File name:

05bc64e823174c1bdf0b80db4ca19037.exe

Full analysis: https://app.any.run/tasks/3cad07c7-0e37-40b5-9a85-c63c97f8c50c
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 16:35:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
autoit
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

05BC64E823174C1BDF0B80DB4CA19037

SHA1:

CC4FD4CE2A491334122E00AE211F4F764CEDF20C

SHA256:

52F039142BB84B5268A2C83138818D3E89C3000F48EFD4405BFB22F1E3F9EA87

SSDEEP:

49152:ZBgzgT4XnQtJn0v2n5vU/Y4DnB2aWl+G/bsH2jyti3pUMP3zIbdV52gl:we43unpUgyB2/zssytipLzIp2gl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 05bc64e823174c1bdf0b80db4ca19037.exe (PID: 2604)
      • cmd.exe (PID: 1308)
      • Perceived.pif (PID: 1104)

    • Create files in the Startup directory

      • cmd.exe (PID: 1760)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2800)

    • ASYNCRAT has been detected (YARA)

      • RegAsm.exe (PID: 2652)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 2216)
      • cmd.exe (PID: 2796)

    • Starts CMD.EXE for commands execution

      • 05bc64e823174c1bdf0b80db4ca19037.exe (PID: 2604)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 2216)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2796)

    • Drops the AutoIt3 executable file

      • cmd.exe (PID: 1308)
      • Perceived.pif (PID: 1104)

    • Get information on the list of running processes

      • cmd.exe (PID: 2796)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2796)

    • The process creates files with name similar to system file names

      • Perceived.pif (PID: 1104)

    • Process drops legitimate windows executable

      • Perceived.pif (PID: 1104)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2796)

    • Connects to unusual port

      • RegAsm.exe (PID: 2652)

  • INFO

    • Checks supported languages

      • 05bc64e823174c1bdf0b80db4ca19037.exe (PID: 2604)
      • Perceived.pif (PID: 1104)
      • RegAsm.exe (PID: 2652)

    • Create files in a temporary directory

      • 05bc64e823174c1bdf0b80db4ca19037.exe (PID: 2604)
      • Perceived.pif (PID: 1104)

    • The executable file from the user directory is run by the CMD process

      • Perceived.pif (PID: 1104)

    • Manual execution by a user

      • cmd.exe (PID: 2800)
      • RegAsm.exe (PID: 2652)
      • cmd.exe (PID: 1760)

    • Reads the computer name

      • Perceived.pif (PID: 1104)
      • RegAsm.exe (PID: 2652)

    • Reads mouse settings

      • Perceived.pif (PID: 1104)

    • Creates files or folders in the user directory

      • Perceived.pif (PID: 1104)
      • RegAsm.exe (PID: 2652)

    • Reads Environment values

      • RegAsm.exe (PID: 2652)

    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 2652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(2652) RegAsm.exe
C2 (1)185.196.8.10
Ports (1)4449
BotnetAsguard-Protector
VersionBlackMAMBA
Options
AutoRunfalse
Mutexsogbvjdjlqcviydtz
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICPzCCAaigAwIBAgIVAKWGRBApNXBWvuhH6s5twg/lB3gVMA0GCSqGSIb3DQEBDQUAMG4xGjAYBgNVBAMMEUJsYWNrTUFNQkEgU2VydmVyMRMwEQYDVQQLDApxd3FkYW5jaHVuMSEwHwYDVQQKDBhCbGFja01BTUJBIEJ5IHF3cWRhbmNodW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yMzAxMDYxNDQyNTRaFw0zMzEwMTUxNDQyNTRaMBUxEzARBgNVBAMMCkJsYWNrTUFNQkEwgZ8wDQYJ...
Server_SignaturecEWggU7zPvgj267X3909i9blrcVw1j2pppLcv2HscrzjWygUxZ6EizlyO+nlo/cBEkYHqEsycu7beDX3JTE1SHWDJGDIWgd8Q/Aw/ckn9mVAD9xUsV4cCLCSu4R6FMfY+ip+YSnWsnGVfQZ4LK7vOSbE/HZKPXGOqAE8rFy8BS4=
Keys
AES7dffcab2e160da7f4f62ad76fc30b4bd49cb4f7ac6683a2d7d8c7be51d6c3fa3
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:02:18 17:19:50+01:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 437248
InitializedDataSize: 893952
UninitializedDataSize: -
EntryPoint: 0x6c788
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 9.326.9.24565
ProductVersionNumber: 9.326.9.24565
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Управление ментальным здоровьем и психологической силой
CompanyName: MindWave
FileDescription: Управление ментальным здоровьем и психологической силой
FileVersion: 9.326.9.90101
InternalName: MindWave
LegalCopyright: Copyright © MindWave Wellness 2008
ProductName: MindWave
ProductVersion: 9.326.9.90101
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
16
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 05bc64e823174c1bdf0b80db4ca19037.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs perceived.pif no specs ping.exe no specs cmd.exe cmd.exe no specs schtasks.exe no specs #ASYNCRAT regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
776ping -n 5 localhostC:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
110427485\Perceived.pif 27485\q C:\Users\admin\AppData\Local\Temp\13401\27485\Perceived.pif—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 4
Modules
Images
c:\users\admin\appdata\local\temp\13401\27485\perceived.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1308cmd /c copy /b Infected + Tin + Excited + Condo 27485\Perceived.pifC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1408cmd /c mkdir 27485C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1760cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindWave.url" & echo URL="C:\Users\admin\AppData\Local\MindWave Wellness\MindWave.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindWave.url" & exitC:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2092schtasks.exe /create /tn "Liquid" /tr "wscript 'C:\Users\admin\AppData\Local\MindWave Wellness\MindWave.js'" /sc minute /mo 3 /FC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2216cmd /k cmd < Enjoyed & exitC:\Windows\SysWOW64\cmd.exe—05bc64e823174c1bdf0b80db4ca19037.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2300findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2316cmd /c copy /b Orders + Cylinder 27485\q C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2604"C:\Users\admin\AppData\Local\Temp\05bc64e823174c1bdf0b80db4ca19037.exe" C:\Users\admin\AppData\Local\Temp\05bc64e823174c1bdf0b80db4ca19037.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\05bc64e823174c1bdf0b80db4ca19037.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
865
Read events
851
Write events
14
Delete events
0

