File name:

QuasarRAT.exe

Full analysis: https://app.any.run/tasks/1b356737-9320-48a7-828f-c698832ce81d
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: April 19, 2025, 09:41:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
azorult
sinkhole
loader
evasion
quasar
autoit
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

78F75D3EE49C612A1B47A095D8B41108

SHA1:

158EB8383DDF8064FDC119053E5755923FDEB5D8

SHA256:

773A219EB43AF7FB4A56992E11871DBD3463ACAE0F7A82F12EFA25AC84248D13

SSDEEP:

98304:GAGQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRp:z1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AZORULT mutex has been detected

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • Uses Task Scheduler to run other applications

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)

    • QUASAR mutex has been found

      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • windef.exe (PID: 7428)
      • winsock.exe (PID: 8012)

    • AZORULT has been detected (SURICATA)

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • Request for a sinkholed resource

      • QuasarRAT.exe (PID: 3192)

    • Changes the autorun value in the registry

      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • winsock.exe (PID: 8012)

    • Connects to the CnC server

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • QUASAR has been detected (YARA)

      • QuasarRAT.exe (PID: 3020)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • QuasarRAT.exe (PID: 3020)
      • windef.exe (PID: 5256)

    • Reads security settings of Internet Explorer

      • QuasarRAT.exe (PID: 3020)
      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • winsock.exe (PID: 6540)

    • Application launched itself

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)

    • Executes application which crashes

      • vnc.exe (PID: 6620)
      • vnc.exe (PID: 7396)
      • winsock.exe (PID: 6540)

    • Contacting a server suspected of hosting an CnC

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • Starts itself from another location

      • windef.exe (PID: 5256)

    • Checks for external IP

      • windef.exe (PID: 5256)
      • svchost.exe (PID: 2196)
      • winsock.exe (PID: 6540)
      • winsock.exe (PID: 8012)

    • Connects to unusual port

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • The process executes via Task Scheduler

      • SystemPropertiesPerformance.exe (PID: 7352)

    • Starts CMD.EXE for commands execution

      • winsock.exe (PID: 6540)

    • Executing commands from a ".bat" file

      • winsock.exe (PID: 6540)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7836)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7836)

    • The executable file from the user directory is run by the CMD process

      • winsock.exe (PID: 8012)

  • INFO

    • Reads the machine GUID from the registry

      • QuasarRAT.exe (PID: 3020)
      • QuasarRAT.exe (PID: 3192)
      • windef.exe (PID: 5256)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • windef.exe (PID: 7428)
      • winsock.exe (PID: 8012)

    • Reads mouse settings

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)

    • The sample compiled with english language support

      • QuasarRAT.exe (PID: 3020)

    • Checks supported languages

      • QuasarRAT.exe (PID: 3020)
      • vnc.exe (PID: 6620)
      • windef.exe (PID: 5256)
      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • vnc.exe (PID: 7396)
      • windef.exe (PID: 7428)
      • chcp.com (PID: 7908)
      • winsock.exe (PID: 8012)

    • Create files in a temporary directory

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • winsock.exe (PID: 6540)

    • Process checks computer location settings

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • winsock.exe (PID: 6540)

    • Reads the computer name

      • QuasarRAT.exe (PID: 3020)
      • QuasarRAT.exe (PID: 3192)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • windef.exe (PID: 7428)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • winsock.exe (PID: 8012)

    • Checks proxy server information

      • QuasarRAT.exe (PID: 3192)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • winsock.exe (PID: 8012)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 300)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • WerFault.exe (PID: 7480)
      • WerFault.exe (PID: 7944)

    • Disables trace logs

      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • winsock.exe (PID: 8012)

    • The process uses AutoIt

      • QuasarRAT.exe (PID: 3020)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:12 13:38:44+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 1527296
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Adobe Download Manager
OriginalFileName: Adobe Download Manager
CompanyName: Adobe Systems Incorporated
FileVersion: ...
LegalCopyright: Copyright 2018 Adobe Incorporated. All rights reserved.
ProductName: Adobe Download Manager
ProductVersion: ...
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
26
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR quasarrat.exe vnc.exe svchost.exe no specs #QUASAR windef.exe #AZORULT quasarrat.exe schtasks.exe no specs conhost.exe no specs werfault.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe no specs #QUASAR winsock.exe systempropertiesperformance.exe no specs vnc.exe svchost.exe no specs #QUASAR windef.exe no specs werfault.exe no specs #AZORULT systempropertiesperformance.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe no specs #QUASAR winsock.exe

