File name:

5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe

Full analysis: https://app.any.run/tasks/7ad2676c-ae93-4d25-b6d8-b5e0027d313b
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 04:03:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

B2FA91466CC86844AB15094D1977EF6D

SHA1:

1B906455B8A22316777379B36BC686C3F02079CD

SHA256:

5EF95B38828C6D99C6CC41F377373C7B1C6D5B48C6F63CEEB2B103DAEC226716

SSDEEP:

1536:FjWDlwQ4Eg2yZbzvHIoWUhyOuRNd33c3bCXSZujd5Kmpx:FjWDlwQ4Eg2cHIrbHc3bCTBXx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

    • ASYNCRAT has been detected (YARA)

      • RtlUpdate.exe (PID: 4976)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

    • Starts CMD.EXE for commands execution

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

    • The executable file from the user directory is run by the CMD process

      • RtlUpdate.exe (PID: 4976)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2412)

    • Connects to unusual port

      • RtlUpdate.exe (PID: 4976)

    • Executing commands from a ".bat" file

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

  • INFO

    • Creates files or folders in the user directory

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

    • Reads the computer name

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)
      • RtlUpdate.exe (PID: 4976)

    • Checks supported languages

      • RtlUpdate.exe (PID: 4976)
      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

    • Reads the machine GUID from the registry

      • RtlUpdate.exe (PID: 4976)
      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)

    • Create files in a temporary directory

      • 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(4976) RtlUpdate.exe
C2 (4)127.0.0.1
18.119.130.176
2.tcp.ngrok.io
8.tcp.ngrok.io
Ports (6)6606
7707
8808
1337
16335
11195
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexYp91dpbmYOAB
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAK17JPAOKBRlLwlWGxvR4zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQxMTEwMTcwMzEyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMA6nuHocQbApHZ9hEcwPS0iQ8jgqSP8/zTUqxuNEp3Ao8XiNF5Ba+haEiA57eKhe0z34e7W+0QX...
Server_SignatureLeOwdVMUwPyDAWbflq1RSTfNkz9nISPI3tnslaD+0N1CVtGDay8x+nS8mbxzAmDFuKvKvL9n+OxVTI3RPqxz3wZBO7yP3NHyNxw60XaLcnUhF3BvIY7nQtnSZAHGstifPkq516TT3ASnor5ZVK0TU7w3KQKrtTmdgcFzCMxx5alIjYZgDyQebc4DRso8hi0kqqsiM9TM5TbwsR6Agpz+LkVgkM4aCxLq42Oy4wB7A4GHujyB+ELqpsMsmFvabQg3fWHW14c8pD5WXKnyukmoYNygYSWFP5tzo/zm4RhcHyPT...
Keys
AES4d919f53848dd1b9dff19ef729b45214133cf3410832aea88c4aec305e94b93d
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: -
OriginalFileName: Stub.exe
LegalTrademarks: -
LegalCopyright: -
InternalName: Stub.exe
FileVersion: 1.0.0.0
FileDescription: -
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xc7ae
UninitializedDataSize: -
InitializedDataSize: 2560
CodeSize: 43008
LinkerVersion: 8
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:10:16 21:40:53+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT rtlupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
2972"C:\Users\admin\Desktop\5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe" C:\Users\admin\Desktop\5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2412C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp7429.tmp.bat""C:\Windows\SysWOW64\cmd.exe—5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5460timeout 3 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4976"C:\Users\admin\AppData\Roaming\RtlUpdate.exe" C:\Users\admin\AppData\Roaming\RtlUpdate.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\rtlupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(4976) RtlUpdate.exe
C2 (4)127.0.0.1
18.119.130.176
2.tcp.ngrok.io
8.tcp.ngrok.io
Ports (6)6606
7707
8808
1337
16335
11195
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexYp91dpbmYOAB
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAK17JPAOKBRlLwlWGxvR4zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQxMTEwMTcwMzEyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMA6nuHocQbApHZ9hEcwPS0iQ8jgqSP8/zTUqxuNEp3Ao8XiNF5Ba+haEiA57eKhe0z34e7W+0QX...
Server_SignatureLeOwdVMUwPyDAWbflq1RSTfNkz9nISPI3tnslaD+0N1CVtGDay8x+nS8mbxzAmDFuKvKvL9n+OxVTI3RPqxz3wZBO7yP3NHyNxw60XaLcnUhF3BvIY7nQtnSZAHGstifPkq516TT3ASnor5ZVK0TU7w3KQKrtTmdgcFzCMxx5alIjYZgDyQebc4DRso8hi0kqqsiM9TM5TbwsR6Agpz+LkVgkM4aCxLq42Oy4wB7A4GHujyB+ELqpsMsmFvabQg3fWHW14c8pD5WXKnyukmoYNygYSWFP5tzo/zm4RhcHyPT...
Keys
AES4d919f53848dd1b9dff19ef729b45214133cf3410832aea88c4aec305e94b93d
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
Total events
629
Read events
628
Write events
1
Delete events
0

Modification events

(PID) Process:(2972) 5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RtlUpdate
Value:
"C:\Users\admin\AppData\Roaming\RtlUpdate.exe"
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
29725ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exeC:\Users\admin\AppData\Roaming\RtlUpdate.exeexecutable
MD5:B2FA91466CC86844AB15094D1977EF6D
SHA256:5EF95B38828C6D99C6CC41F377373C7B1C6D5B48C6F63CEEB2B103DAEC226716
29725ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exeC:\Users\admin\AppData\Local\Temp\tmp7429.tmp.battext
MD5:12C7FF199DE53BA8B029CDBA3D42BC49
SHA256:43BA4DE410390CC63524EB0250E53DADE97BC3DA8A983EB675A86107C3184250
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
25
DNS requests
9
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6068
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6068
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
6068
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6068
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6068
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.140
  • 2.23.209.130
  • 2.23.209.182
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
2.tcp.ngrok.io
  • 3.22.53.161
whitelisted
self.events.data.microsoft.com
  • 52.178.17.235
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
5ef95b38828c6d99c6cc41f377373c7b1c6d5b48c6f63ceeb2b103daec226716.exe