| File name: | 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33 |
| Full analysis: | https://app.any.run/tasks/46c42dda-a7a4-4394-b5ee-a5c250950a37 |
| Verdict: | Malicious activity |
| Threats: | The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes. |
| Analysis date: | August 01, 2025, 03:14:15 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 0139B5F2565B3C046F2785EF43B48CFE |
| SHA1: | B31AAB8BBC6548ABE2B17E1D8E9A787BC15E1AE8 |
| SHA256: | 74C70A9E45A5DBA1040FA34981286F2927B1FBB6B8F5D9740DD51752516EFF33 |
| SSDEEP: | 24576:kLXvOkVkk8Dr+kobzZyuYntEhqc8MnJIH9vFJ0wNUDb5FKIUL:kLOkVkk8D6kobzZy/ntEhqc8MnmH9vFl |
MALICIOUS
SECTOPRAT has been detected
- cmd.exe (PID: 3656)
SUSPICIOUS
Reads security settings of Internet Explorer
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
Starts CMD.EXE for commands execution
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
- cmd.exe (PID: 3656)
Executing commands from ".cmd" file
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
Get information on the list of running processes
- cmd.exe (PID: 3656)
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 3656)
Application launched itself
- cmd.exe (PID: 3656)
Starts application with an unusual extension
- cmd.exe (PID: 3656)
The executable file from the user directory is run by the CMD process
- Continuous.com (PID: 2356)
Starts the AutoIt3 executable file
- cmd.exe (PID: 3656)
There is functionality for taking screenshot (YARA)
- Continuous.com (PID: 2356)
INFO
Create files in a temporary directory
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
Reads the computer name
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
- Continuous.com (PID: 2356)
Process checks computer location settings
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
Checks supported languages
- 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe (PID: 4036)
- Continuous.com (PID: 2356)
Creates a new folder
- cmd.exe (PID: 6760)
Reads mouse settings
- Continuous.com (PID: 2356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2012:02:24 19:20:04+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 29696 |
| InitializedDataSize: | 503808 |
| UninitializedDataSize: | 16896 |
| EntryPoint: | 0x38af |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
Total processes
146
Monitored processes
11
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1976 | findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2356 | Continuous.com R | C:\Users\admin\AppData\Local\Temp\550046\Continuous.com | cmd.exe | ||||||||||||
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Version: 3, 3, 14, 4 Modules
| |||||||||||||||
| 2964 | findstr /I "wrsa opssvc" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3504 | choice /d y /t 5 | C:\Windows\SysWOW64\choice.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Offers the user a choice Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3656 | "C:\Windows\System32\cmd.exe" /c copy Scout Scout.cmd && Scout.cmd | C:\Windows\SysWOW64\cmd.exe | 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3844 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3948 | cmd /c copy /b ..\Diagnosis R | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4036 | "C:\Users\admin\AppData\Local\Temp\74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe" | C:\Users\admin\AppData\Local\Temp\74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4648 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5968 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
940
Read events
940
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3656 | cmd.exe | C:\Users\admin\AppData\Local\Temp\550046\Continuous.com | binary | |
MD5:69691C7BDCC3CE6D5D8A1361F22D04AC | SHA256:08F271887CE94707DA822D5263BAE19D5519CB3614E0DAEDC4C7CE5DAB7473F1 | |||
| 4036 | 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe | C:\Users\admin\AppData\Local\Temp\Movement | binary | |
MD5:508DD472A89794E64AD5EEB315F9939D | SHA256:EF279E2EEF2F3F56EBAC738D3EAC31CA1EE46A201998BFE941CCB940B947C221 | |||
| 3656 | cmd.exe | C:\Users\admin\AppData\Local\Temp\Scout.cmd | text | |
MD5:B03D9921E1D7AACAAF23E52C78C1B79E | SHA256:337A38B724F6601C3C7B864316642C044A415ACBE840ED13B2D62D220FF3FE29 | |||
| 4036 | 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe | C:\Users\admin\AppData\Local\Temp\Diagnosis | binary | |
MD5:1ED187567D2753BB83CA63CE55C3F4A0 | SHA256:56595EF1A7047B970D9AA072EE402C0EC66319ACEC589F31F6B4B89648106743 | |||
| 3948 | cmd.exe | C:\Users\admin\AppData\Local\Temp\550046\R | binary | |
MD5:1ED187567D2753BB83CA63CE55C3F4A0 | SHA256:56595EF1A7047B970D9AA072EE402C0EC66319ACEC589F31F6B4B89648106743 | |||
| 4036 | 74c70a9e45a5dba1040fa34981286f2927b1fbb6b8f5d9740dd51752516eff33.exe | C:\Users\admin\AppData\Local\Temp\Scout | text | |
MD5:B03D9921E1D7AACAAF23E52C78C1B79E | SHA256:337A38B724F6601C3C7B864316642C044A415ACBE840ED13B2D62D220FF3FE29 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
30
DNS requests
13
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4892 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.3.109.244:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6760 | SIHClient.exe | GET | 200 | 23.3.109.244:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6760 | SIHClient.exe | GET | 200 | 23.3.109.244:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2288 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4892 | svchost.exe | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4892 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
1268 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.3.109.244:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
khmjQtPZBDhtu.khmjQtPZBDhtu |
| unknown |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |