was detected

      • RegAsm.exe (PID: 2404)

    • ASYNCRAT detected by memory dumps

      • RegAsm.exe (PID: 2404)

  • SUSPICIOUS

    • Reads the Internet Settings

      • powershell.exe (PID: 1772)

    • Reads settings of System Certificates

      • RegAsm.exe (PID: 2404)

    • Connects to unusual port

      • RegAsm.exe (PID: 2404)

  • INFO

    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 2404)

    • Reads the computer name

      • RegAsm.exe (PID: 2404)

    • Reads Environment values

      • RegAsm.exe (PID: 2404)

    • Checks supported languages

      • RegAsm.exe (PID: 2404)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 1772)

    • The process checks LSA protection

      • powershell.exe (PID: 1772)
      • RegAsm.exe (PID: 2404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(2404) RegAsm.exe
Version1.4.0
C2 (2)ghcc.duckdns.org:4782
Sub_DirSubDir
Install_NameClient.exe
Mutexa9c03eb7-f3c1-4b9e-a4f7-1962d17a793b
StartupUpdate
TagOffice04
LogDirLogs
SignatureBmURqSFZ1h2iQNUFHO7t3JRIXIZcWwELygvZDWIr3vX6NxWQP68g106p2vVr72210wgoaCAv4Ul4E/IjFIlaKGItU1/tiYVTY0YHdPX2xUlyaprjohsVra3+XrW2o/xclc5YfL/zpgRFBuuOLL6+Zx4GS2gummWhFS0XUd/xYkRc3ANvVe9OSBqLjkSnQmWmtOafaUZ4zoLG2hbT/yPBMU/4cR7FGqbTqVo8meFUBN8yDrahXffVXM4eGWmIkpgjv4V9X+T7qJmwZfZcM6MGT7NwjVptw8cWtx28oI6gLT89...
CertificateMIIE9DCCAtygAwIBAgIQAP+vzY1ukBhsntvfMpJ2ozANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDExMzIzMTk0MFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvpJmhK1164+lKKlpHbySFZY44CPihUYne/jdh7mfMPfamwm0xw8FEZwqF5xop/GYCCEvzbF6...
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs #ASYNCRAT regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
1772"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\ss.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2404"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
Quasar
(PID) Process(2404) RegAsm.exe
Version1.4.0
C2 (2)ghcc.duckdns.org:4782
Sub_DirSubDir
Install_NameClient.exe
Mutexa9c03eb7-f3c1-4b9e-a4f7-1962d17a793b
StartupUpdate
TagOffice04
LogDirLogs
SignatureBmURqSFZ1h2iQNUFHO7t3JRIXIZcWwELygvZDWIr3vX6NxWQP68g106p2vVr72210wgoaCAv4Ul4E/IjFIlaKGItU1/tiYVTY0YHdPX2xUlyaprjohsVra3+XrW2o/xclc5YfL/zpgRFBuuOLL6+Zx4GS2gummWhFS0XUd/xYkRc3ANvVe9OSBqLjkSnQmWmtOafaUZ4zoLG2hbT/yPBMU/4cR7FGqbTqVo8meFUBN8yDrahXffVXM4eGWmIkpgjv4V9X+T7qJmwZfZcM6MGT7NwjVptw8cWtx28oI6gLT89...
CertificateMIIE9DCCAtygAwIBAgIQAP+vzY1ukBhsntvfMpJ2ozANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDExMzIzMTk0MFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvpJmhK1164+lKKlpHbySFZY44CPihUYne/jdh7mfMPfamwm0xw8FEZwqF5xop/GYCCEvzbF6...
Total events
9 356
Read events
9 178
Write events
178
Delete events
0

Modification events

(PID) Process:(1772) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1772) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1772) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1772) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1772) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2404) RegAsm.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2404) RegAsm.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Update
Value:
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
(PID) Process:(2404) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2404) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2404) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
0
Suspicious files
14
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2404RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:A3D4A45CB5FFA679A87D5E15116209F3
SHA256:D7CD561CB8C2CA3B45D027D63FF80FAF4204CB4715AEDE539A0D517A94F4A3AB
1772powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF106f1e7.TMPbinary
MD5:CCFCF369F751CE8DA0370D84E52A7EED
SHA256:53922490C3F5A04667EC3605A01AF2A4F4F265782D1BCA519F63ACAD413F2ED9
1772powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:B5CB4E8687032935729FAC33E78286B6
SHA256:A0A8CF517A201DC1524077A9932DF4D2F8123A1E2DFDDBC44BC6B57F72BC9D99
1772powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CHVVPCWRSSADZFJHXBTJ.tempbinary
MD5:B5CB4E8687032935729FAC33E78286B6
SHA256:A0A8CF517A201DC1524077A9932DF4D2F8123A1E2DFDDBC44BC6B57F72BC9D99
1772powershell.exeC:\Users\admin\AppData\Local\Temp\2fniez0h.ntx.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
1772powershell.exeC:\Users\admin\AppData\Local\Temp\03v3dndn.0kj.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
1772powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2404RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:FC4666CBCA561E864E7FDF883A9E6661
SHA256:10F3DEB6C452D749A7451B5D065F4C0449737E5EE8A44F4D15844B503141E65B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
4
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2404
RegAsm.exe
GET
200
8.238.32.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?db5e4cb627840a14
US
compressed
61.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2404
RegAsm.exe
64.185.227.155:443
api.ipify.org
WEBNX
US
malicious
2404
RegAsm.exe
185.172.148.96:443
tools.keycdn.com
proinity GmbH
CH
suspicious
2404
RegAsm.exe
8.238.32.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2404
RegAsm.exe
95.216.102.32:4782
ghcc.duckdns.org
Hetzner Online GmbH
FI
malicious
2404
RegAsm.exe
8.238.28.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
ghcc.duckdns.org
  • 95.216.102.32
malicious
ctldl.windowsupdate.com
  • 8.238.28.126
  • 8.238.32.126
  • 8.248.115.254
  • 8.248.133.254
  • 8.248.145.254
whitelisted
tools.keycdn.com
  • 185.172.148.96
suspicious
api.ipify.org
  • 64.185.227.155
  • 173.231.16.75
  • 104.237.62.211
shared

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
A Network Trojan was detected
ET TROJAN Observed Malicious SSL Cert (Quasar CnC)
—
—
A Network Trojan was detected
ET TROJAN Generic AsyncRAT Style SSL Cert
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ss.ps1