Find similar analyses in TI Lookup
Analysis date (UTC): 4 November 2024, 07:31Analysis environment: Windows 10 Pro, build 19045, x64

https://uploadnow.io/en/share?utm_source=R5BKR4b

MD5:A652D81BDDEAF92B3A4A2FF49905EB13
SHA1:A8FF961A2041AA0362F8C4B9B862EEFC9CF10986
SHA256:229E94183E60B6A79596C978FFDDD962F53CCD092F0A97E6F73254739948DA8F

Analysis result

Threat level:Malicious activity
Tags:
evasionasyncrat
Full analysis:Analysis https://uploadnow.io/en/share?utm_source=R5BKR4b Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

ASYNCRAT has been detected (YARA)

  • BaffClientLoader.exe (PID: 3860)

SUSPICIOUS

Executable content was dropped or overwritten

  • BaffClientCrack.exe (PID: 5160)
  • BaffClientCrack.exe (PID: 7228)

Uses WMIC.EXE to obtain Windows Installer data

  • Umbral.exe (PID: 1588)
  • Umbral.exe (PID: 2312)

Executing commands from a ".bat" file

  • BaffClientCrack.exe (PID: 7228)

Checks for external IP

  • svchost.exe (PID: 2172)
  • Umbral.exe (PID: 1588)
  • Umbral.exe (PID: 2312)

Connects to unusual port

  • BaffClientLoader.exe (PID: 3860)

The executable file from the user directory is run by the CMD process

  • BaffClientLoader.exe (PID: 3860)

Starts CMD.EXE for commands execution

  • BaffClientCrack.exe (PID: 7228)

Uses TIMEOUT.EXE to delay execution

  • cmd.exe (PID: 6164)

INFO

Checks supported languages

  • identity_helper.exe (PID: 8092)

Reads the computer name

  • identity_helper.exe (PID: 8092)

Manual execution by a user

  • BaffClientCrack.exe (PID: 5160)
  • BaffClientCrack.exe (PID: 7464)

Application launched itself

  • msedge.exe (PID: 4436)

Executable content was dropped or overwritten

  • msedge.exe (PID: 7860)
  • WinRAR.exe (PID: 5736)

Reads Environment values

  • identity_helper.exe (PID: 8092)

Threats

PIDProcessClassMessage
5580msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
5580msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
5580msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
5580msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
1588Umbral.exeDevice Retrieving External IP Address DetectedPOLICY [ANY.RUN] External Hosting Lookup by ip-api
1588Umbral.exeDevice Retrieving External IP Address DetectedET POLICY External IP Lookup ip-api.com
2172svchost.exeDevice Retrieving External IP Address DetectedINFO [ANY.RUN] External IP Check (ip-api .com)
2172svchost.exeDevice Retrieving External IP Address DetectedET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2172svchost.exePotentially Bad TrafficET INFO playit .gg Tunneling Domain in DNS Lookup
2172svchost.exeMisc activityET INFO Tunneling Service in DNS Lookup (* .ply .gg)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED