| File name: | 9eeb1ff9590f0d56965dd0c3be237be5.exe |
| Full analysis: | https://app.any.run/tasks/7ee4596a-6d93-4564-ba03-cb3567f873f4 |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | February 01, 2025, 07:56:46 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 9EEB1FF9590F0D56965DD0C3BE237BE5 |
| SHA1: | 64155D81FE03AF2725DCA920E7AAC156B6FA12E6 |
| SHA256: | 5F9656C4D140F6EE84DA24A9241E4C7E8DB9B98AB32E9D860731DFBAB2CF7477 |
| SSDEEP: | 98304:+7kJIvMKykU6rbb1wWnFTKyD1FfX9EaoZ/KyssleX98CLYvBByJ+H+pDSeSFu3yI:VvMOmXZ |
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2011:09:26 13:21:28+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 28160 |
| InitializedDataSize: | 445952 |
| UninitializedDataSize: | 16896 |
| EntryPoint: | 0x3883 |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.575.4.55894 |
| ProductVersionNumber: | 1.575.4.55894 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| ProductName: | Guardian360X |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4384 | C:\Users\admin\AppData\Local\Temp\279619\RegAsm.exe | C:\Users\admin\AppData\Local\Temp\279619\RegAsm.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 4.8.9037.0 built by: NET481REL1 Modules
ims-api(PID) Process(4384) RegAsm.exe Discord-Webhook-Tokens (1)1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM Discord-Info-Links 1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM Get Webhook Infohttps://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM StormKitty(PID) Process(4384) RegAsm.exe C2 (1)199.247.17.239 Ports (2)4449 7000 VersionRAT + hVNC 6.0.6 Options AutoRunfalse Mutexhujgycdymekpvnldx InstallFolder%PreLoadSQLite_TargetFramework% Certificates Cert1MIICLjCCAZegAwIBAgIVALUOFWk8z6RV3/uzZ3kIYN62YODHMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDA0MjExOTM2MTBaFw0zNTAxMjkxOTM2MTBaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB... Server_SignatureJKs1n2pmINUnJBiEjCCF6dzHvOg6omq240M5kW9KJ9tXLm0WAxBwAM8rOIRwSsMXEdiIH9zARiKipi+SfS5gLXMCfLX4iri2GZA0eWVKVJ71GJylolpvYFKALnDRIkjMJa5oqfw7juLZs+YCcHHG5To4YvE/aLmaZu8LBlENflY= Keys AES36f5abb73fb838ac278f4e17115752c858ddf49bc8b924683a8889cf2b01dfd6 SaltVenomRATByVenom | |||||||||||||||
| 6380 | "C:\Users\admin\AppData\Local\Temp\9eeb1ff9590f0d56965dd0c3be237be5.exe" | C:\Users\admin\AppData\Local\Temp\9eeb1ff9590f0d56965dd0c3be237be5.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6476 | "C:\Windows\System32\cmd.exe" /c copy Tricks Tricks.cmd & Tricks.cmd | C:\Windows\SysWOW64\cmd.exe | — | 9eeb1ff9590f0d56965dd0c3be237be5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6484 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6540 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6560 | findstr /I "opssvc wrsa" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6652 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6660 | findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6712 | cmd /c md 279619 | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6736 | extrac32 /Y /E Knights | C:\Windows\SysWOW64\extrac32.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® CAB File Extract Utility Exit code: 0 Version: 5.00 (WinBuild.160101.0800) Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Larry | binary | |
MD5:0EB8B1E9EECD9D157454A5D74E02B453 | SHA256:10A453C8031366AF738D2E4855E5B6953F31AF81C41F4CF2D09278CC9C3B4479 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Knights | compressed | |
MD5:A37F52340B365E198501AE40C6BFA6E4 | SHA256:9EC82A5093B170216E3BFDD5A691EB9E05597E0E85451F8059706BA9E8189862 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Door | binary | |
MD5:AB75EF3E70EF6FEBB742211489B92CD2 | SHA256:12ED56BDF120AA7E964597599A681EAAFC4F27FC6475C65674C0300C188A7BE9 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Tricks | text | |
MD5:DD10A26516CA1A7BF722C34E4A8E7C4D | SHA256:C07BA02B2CB284E1F2A0C9EF887643BC8B7C552969066153F2A6BB6283669413 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Investing | binary | |
MD5:AAC60CCF17DA69648A8A504AC2A3BB3A | SHA256:59AD54C60B817D472EB77C5A8C922D9FF944686732B05E555524666EC01BDD25 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Concentrations | binary | |
MD5:DFE3DBAC85EB7A4C1816ED4B4C1F050D | SHA256:DAF2AD4D0F20FC9730724E837D6E126A7A5CD71025E1833E345B8EF4EA003645 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Mason | binary | |
MD5:330AF6D59D7A99E5F90D560ADFC6CC03 | SHA256:B04BEB5E076EC9E7A5152880A4266123A6AE5327FE33457D6917E049E6C1470B | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Induction | binary | |
MD5:D7F7A2F66A3322A22751BE72CB5840FC | SHA256:4AA7CA4A48DFC31D34D5AF4D5B7D1D24EF1A6D07626CEA1B8218D4DFD7BCC930 | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Recorded | binary | |
MD5:FC01551A815B37FE2F0E927B71E36BF4 | SHA256:6CC49E1B3199B22456B28B6E9D5D9A97F5C9F03E15DC9C29C10541FD9575C37D | |||
| 6380 | 9eeb1ff9590f0d56965dd0c3be237be5.exe | C:\Users\admin\AppData\Local\Temp\Roy | binary | |
MD5:881CD371509187E7AE3C6D8E020C8DC8 | SHA256:E91F36B2AF5EF90B038D2E02F56C6B6CEDF5EA323CE29820F9A3AC993FCEAC90 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1176 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5464 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
836 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
836 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5064 | SearchApp.exe | 2.21.65.132:443 | www.bing.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1176 | svchost.exe | 20.190.160.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1176 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
1076 | svchost.exe | 184.28.89.167:443 | go.microsoft.com | AKAMAI-AS | US | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5464 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
cfQPDFsZUvvOiqtcFSRe.cfQPDFsZUvvOiqtcFSRe |
| unknown |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
4384 | RegAsm.exe | Domain Observed Used for C2 Detected | REMOTE [ANY.RUN] Possible AsyncRAT SSL Certificate |