File name:

22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9

Full analysis: https://app.any.run/tasks/40261a68-4abd-45ea-bb77-398b34d3a03f
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 19:08:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

92B64C4122012BAE1687C15A9470CB19

SHA1:

779191F09A989D8DCC08717ECA4CA155E1FE25A7

SHA256:

22A92A0A90C35740EE54D53C110119E055372B620FFB903CEFCD37AE686069C9

SSDEEP:

3072:RVlReD33GfP2PPDpp6XzNUhSwFV1pWGlKRA/b9Hr73PgPFZGHE80X9GxxpjThW9Y:xNdwFVzzVlObS/m4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • ASYNCRAT has been detected (YARA)

      • Runtime Broker.exe (PID: 4084)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Process drops legitimate windows executable

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Executing commands from a ".bat" file

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Starts CMD.EXE for commands execution

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Executable content was dropped or overwritten

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2520)

    • The executable file from the user directory is run by the CMD process

      • Runtime Broker.exe (PID: 7108)

  • INFO

    • Reads the computer name

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)
      • Runtime Broker.exe (PID: 4084)
      • Runtime Broker.exe (PID: 7108)

    • Reads the machine GUID from the registry

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)
      • Runtime Broker.exe (PID: 7108)
      • Runtime Broker.exe (PID: 4084)

    • Checks supported languages

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)
      • Runtime Broker.exe (PID: 4084)
      • Runtime Broker.exe (PID: 7108)

    • Creates files or folders in the user directory

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Launching a file from a Registry key

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Create files in a temporary directory

      • 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe (PID: 4412)

    • Manual execution by a user

      • Runtime Broker.exe (PID: 4084)

    • Checks proxy server information

      • slui.exe (PID: 2696)

    • Reads the software policy settings

      • slui.exe (PID: 2696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(4084) Runtime Broker.exe
C2 (1)127.0.0.1
Ports (1)27193
Version1.0.7
Options
AutoRuntrue
MutexbBF4YU7NNJKKNFEWuhfgriuhe432qw
InstallFolder%AppData%
Certificates
Cert1MIICMzCCAZygAwIBAgIVAOJsIj2vCBmOiFB4et+zk1k9Y7sJMA0GCSqGSIb3DQEBDQUAMGcxGDAWBgNVBAMMD29rZW9rZW9rZW9rZW9rZTETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDkwOTEzNTkxMFoXDTM1MDYxOTEzNTkxMFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQAD...
Server_SignatureCO1txU5FeteWSJ/uTnJlgV3YgXndpVOfTFnJEuD5+pbbp3vl1z8biO6LRIdLezuszh1xpfyjvrEMHukUD86FDfcyD37fu9XA/WxRaZ9hoCYNKi6j+8Z42m/aBkTYqXHC6rJhN3PXFjPzRO5zNWCIL9ROJkoplS3XBTIElZflP9s=
Keys
AESc42abd6bbf3e2312fc44406f6e27c2526fdbe3594e165ebac8935ab2d2226346
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:05:05 21:11:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 316928
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x4f46e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.5794
ProductVersionNumber: 10.0.19041.5794
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Application
FileVersion: 10.0.19041.5794
InternalName: Runtime Broker.exe
LegalCopyright: ©Microsoft Corporation. All rights reserved.
LegalTrademarks: ©Microsoft Corporation. All rights reserved.
OriginalFileName: Runtime Broker.exe
ProductName: Runtime Broker
ProductVersion: 10.0.19041.5794
AssemblyVersion: 10.0.19041.5794
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT runtime broker.exe no specs runtime broker.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2520C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp81C2.tmp.bat""C:\Windows\System32\cmd.exe—22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
2696C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4084"C:\Users\admin\AppData\Roaming\Runtime Broker.exe"C:\Users\admin\AppData\Roaming\Runtime Broker.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application
Version:
10.0.19041.5794
Modules
Images
c:\users\admin\appdata\roaming\runtime broker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(4084) Runtime Broker.exe
C2 (1)127.0.0.1
Ports (1)27193
Version1.0.7
Options
AutoRuntrue
MutexbBF4YU7NNJKKNFEWuhfgriuhe432qw
InstallFolder%AppData%
Certificates
Cert1MIICMzCCAZygAwIBAgIVAOJsIj2vCBmOiFB4et+zk1k9Y7sJMA0GCSqGSIb3DQEBDQUAMGcxGDAWBgNVBAMMD29rZW9rZW9rZW9rZW9rZTETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDkwOTEzNTkxMFoXDTM1MDYxOTEzNTkxMFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQAD...
Server_SignatureCO1txU5FeteWSJ/uTnJlgV3YgXndpVOfTFnJEuD5+pbbp3vl1z8biO6LRIdLezuszh1xpfyjvrEMHukUD86FDfcyD37fu9XA/WxRaZ9hoCYNKi6j+8Z42m/aBkTYqXHC6rJhN3PXFjPzRO5zNWCIL9ROJkoplS3XBTIElZflP9s=
Keys
AESc42abd6bbf3e2312fc44406f6e27c2526fdbe3594e165ebac8935ab2d2226346
SaltDcRatByqwqdanchun
4320timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4412"C:\Users\admin\Desktop\22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe" C:\Users\admin\Desktop\22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application
Exit code:
0
Version:
10.0.19041.5794
Modules
Images
c:\users\admin\desktop\22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7108"C:\Users\admin\AppData\Roaming\Runtime Broker.exe" C:\Users\admin\AppData\Roaming\Runtime Broker.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application
Exit code:
0
Version:
10.0.19041.5794
Modules
Images
c:\users\admin\appdata\roaming\runtime broker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 376
Read events
4 375
Write events
1
Delete events
0

Modification events

(PID) Process:(4412) 22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Runtime Broker
Value:
"C:\Users\admin\AppData\Roaming\Runtime Broker.exe"
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
441222a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exeC:\Users\admin\AppData\Local\Temp\tmp81C2.tmp.battext
MD5:5872DCB8D32A56F29E71ED30094E1327
SHA256:DA144BF4A78592E92D5AB4946B20F529981F9E1D73068208AFA55EA4DB67372E
441222a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9.exeC:\Users\admin\AppData\Roaming\Runtime Broker.exeexecutable
MD5:92B64C4122012BAE1687C15A9470CB19
SHA256:22A92A0A90C35740EE54D53C110119E055372B620FFB903CEFCD37AE686069C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
40
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.3:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
20.190.160.65:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
20.190.160.64:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
GET
200
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
compressed
23.9 Kb
whitelisted
—
—
POST
200
20.190.160.22:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
POST
200
20.190.160.4:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
6172
RUXIMICS.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.17:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6172
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6172
RUXIMICS.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6172
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.4
  • 20.190.160.64
  • 20.190.160.17
  • 20.190.160.65
  • 20.190.160.22
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
22a92a0a90c35740ee54d53c110119e055372b620ffb903cefcd37ae686069c9