File name:

gt.exe

Full analysis: https://app.any.run/tasks/80421b13-58bd-4b8e-a838-1b199fd18cff
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 22:36:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
rat
asyncrat
remote
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

EF6C90B300BCFDBB1DDB1645A7702E39

SHA1:

65D7C9EE584C1B8AE48E814C1FA018F9B969C72A

SHA256:

47DF6745DADAC5D8ECB9C264FC93304916EA5F3BE98D6FAC73E24C1149CB49A8

SSDEEP:

3072:ov72uWLZBDOYHh1G4xMHW6gaep1TwO53ejOmZx0G:ov72uWLZ1PGfxgae3cO53k0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • gt.exe (PID: 7000)

    • Changes Windows Defender settings

      • gt.exe (PID: 7000)

    • Executing a file with an untrusted certificate

      • kb0.exe (PID: 8056)
      • exp.exe (PID: 7328)

    • ASYNCRAT has been detected (SURICATA)

      • MSBuild.exe (PID: 5544)

    • Changes the autorun value in the registry

      • kb0.exe (PID: 8056)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • gt.exe (PID: 7000)

    • Starts POWERSHELL.EXE for commands execution

      • gt.exe (PID: 7000)

    • Reads security settings of Internet Explorer

      • gt.exe (PID: 7000)

    • Script adds exclusion path to Windows Defender

      • gt.exe (PID: 7000)

    • Found IP address in command line

      • powershell.exe (PID: 7244)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 7244)

    • Starts process via Powershell

      • powershell.exe (PID: 7244)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7244)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7244)
      • csc.exe (PID: 6640)
      • kb0.exe (PID: 8056)
      • csc.exe (PID: 7872)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7244)

    • Connects to the server without a host name

      • powershell.exe (PID: 7244)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 5544)

    • Uses WMIC.EXE to obtain computer system information

      • MSBuild.exe (PID: 5544)

    • Accesses domain name via WMI (SCRIPT)

      • WMIC.exe (PID: 680)

    • Connects to unusual port

      • MSBuild.exe (PID: 5544)

  • INFO

    • Reads the computer name

      • gt.exe (PID: 7000)
      • kb0.exe (PID: 8056)
      • MSBuild.exe (PID: 5544)
      • exp.exe (PID: 7328)
      • MSBuild.exe (PID: 7756)

    • Checks supported languages

      • gt.exe (PID: 7000)
      • kb0.exe (PID: 8056)
      • cvtres.exe (PID: 3096)
      • csc.exe (PID: 6640)
      • MSBuild.exe (PID: 5544)
      • csc.exe (PID: 7872)
      • cvtres.exe (PID: 7632)
      • exp.exe (PID: 7328)
      • MSBuild.exe (PID: 7756)

    • Process checks computer location settings

      • gt.exe (PID: 7000)

    • Disables trace logs

      • powershell.exe (PID: 7244)

    • Checks proxy server information

      • powershell.exe (PID: 7244)

    • Create files in a temporary directory

      • csc.exe (PID: 6640)
      • cvtres.exe (PID: 3096)
      • kb0.exe (PID: 8056)
      • exp.exe (PID: 7328)
      • cvtres.exe (PID: 7632)
      • csc.exe (PID: 7872)

    • Reads the machine GUID from the registry

      • kb0.exe (PID: 8056)
      • csc.exe (PID: 6640)
      • MSBuild.exe (PID: 5544)
      • csc.exe (PID: 7872)
      • exp.exe (PID: 7328)
      • MSBuild.exe (PID: 7756)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7204)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7204)

    • Reads the software policy settings

      • MSBuild.exe (PID: 5544)
      • slui.exe (PID: 7528)

    • Manual execution by a user

      • explorer.exe (PID: 7616)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 680)
      • explorer.exe (PID: 5548)

    • Auto-launch of the file from Registry key

      • kb0.exe (PID: 8056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:25 12:39:59+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 75264
InitializedDataSize: 57856
UninitializedDataSize: -
EntryPoint: 0x2768
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
22
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start gt.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe kb0.exe csc.exe conhost.exe no specs cvtres.exe no specs #ASYNCRAT msbuild.exe wmic.exe no specs conhost.exe no specs explorer.exe no specs explorer.exe no specs exp.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs msbuild.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680"wmic" computersystem get domainC:\Windows\SysWOW64\wbem\WMIC.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
1628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3096C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1C9D.tmp" "c:\Users\admin\AppData\Local\Temp\CSC45C4789C0B74D30B9607B5D139AFDC0.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
5544"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
kb0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5548C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
6640"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\top054em.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
kb0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
7000"C:\Users\admin\AppData\Local\Temp\gt.exe" C:\Users\admin\AppData\Local\Temp\gt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\gt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
7204"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
gt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7212\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 769
Read events
16 767
Write events
2
Delete events
0

Modification events

(PID) Process:(8056) kb0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Shell
Value:
explorer.exe C:\Windows\Temp\xPiglS2\exp.exe
(PID) Process:(5548) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
4
Suspicious files
5
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
8056kb0.exeC:\Users\admin\AppData\Local\Temp\top054em.cmdlinetext
MD5:29F322A3A165A13016D1A944F3BAC711
SHA256:0FA64BA53BDCF193B9340EF84FDE19313590FED0619E4442CF084246E11D0E47
7204powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l2jujcop.j2c.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7204powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4n35us55.3h4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7244powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oafpfrct.tfv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7244powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3oqonbbh.3fj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8056kb0.exeC:\Windows\Temp\xPiglS2\exp.exeexecutable
MD5:DB25FD7F325F5EA6CD5C0EE5F8AF8D22
SHA256:59D5DF6B32EE3F1A30281FCA62BC6FD7CECA2F561442495BA4A03A7CBEB227CD
7328exp.exeC:\Users\admin\AppData\Local\Temp\vhqvhnnc.0.cstext
MD5:58B10EF6BA0DA88788F1AAC56CE7E2DB
SHA256:AE11144F426028E50E77D64A66AEB954E169F627F8ABFE403791032594834520
8056kb0.exeC:\Users\admin\AppData\Local\Temp\top054em.0.cstext
MD5:58B10EF6BA0DA88788F1AAC56CE7E2DB
SHA256:AE11144F426028E50E77D64A66AEB954E169F627F8ABFE403791032594834520
6640csc.exeC:\Users\admin\AppData\Local\Temp\top054em.dllexecutable
MD5:B0BD063E2F9757A0682CBC04EF72A4C9
SHA256:9FC84B71FCB199A994FEEA7A81C1779ED0D1A581203EE6A5CDFB316F532B7034
7204powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:0C6E49A46FAFCB69A1437AFA54D77976
SHA256:F44A14DE50A5D88863948EBC842F8AD3FB2BD13C97AFDA65C5D84ABEFB165DC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
15
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7244
powershell.exe
GET
200
185.39.17.70:80
http://185.39.17.70/zgrnf/upx.exe
unknown
—
—
malicious
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5332
SIHClient.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5332
SIHClient.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7244
powershell.exe
185.39.17.70:80
—
Joint Stock Company Tagnet
RU
malicious
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5332
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.180
  • 23.48.23.178
  • 23.48.23.181
  • 23.48.23.177
  • 23.48.23.175
  • 23.48.23.183
  • 23.48.23.185
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 92.123.22.101
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.130
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

PID
Process
Class
Message
7244
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
7244
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7244
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
7244
powershell.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
7244
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7244
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
7244
powershell.exe
Misc activity
ET INFO Packed Executable Download
7244
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5544
MSBuild.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
5544
MSBuild.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gt.exe