| File name: | cotest.txt |
| Full analysis: | https://app.any.run/tasks/dec8f112-2f1f-4744-b09a-b723c4565b92 |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | February 18, 2025, 16:11:47 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (61792), with CRLF line terminators |
| MD5: | C76961ED1C21B3A27A83C41F0C77D01A |
| SHA1: | 8FD70155514B1405D5176AF2FB69EF7A5715DA9D |
| SHA256: | 46BC5AB1B803F4E09F5950F6D70C6E5C5B63DB83176ADC19A1CFDF4104E16E6A |
| SSDEEP: | 3072:qeptNzymqhalOfWnYKAeD4AE7jN1pl+fr6+6Vvy:DFwvy |
MALICIOUS
Bypass execution policy to execute commands
- powershell.exe (PID: 6448)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 6448)
ASYNCRAT has been detected (YARA)
- aspnet_regbrowsers.exe (PID: 6928)
ASYNCRAT has been detected (MUTEX)
- aspnet_regbrowsers.exe (PID: 6928)
SUSPICIOUS
Connects to unusual port
- aspnet_regbrowsers.exe (PID: 6928)
Converts a specified value to a byte (POWERSHELL)
- powershell.exe (PID: 6448)
INFO
Gets data length (POWERSHELL)
- powershell.exe (PID: 6448)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 6448)
Reads the machine GUID from the registry
- aspnet_regbrowsers.exe (PID: 6928)
Checks supported languages
- aspnet_regbrowsers.exe (PID: 6928)
Reads the computer name
- aspnet_regbrowsers.exe (PID: 6928)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 6448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
AsyncRat
(PID) Process(6928) aspnet_regbrowsers.exe
C2 (6)chromedata.accesscam.org
chromedata.webredirect.org
cepas2023.duckdns.org
127.0.0.1
cdt2024.ddns.net
all.ddnskey.com
Ports (17)6606
7707
8808
3313
3314
9441
9442
9443
2900
1018
2019
2020
2021
5155
6666
9999
5505
VersionAWS | 3Losh
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva...
Server_SignatureC9CdsjbuVc3W38+HczbNZf97A8Ugf6WiVrRVMERohgPP25Fz2dVksOUV5X1Otda/9pge9ESNx0TMaFQkJd0W1MDRmKsC541AI7n3jJNPvijyjIXAU6xE7XwEliislHwe1so0Yzg2Ymvd4mn9HsRxM9Hvk6XzBTGKY65JZEY89SuCmhwxWUc27Po0QFj+G1hbTdpBos+O7IG9v1Ka7n1q8EVuV0e/DAaWnTL86ubdhv2JFkvHCEj/zB2KzR3dwRrapF2FPBwlUpZsGPy7f77vPmvnpmezXAUv+npnLFkeO24a...
Keys
AES7fb2b87b669c986493c73ce0fb901d5af41beb3920b54ed1bf3ca6284e262a6b
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
Total processes
121
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6448 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Downloads\cotest.txt.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6456 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 4294967295 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6928 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_regbrowsers.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
AsyncRat(PID) Process(6928) aspnet_regbrowsers.exe C2 (6)chromedata.accesscam.org chromedata.webredirect.org cepas2023.duckdns.org 127.0.0.1 cdt2024.ddns.net all.ddnskey.com Ports (17)6606 7707 8808 3313 3314 9441 9442 9443 2900 1018 2019 2020 2021 5155 6666 9999 5505 VersionAWS | 3Losh Options AutoRunfalse MutexAsyncMutex_6SI8OkPnk InstallFolder%AppData% Certificates Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva... Server_SignatureC9CdsjbuVc3W38+HczbNZf97A8Ugf6WiVrRVMERohgPP25Fz2dVksOUV5X1Otda/9pge9ESNx0TMaFQkJd0W1MDRmKsC541AI7n3jJNPvijyjIXAU6xE7XwEliislHwe1so0Yzg2Ymvd4mn9HsRxM9Hvk6XzBTGKY65JZEY89SuCmhwxWUc27Po0QFj+G1hbTdpBos+O7IG9v1Ka7n1q8EVuV0e/DAaWnTL86ubdhv2JFkvHCEj/zB2KzR3dwRrapF2FPBwlUpZsGPy7f77vPmvnpmezXAUv+npnLFkeO24a... Keys AES7fb2b87b669c986493c73ce0fb901d5af41beb3920b54ed1bf3ca6284e262a6b Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941 | |||||||||||||||
Total events
4 859
Read events
4 859
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6448 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gygb4dt1.bqc.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6448 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZXE9ER3HATQXUTLHDG84.temp | binary | |
MD5:68981121E5B9FF358C011B8FC40797E3 | SHA256:096302B18D777AC6C8D02F06AD65AC2F369095CEF02D2F7B0EE0DF164D12755C | |||
| 6448 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:42BE705CDBA5E43D1634890FA85056B7 | SHA256:87A60A633E90DDFAF25471CEFCD167B65692C19DD74602A728B1F04A52C02C3A | |||
| 6448 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1356be.TMP | binary | |
MD5:D040F64E9E7A2BB91ABCA5613424598E | SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670 | |||
| 6448 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:68981121E5B9FF358C011B8FC40797E3 | SHA256:096302B18D777AC6C8D02F06AD65AC2F369095CEF02D2F7B0EE0DF164D12755C | |||
| 6448 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sttvg2tu.csg.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
28
DNS requests
16
Threats
8
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3976 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4024 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6928 | aspnet_regbrowsers.exe | 128.90.103.206:3314 | chromedata.webredirect.org | PHMGMT-AS1 | BR | malicious |
6928 | aspnet_regbrowsers.exe | 192.169.69.26:9441 | cepas2023.duckdns.org | SERVERSTADIUM | US | malicious |
6928 | aspnet_regbrowsers.exe | 128.90.103.206:6606 | chromedata.webredirect.org | PHMGMT-AS1 | BR | malicious |
6928 | aspnet_regbrowsers.exe | 192.169.69.26:9443 | cepas2023.duckdns.org | SERVERSTADIUM | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
chromedata.webredirect.org |
| malicious |
cepas2023.duckdns.org |
| malicious |
cdt2024.ddns.net |
| malicious |
chromedata.accesscam.org |
| malicious |
self.events.data.microsoft.com |
| whitelisted |
all.ddnskey.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.webredirect .org Domain |
2192 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
2192 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
2192 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
2192 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
2192 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net |
2192 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.accesscam .org Domain |
2192 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.webredirect .org Domain |