File name:

setup.ps1

Full analysis: https://app.any.run/tasks/7aa441ba-83b8-4d4b-a127-7509d2fbdc78
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: September 03, 2024, 14:03:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
asyncrat
remote
evasion
susp-powershell
api-base64
Indicators:
MIME: text/plain
File info: Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
MD5:

8743F6A63DCE2B0D13AC0D18223B9C30

SHA1:

396366A412608306F9BC0FCC99DDBCA6C9F80572

SHA256:

64F9AEEC01269185CFE6FF0A80D9D55025E5905751A779EB8955C0A181DF2C3A

SSDEEP:

12288:BYmb0rrxpjtNSlK0J86cdd1Y8AhhTguYOgmhPYjyC5HLZdZz9cDYVBKiE2NykAEK:BYmb0nxpJNSlRC6ed67hhUu5gm6f7dZi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (SURICATA)

      • powershell.exe (PID: 6196)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • powershell.exe (PID: 6196)

    • Connects to unusual port

      • powershell.exe (PID: 6196)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6196)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 1920)
      • csc.exe (PID: 2892)

    • Checks for external IP

      • powershell.exe (PID: 6196)

  • INFO

    • Checks supported languages

      • csc.exe (PID: 1920)
      • cvtres.exe (PID: 6752)
      • cvtres.exe (PID: 2092)
      • csc.exe (PID: 2892)

    • The process uses the downloaded file

      • powershell.exe (PID: 6196)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6196)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 1920)
      • csc.exe (PID: 2892)

    • Create files in a temporary directory

      • csc.exe (PID: 1920)
      • cvtres.exe (PID: 6752)
      • csc.exe (PID: 2892)
      • cvtres.exe (PID: 2092)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6196)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 6196)

    • Found Base64 encoded network access via PowerShell (YARA)

      • powershell.exe (PID: 6196)

    • Found Base64 encoded access to processes via PowerShell (YARA)

      • powershell.exe (PID: 6196)

    • Found Base64 encoded access to Windows Identity via PowerShell (YARA)

      • powershell.exe (PID: 6196)

    • Found Base64 encoded file access via PowerShell (YARA)

      • powershell.exe (PID: 6196)

    • Found Base64 encoded access to Marshal class via PowerShell (YARA)

      • powershell.exe (PID: 6196)

    • Reads the software policy settings

      • slui.exe (PID: 2612)
      • slui.exe (PID: 6292)

    • Checks proxy server information

      • slui.exe (PID: 6292)
      • powershell.exe (PID: 6196)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • powershell.exe (PID: 6196)

    • Disables trace logs

      • powershell.exe (PID: 6196)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 6196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-16 (LE) encoded (66.6)
.mp3 | MP3 audio (33.3)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs sppextcomobj.exe no specs slui.exe csc.exe cvtres.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1920"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ytwtx5w3.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
2092C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES201E.tmp" "c:\Users\admin\AppData\Local\Temp\CSC95ABE7EB2A9A4A659211383E6987B71.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2612"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2892"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ggeudceh.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3028C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6196"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\admin\AppData\Local\Temp\setup.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6292C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6752C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESC1C2.tmp" "c:\Users\admin\AppData\Local\Temp\CSCF3E4D80287EF47D49FFFAE37E2C8857C.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
Total events
15 744
Read events
15 722
Write events
22
Delete events
0

Modification events

(PID) Process:(6196) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6196) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6196) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6196) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6196) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6196) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6196) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6196) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6196) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6196) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
2
Suspicious files
5
Text files
10
Unknown types
3

Dropped files

PID
Process
Filename
Type
1920csc.exeC:\Users\admin\AppData\Local\Temp\CSCF3E4D80287EF47D49FFFAE37E2C8857C.TMPres
MD5:B54C3F1393A752B327A986829FD78DC8
SHA256:D8BD00E5405CA90F20C380F4EA9CE2B6DD3C54126D68279AFCAF01D2D7DB39D0
6196powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r2fwxi2f.bnq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2092cvtres.exeC:\Users\admin\AppData\Local\Temp\RES201E.tmpo
MD5:38413A5CD43F04184352D8444EE15F19
SHA256:58AC1973E56679CF29D3A1EC5A768E78496D25C88D49B0A70FB8AE2F9005DE56
6196powershell.exeC:\Users\admin\AppData\Local\Temp\ytwtx5w3.0.cstext
MD5:CA8212A5E5CBD121128003C6FB39C43A
SHA256:B8D11AB08708F170D959FDB4003E3C74872B570D3153438EAFCBFC3D78921E07
1920csc.exeC:\Users\admin\AppData\Local\Temp\ytwtx5w3.outtext
MD5:DC8F417FE6386D19704DDFC45F6166AC
SHA256:C6A81F2F39DE7E2328211560C805BE19D0888267EC6B1805E6D5F8E53FA2E326
6196powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vsyfzayg.mac.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6196powershell.exeC:\Users\admin\AppData\Local\Temp\ggeudceh.0.cstext
MD5:36378AF3E9CADD94CED6728517519BC9
SHA256:DCEEEF4A04AD74F7274337FAC4BB19CD95A3E38D14189F7095DD9E7E416573DB
6752cvtres.exeC:\Users\admin\AppData\Local\Temp\RESC1C2.tmpbinary
MD5:D2A6AA916A237789C73A5C6DAC8C6BF2
SHA256:7F2611473CB197DFF6316284FC2ABDA450597AEDE4B71FF062013CFD20B216A6
1920csc.exeC:\Users\admin\AppData\Local\Temp\ytwtx5w3.dllexecutable
MD5:81DC6A7E362628BF343A89D2FCF16550
SHA256:A07E3CE7474CCCCB305CC3E64026A31C8A14FF6B4D9AC0EC4624629B3B2F8D12
6196powershell.exeC:\Users\admin\AppData\Local\Temp\ytwtx5w3.cmdlinetext
MD5:FAFFEAC288748E58DB3F0F8313A3CFF0
SHA256:DDCED7E1DD1957CC547E36492C6A89D23A929C363C95551E1A1ABCC114B522E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
47
DNS requests
23
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6288
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6056
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6056
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6196
powershell.exe
193.29.59.154:18414
6gjq2xnexz5j59a.top
IP-Projects GmbH & Co. KG
DE
unknown
6196
powershell.exe
104.26.13.205:443
api.ipify.org
CLOUDFLARENET
US
shared
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3424
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
6gjq2xnexz5j59a.top
  • 193.29.59.154
unknown
api.ipify.org
  • 104.26.13.205
  • 104.26.12.205
  • 172.67.74.152
shared
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
6196
powershell.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
6196
powershell.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
2256
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6196
powershell.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
6196
powershell.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.ps1