| File name: | 4363463463464363463463463.exe |
| Full analysis: | https://app.any.run/tasks/d4c43a95-2eeb-4707-9ce6-b130f5c77f1f |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | December 29, 2024, 00:05:46 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 2A94F3960C58C6E70826495F76D00B85 |
| SHA1: | E2A1A5641295F5EBF01A37AC1C170AC0814BB71A |
| SHA256: | 2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE |
| SSDEEP: | 192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:12:22 08:29:10+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 80 |
| CodeSize: | 5632 |
| InitializedDataSize: | 4608 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x3552 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 0.0.0.0 |
| InternalName: | 4363463463464363463463463.exe |
| LegalCopyright: | |
| OriginalFileName: | 4363463463464363463463463.exe |
| ProductVersion: | 0.0.0.0 |
| AssemblyVersion: | 0.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 236 | "C:\Users\admin\Desktop\Files\zxcv.exe" | C:\Users\admin\Desktop\Files\zxcv.exe | — | zxcv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Print Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 520 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 3221226540 Version: 0.0.0.0 Modules
| |||||||||||||||
| 624 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 3221226540 Version: 0.0.0.0 Modules
| |||||||||||||||
| 624 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 640 | "C:\Users\admin\Desktop\Files\build6_unencrypted.exe" | C:\Users\admin\Desktop\Files\build6_unencrypted.exe | 4363463463464363463463463.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 836 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 4363463463464363463463463.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 848 | "C:\Users\admin\Desktop\Files\zxcv.exe" | C:\Users\admin\Desktop\Files\zxcv.exe | — | zxcv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Print Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1140 | "C:\Users\admin\Desktop\Files\zxcv.exe" | C:\Users\admin\Desktop\Files\zxcv.exe | — | zxcv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Print Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1200 | "C:\Users\admin\Desktop\Files\zxcv.exe" | C:\Users\admin\Desktop\Files\zxcv.exe | — | zxcv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Print Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1228 | "C:\Users\admin\Desktop\Files\zxcv.exe" | C:\Users\admin\Desktop\Files\zxcv.exe | — | zxcv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Print Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (6888) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7020) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7020) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7020) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6820 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\svchost.exe | executable | |
MD5:E281C07B2469B7943ABD04F9C39D2D81 | SHA256:0DE3CC456FD163B597841CF6932B879D87FE0FFDBACBF52336C6CBFBB943BBAD | |||
| 6888 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\vncgroups.exe | executable | |
MD5:532ABCCDFE34F585BE8EEC40BDC7972D | SHA256:0BE4487462EDE94362A2CE208E7C256E1C2D6ACF361B6CDA72FBAA2A3A66E6B8 | |||
| 6572 | vncgroups.exe | C:\ProgramData\idmans\idmans.exe | executable | |
MD5:532ABCCDFE34F585BE8EEC40BDC7972D | SHA256:0BE4487462EDE94362A2CE208E7C256E1C2D6ACF361B6CDA72FBAA2A3A66E6B8 | |||
| 6200 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\onlysteal.exe | executable | |
MD5:8F81AC89B9F6DBCCF07A86AF59FAA6BA | SHA256:766B497466955F86E0D049C25AA6F99880D230ACBB8D1141408FE0E8169FB46A | |||
| 2008 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\22.exe | executable | |
MD5:301DAF49CF3821D82A515D447326026A | SHA256:7197DC2E6243B3AA6BA71825C04B381A98922982DE4232BB27474EB69BA43A28 | |||
| 6820 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\XClient.exe | executable | |
MD5:CF14FAC9FA45E4989AD1DB2910ED98FD | SHA256:3DF057F43A8C20C88FE2A2266AC09414FCF9DAC4037E9A4F6E95AB66E6409636 | |||
| 6636 | 22.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\1[1].bin | binary | |
MD5:8DB5BA6BB040A5EC4ABF85B25FEF7291 | SHA256:FA2B12EA83C959801A319B92E73409B1912A080D464E5AFD612DA02C3D38AC6D | |||
| 6576 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\agent.exe | executable | |
MD5:AFF07019035BBFE5BAC96D943FADB530 | SHA256:C2E367C6F38B6276680526550403573A74E4DB2F2469C7936AFC2B935781FEB6 | |||
| 6888 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\ew.exe | executable | |
MD5:D76E1525C8998795867A17ED33573552 | SHA256:F4DD44BC19C19056794D29151A5B1BB76AFD502388622E24C863A8494AF147DD | |||
| 7504 | contorax.exe | C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe | executable | |
MD5:771B8E84BA4F0215298D9DADFE5A10BF | SHA256:3F074FB6A883663F2937FD9435FC90F8D31CEABE496627D40B3813DBCC472ED0 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 92.123.37.9:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5776 | svchost.exe | GET | 200 | 2.18.79.138:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5320 | 4363463463464363463463463.exe | GET | 200 | 185.215.113.209:80 | http://185.215.113.209/inc/kp8dnpa9.exe | unknown | — | — | malicious |
6200 | 4363463463464363463463463.exe | GET | 200 | 185.215.113.16:80 | http://185.215.113.16/inc/onlysteal.exe | unknown | — | — | malicious |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5776 | svchost.exe | GET | 200 | 92.123.37.9:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 92.123.37.9:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6016 | 4363463463464363463463463.exe | GET | — | 183.57.21.131:8095 | http://183.57.21.131:8095/TMS_C028.exe | unknown | — | — | unknown |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.18.79.138:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.18.79.138:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5064 | SearchApp.exe | 95.101.23.43:443 | www.bing.com | Akamai International B.V. | AT | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5776 | svchost.exe | 2.18.79.138:80 | crl.microsoft.com | Akamai International B.V. | AT | whitelisted |
— | — | 2.18.79.138:80 | crl.microsoft.com | Akamai International B.V. | AT | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.18.79.138:80 | crl.microsoft.com | Akamai International B.V. | AT | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4712 | MoUsoCoreWorker.exe | 92.123.37.9:80 | www.microsoft.com | AKAMAI-AS | AT | whitelisted |
— | — | 92.123.37.9:80 | www.microsoft.com | AKAMAI-AS | AT | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
urlhaus.abuse.ch |
| whitelisted |
raw.githubusercontent.com |
| shared |
github.com |
| shared |
twizthash.net |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
5320 | 4363463463464363463463463.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 |
5320 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
6200 | 4363463463464363463463463.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 |
5320 | 4363463463464363463463463.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6200 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
5320 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
5320 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
6200 | 4363463463464363463463463.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6200 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
6200 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
Process | Message |
|---|---|
4363463463464363463463463.exe | The remote server returned an error: (403) Forbidden.
|
4363463463464363463463463.exe | The remote server returned an error: (403) Forbidden.
|
4363463463464363463463463.exe | The remote server returned an error: (403) Forbidden.
|
random.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
popapoers.exe | This assembly was protected by demo version of ArmDot more than 7 days ago
Buy full version at https://www.armdot.com/order.html |
popapoers.exe | "
|
popapoers.exe | CLR: Managed code called FailFast, saying " |
4363463463464363463463463.exe | The remote server returned an error: (403) Forbidden.
|
4363463463464363463463463.exe | The remote server returned an error: (403) Forbidden.
|
4363463463464363463463463.exe | The remote server returned an error: (403) Forbidden.
|