Analysis date (UTC): 14 November 2023, 12:27Analysis environment: Windows 7 Pro, build 7601, x64

https://github.com/supoyev/Escape-from-Tarkov-External-Esp-Aimbot-Cheat/raw/main/escape%20from%20tarkov/Escape%20From%20Tarkov/Escape%20From%20Tarkov%E2%80%AEnls..scr

SHA1:3065DA0D35988807C34C98164D35385F846AB1DF

SHA256:84C8AD42D82A82951A1968C738FC813A83FC5CD6F1C2F446F2960CF21A373E14

Analysis result

Threat level:Malicious activity

Tags:

ratasyncratremote

Full analysis:Analysis https://github.com/supoyev/Escape-from-Tarkov-External-Esp-Aimbot-Cheat/raw/main/escape%20from%20tarkov/Escape%20From%20Tarkov/Escape%20From%20Tarkov%E2%80%AEnls..scr Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Escape From Tarkov_nls..scr (PID: 3552)
6eYwGvYfZ8.exe (PID: 3780)
powershell.exe (PID: 2504)
RegAsm.exe (PID: 2756)

Create files in the Startup directory

6eYwGvYfZ8.exe (PID: 3780)

ASYNCRAT has been detected (SURICATA)

RegAsm.exe (PID: 2756)

ASYNCRAT has been detected (YARA)

RegAsm.exe (PID: 2756)

SUSPICIOUS

Reads the Internet Settings

Escape From Tarkov_nls..scr (PID: 3552)
hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)
powershell.exe (PID: 4088)
powershell.exe (PID: 3820)
rundll32.exe (PID: 3708)
powershell.exe (PID: 3912)
powershell.exe (PID: 2504)
RegAsm.exe (PID: 2756)
powershell.exe (PID: 4092)
powershell.exe (PID: 3052)
powershell.exe (PID: 2996)
powershell.exe (PID: 2504)
powershell.exe (PID: 2524)
powershell.exe (PID: 3144)
cmd.exe (PID: 3016)
powershell.exe (PID: 3376)

Reads settings of System Certificates

Escape From Tarkov_nls..scr (PID: 3552)
RegAsm.exe (PID: 2756)

Starts CMD.EXE for commands execution

Escape From Tarkov_nls..scr (PID: 3552)
icannotseeyou.exe (PID: 2572)

Uses RUNDLL32.EXE to load library

cmd.exe (PID: 3648)

Starts POWERSHELL.EXE for commands execution

hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)
cmd.exe (PID: 3016)

BASE64 encoded PowerShell command has been detected

hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)

Base64-obfuscated command line is found

hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)

The Powershell connects to the Internet

powershell.exe (PID: 3820)
powershell.exe (PID: 3912)
powershell.exe (PID: 4088)
powershell.exe (PID: 2504)
powershell.exe (PID: 3052)
powershell.exe (PID: 2996)
powershell.exe (PID: 2524)
powershell.exe (PID: 4092)
powershell.exe (PID: 2504)
powershell.exe (PID: 3144)
powershell.exe (PID: 3376)

Unusual connection from system programs

powershell.exe (PID: 3820)
powershell.exe (PID: 3912)
powershell.exe (PID: 4088)
powershell.exe (PID: 2504)
powershell.exe (PID: 4092)
powershell.exe (PID: 3052)
powershell.exe (PID: 2996)
powershell.exe (PID: 2524)
powershell.exe (PID: 2504)
powershell.exe (PID: 3144)
powershell.exe (PID: 3376)

Process drops legitimate windows executable

powershell.exe (PID: 2504)
RegAsm.exe (PID: 2756)

Connects to unusual port

RegAsm.exe (PID: 2756)

Executing commands from a ".bat" file

icannotseeyou.exe (PID: 2572)

Uses TIMEOUT.EXE to delay execution

cmd.exe (PID: 3016)

The process executes via Task Scheduler

4KSDFSFGQ.exe (PID: 684)

INFO

The process uses the downloaded file

firefox.exe (PID: 2944)

Checks supported languages

Escape From Tarkov_nls..scr (PID: 3552)
hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)
6eYwGvYfZ8.exe (PID: 3780)
4KSDFSFGQ.exe (PID: 4064)
RegAsm.exe (PID: 2756)
icannotseeyou.exe (PID: 2572)
4KSDFSFGQ.exe (PID: 684)
RegAsm.exe (PID: 4932)
RunNihaiersion.exe (PID: 4196)
RunNihaiersion.exe (PID: 4720)

Application launched itself

firefox.exe (PID: 2944)

Manual execution by a user

Escape From Tarkov_nls..scr (PID: 3552)
WinRAR.exe (PID: 4444)
RunNihaiersion.exe (PID: 4196)
RunNihaiersion.exe (PID: 4720)

Reads the computer name

Escape From Tarkov_nls..scr (PID: 3552)
hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)
6eYwGvYfZ8.exe (PID: 3780)
4KSDFSFGQ.exe (PID: 4064)
RegAsm.exe (PID: 2756)
4KSDFSFGQ.exe (PID: 684)
RegAsm.exe (PID: 4932)
RunNihaiersion.exe (PID: 4196)
RunNihaiersion.exe (PID: 4720)

Checks proxy server information

Escape From Tarkov_nls..scr (PID: 3552)

Reads the machine GUID from the registry

Escape From Tarkov_nls..scr (PID: 3552)
6eYwGvYfZ8.exe (PID: 3780)
RegAsm.exe (PID: 2756)
4KSDFSFGQ.exe (PID: 4064)
4KSDFSFGQ.exe (PID: 684)
RegAsm.exe (PID: 4932)

Create files in a temporary directory

Escape From Tarkov_nls..scr (PID: 3552)
icannotseeyou.exe (PID: 2572)

Drops the executable file immediately after the start

firefox.exe (PID: 2944)

The executable file from the user directory is run by the CMD process

hF3nP5CjhI.exe (PID: 3756)
xU2bRls9x8.exe (PID: 3852)
gGGpmHMqVl.exe (PID: 4004)
AmZxIPbzHv.exe (PID: 1172)
6eYwGvYfZ8.exe (PID: 3780)

Creates files or folders in the user directory

6eYwGvYfZ8.exe (PID: 3780)

The executable file from the user directory is run by the Powershell process

4KSDFSFGQ.exe (PID: 4064)

Reads Environment values

RegAsm.exe (PID: 2756)

Threats

PID	Process	Class	Message
3552	Escape From Tarkov_nls..scr	Potentially Bad Traffic	ET INFO Pastebin-style Service (textbin .net in TLS SNI)
324	svchost.exe	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3552	Escape From Tarkov_nls..scr	Potentially Bad Traffic	ET INFO Pastebin-style Service (textbin .net in TLS SNI)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3552	Escape From Tarkov_nls..scr	Misc activity	ET INFO Observed Discord Domain (discordapp .com in TLS SNI)

Rows per page