Modification events

(PID) Process:(2652) RegAsm.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
4
Suspicious files
3
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
260405bc64e823174c1bdf0b80db4ca19037.exeC:\Users\admin\AppData\Local\Temp\13401\Excitedbinary
MD5:00B06C10CB0E907952EABC40D1066AF7
SHA256:FFD97D25C9D8E9A8B73C520745362828516689EA21489A60A891330030CF7675
260405bc64e823174c1bdf0b80db4ca19037.exeC:\Users\admin\AppData\Local\Temp\13401\Infectedexecutable
MD5:610A3DAD1E9C4E1E7FA902D90A27A626
SHA256:BAC0673233D6DAF1969CA8E084720B278F2E31F62C0DE1928B82885B8C893C7D
1308cmd.exeC:\Users\admin\AppData\Local\Temp\13401\27485\Perceived.pifexecutable
MD5:BFA84DBDE0DF8F1CAD3E179BD46A6E34
SHA256:6DE412B8674FFBA5D78FF9D36ABFFBE2CF86FD08B2231592FCA2FCF41F1F2314
260405bc64e823174c1bdf0b80db4ca19037.exeC:\Users\admin\AppData\Local\Temp\13401\Cylindertext
MD5:28E2CBC2124D320395A949737C933C46
SHA256:35FD665E063AECCE54E6448C08B36D2C45749BBB7FE52C796E56E68E8F88558A
1104Perceived.pifC:\Users\admin\AppData\Local\MindWave Wellness\vtext
MD5:2AEB25B87C0CB6A8F360F66CA69EDD70
SHA256:614DEC82F15CD338C88A43542B5BAB568A4A0C74FB52C0D8362A7D43E75CF8AF
1104Perceived.pifC:\Users\admin\AppData\Local\MindWave Wellness\MindWave.pifexecutable
MD5:BFA84DBDE0DF8F1CAD3E179BD46A6E34
SHA256:6DE412B8674FFBA5D78FF9D36ABFFBE2CF86FD08B2231592FCA2FCF41F1F2314
1760cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindWave.urltext
MD5:353795816AE5B37D44A9024159D27EA8
SHA256:C0FC703B325B80CD526B0CF1AAA1A1BFEBBBFCB68A00B2493F690B950722E242
2316cmd.exeC:\Users\admin\AppData\Local\Temp\13401\27485\qtext
MD5:2AEB25B87C0CB6A8F360F66CA69EDD70
SHA256:614DEC82F15CD338C88A43542B5BAB568A4A0C74FB52C0D8362A7D43E75CF8AF
1104Perceived.pifC:\Users\admin\AppData\Local\Temp\13401\27485\RegAsm.exeexecutable
MD5:B19FD9298FF205E8718CDEF5C19DF6FE
SHA256:1E9516DA2DED24D635F5FAB0347D34CEB76E50B2A015EBB1EE3B8EE69DE5FAAE
1104Perceived.pifC:\Users\admin\AppData\Local\MindWave Wellness\MindWave.jstext
MD5:75EC55C2A09B385C689AC5D02EB765DB
SHA256:BD45C660A53B61FB7B941509462A8031A2172F3E37F5D910DB3A164AD5BB2342
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2652
RegAsm.exe
185.196.8.10:4449
—
—
US
unknown

DNS requests

Domain
IP
Reputation
JiOWngCJdXjgubID.JiOWngCJdXjgubID
  • —
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
05bc64e823174c1bdf0b80db4ca19037.exe