Process information

PID
CMD
Path
Indicators
Parent process
300C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6620 -s 592C:\Windows\SysWOW64\WerFault.exe—vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3020"C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe" C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Version:
...
Modules
Images
c:\users\admin\appdata\local\temp\quasarrat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
3192"C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe"C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe
QuasarRAT.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\appdata\local\temp\quasarrat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4880C:\WINDOWS\system32\svchost.exe -kC:\Windows\System32\svchost.exe—vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
4892C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4976"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /FC:\Windows\SysWOW64\schtasks.exe—QuasarRAT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5164"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5256"C:\Users\admin\AppData\Local\Temp\windef.exe" C:\Users\admin\AppData\Local\Temp\windef.exe
QuasarRAT.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windef.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
12 903
Read events
12 866
Write events
37
Delete events
0

Modification events

(PID) Process:(3192) QuasarRAT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3192) QuasarRAT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3192) QuasarRAT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
4
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
300WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_c260b12b-b723-4ec0-bb01-5fbf4da1df6c\Report.wer —
MD5:—
SHA256:—
7480WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_5ae4957f-4540-4c58-804f-1b802abb9ba2\Report.wer —
MD5:—
SHA256:—
7944WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_winsock.exe_4ec29f32368eb0b92941df6619f6579b4b16f5a8_e8bd1e0d_0159e100-1f6d-4689-8b21-7b165e972aa3\Report.wer —
MD5:—
SHA256:—
7944WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\winsock.exe.6540.dmp —
MD5:—
SHA256:—
3020QuasarRAT.exeC:\Users\admin\AppData\Local\Temp\windef.exeexecutable
MD5:B4A202E03D4135484D0E730173ABCC72
SHA256:7050608D53F80269DF951D00883ED79815C060CE7678A76B5C3F6A2A985BEEA9
3020QuasarRAT.exeC:\Users\admin\btpanui\SystemPropertiesPerformance.exeexecutable
MD5:B0828CD0E21C90652B258A29DD5814CC
SHA256:1EE246575CFFF910B2B6649C8B1351B8CFF5134F504D08B4714DE89FBD3423DC
7480WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER34B.tmp.xmlxml
MD5:C5AC78E2E9919B90C4F7931440EDF0DE
SHA256:CDBF9CD3AB4A847C13F4AB6047F8225BF958232490A09562125DC024DF7E09AA
300WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC045.tmp.WERInternalMetadata.xmlbinary
MD5:3DC152EDE9A8A3691BEBAC85688D8BE8
SHA256:FF03A2737B4D236C7390D31EB86B5CDC2D3834DF94F981699011ED58917A2372
7480WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\vnc.exe.7396.dmpbinary
MD5:252DB8404E3A2275A33E576C5813168B
SHA256:41F2A800DB23BA330E3510A92D08C1D231AFBE14D20E2473538073210B8512D1
7480WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2DB.tmp.dmpbinary
MD5:A300AD4BCFAB5DE5775094C456583147
SHA256:CA397F5C8593390B7DDAED54654A4CE5ECC0441D6471A886D4A30C4A2F3ED6BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
26
DNS requests
16
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3192
QuasarRAT.exe
POST
—
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
3192
QuasarRAT.exe
POST
200
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
6540
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
5256
windef.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7748
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7748
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7496
SystemPropertiesPerformance.exe
POST
200
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
7496
SystemPropertiesPerformance.exe
POST
—
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3192
QuasarRAT.exe
3.229.117.57:8000
0x21.in
AMAZON-AES
US
malicious
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5256
windef.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6540
winsock.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6540
winsock.exe
5.8.88.191:443
—
PINVDS OU
RU
malicious
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
whitelisted
google.com
  • 142.250.186.174
whitelisted
0x21.in
  • 3.229.117.57
malicious
client.wns.windows.com
  • 172.211.123.249
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.131
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted

Threats

PID
Process
Class
Message
3192
QuasarRAT.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
3192
QuasarRAT.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
3192
QuasarRAT.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
3192
QuasarRAT.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5256
windef.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
5256
windef.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6540
winsock.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6540
winsock.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
QuasarRAT.exe