File name:

SwiftLoader.exe

Full analysis: https://app.any.run/tasks/1d713974-80f5-4176-8a0b-f73a1899257e
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 20:12:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

5DC92EF487D09957DC3B1AA8C611C575

SHA1:

3B4E145246465390326D28491A67FD0399315A00

SHA256:

61B90C5C3B7ABE49384E67E38F553121D447BA22A9C5AFCB152E7C827E87B784

SSDEEP:

1536:54SSEuSmcvK4IewKKaslFP+AHGjH1bz/EdQ4BsuLVclN:54SSEuSmcvJwKKaslFPGH1bz8q4BBY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (YARA)

      • SwiftLoader.exe (PID: 6548)

  • SUSPICIOUS

    • Executes application which crashes

      • SwiftLoader.exe (PID: 6548)

  • INFO

    • Reads Environment values

      • SwiftLoader.exe (PID: 6548)

    • Reads the machine GUID from the registry

      • SwiftLoader.exe (PID: 6548)

    • Reads the computer name

      • SwiftLoader.exe (PID: 6548)

    • Sends debugging messages

      • SwiftLoader.exe (PID: 6548)

    • Checks supported languages

      • SwiftLoader.exe (PID: 6548)

    • Checks proxy server information

      • WerFault.exe (PID: 3464)

    • Reads the software policy settings

      • WerFault.exe (PID: 3464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(6548) SwiftLoader.exe
C2 (1)10.9.196.210
Ports (2)29558
5552
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRuntrue
Mutexytizkcaytelds
InstallFolder%AppData%
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureI4ZT7urL81Onsy05JWjYomjadZVkvPTOXC4TJ+qOVGVcV4SIsPh0ifoI86qOZxVxGyg1ge9eOljwYXNXtoYgAJy8NXl2AZnIWWUCyJTwt3rlyymuUad3j+Ju4Yj8iTvjGJUa+ZBTHq2gWVIT8U1KS6EtliDtPGZMFBghMO9h58g=
Keys
AES56b89ccba8adfdbd667e20a6033780396a7c0014acfd488304c9d6976f5ace9d
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

AssemblyVersion: 6.0.1.0
ProductVersion: 6.0.1
ProductName: -
OriginalFileName: ClientAny.exe
LegalTrademarks: -
LegalCopyright: -
InternalName: ClientAny.exe
FileVersion: 6.0.1
FileDescription: -
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 6.0.1.0
FileVersionNumber: 6.0.1.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1344e
UninitializedDataSize: -
InitializedDataSize: 4096
CodeSize: 71168
LinkerVersion: 8
PEType: PE32
ImageFileCharacteristics: Executable
TimeStamp: 2023:02:08 22:10:28+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT swiftloader.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6548"C:\Users\admin\AppData\Local\Temp\SwiftLoader.exe" C:\Users\admin\AppData\Local\Temp\SwiftLoader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2148734499
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\swiftloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(6548) SwiftLoader.exe
C2 (1)10.9.196.210
Ports (2)29558
5552
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRuntrue
Mutexytizkcaytelds
InstallFolder%AppData%
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureI4ZT7urL81Onsy05JWjYomjadZVkvPTOXC4TJ+qOVGVcV4SIsPh0ifoI86qOZxVxGyg1ge9eOljwYXNXtoYgAJy8NXl2AZnIWWUCyJTwt3rlyymuUad3j+Ju4Yj8iTvjGJUa+ZBTHq2gWVIT8U1KS6EtliDtPGZMFBghMO9h58g=
Keys
AES56b89ccba8adfdbd667e20a6033780396a7c0014acfd488304c9d6976f5ace9d
SaltVenomRATByVenom
3464C:\WINDOWS\system32\WerFault.exe -u -p 6548 -s 1440C:\Windows\System32\WerFault.exe
SwiftLoader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
Total events
3 571
Read events
3 571
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
5
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SwiftLoader.exe_68be68caea3056b45bf0203779f864455997_65722aea_c601b49b-0a24-4b57-bf9a-f5f84e584179\Report.wer —
MD5:—
SHA256:—
3464WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\SwiftLoader.exe.6548.dmp —
MD5:—
SHA256:—
3464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER66EB.tmp.dmpbinary
MD5:F10303D5BE1E0FB46A2CBCFA8C2E4C2C
SHA256:4EF264BE86E55A7037F4E28E60AFA70FC84494C5BA2B98273B5D5BD95FDE8A3C
3464WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:44BB9120CA1918560A4204CE37F23A4F
SHA256:22B33A88EDCF647BB1212892132EAA76D710FD018B801D6CDF8991170CD5EC25
3464WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
3464WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6548SwiftLoader.exeC:\Users\admin\AppData\Roaming\MyData\DataLogs.conftext
MD5:CF759E4C5F14FE3EEC41B87ED756CEA8
SHA256:C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
3464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6854.tmp.xmlxml
MD5:7FAC844FD2D462D8A5D9046FAE445236
SHA256:8A977F117D087F9B9E20D154A4A791FAAA4A333FFD2174DBC998ACCE1FEA9724
3464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6824.tmp.WERInternalMetadata.xmlxml
MD5:3518944323227F7C00A9DCE37F988715
SHA256:5752FE35241C55598A5EBBE8BA1233556C7FBD34506D77C7CC19076BB35E4EE0
3464WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:0CC778F16A12ED18156937F3A7A53958
SHA256:60140F22190DC310ADDECB8B2B84187E8EA1493F671B4344BDB331105C736222
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
30
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.185:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3464
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3464
WerFault.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6652
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.185:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.185
  • 23.48.23.177
  • 23.48.23.178
  • 23.48.23.176
  • 23.48.23.194
  • 23.48.23.190
  • 23.48.23.181
  • 23.48.23.193
  • 23.48.23.188
  • 23.48.23.138
  • 23.48.23.147
  • 23.48.23.145
  • 23.48.23.146
  • 23.48.23.139
  • 23.48.23.143
  • 23.48.23.156
  • 23.48.23.150
  • 23.48.23.140
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.154
  • 104.126.37.163
  • 104.126.37.129
  • 104.126.37.123
  • 104.126.37.145
  • 104.126.37.176
  • 104.126.37.131
  • 104.126.37.139
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.20
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
watson.events.data.microsoft.com
  • 52.168.117.173
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
Process
Message
SwiftLoader.exe
CLR: Managed code called FailFast without specifying a reason.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SwiftLoader.exe