File name:

8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf

Full analysis: https://app.any.run/tasks/9f726aac-2201-4622-ad2b-df1bb0ce3e6d
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 17:57:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

BC18B6803A287E63B3668B5817F12419

SHA1:

BC21190DF092D93629068C705EA8DC630D3DB4A4

SHA256:

8F42D1E07595808544EED18A45E8D7220DFF40597D4D53D0F63FAB47554AFBDF

SSDEEP:

49152:HHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZL:8AGQX21RBt7QjTmcaTH/vU4do9Pcjq1c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Wausaukee.exe (PID: 6624)

    • ASYNCRAT has been detected (YARA)

      • RegSvcs.exe (PID: 6648)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)

    • Starts itself from another location

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)

    • Connects to unusual port

      • RegSvcs.exe (PID: 6648)

  • INFO

    • Create files in a temporary directory

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)
      • Wausaukee.exe (PID: 6624)

    • Reads mouse settings

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)
      • Wausaukee.exe (PID: 6624)

    • Creates files or folders in the user directory

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)
      • Wausaukee.exe (PID: 6624)

    • Checks supported languages

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)
      • Wausaukee.exe (PID: 6624)
      • RegSvcs.exe (PID: 6648)

    • The sample compiled with english language support

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)

    • Reads the machine GUID from the registry

      • 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe (PID: 6436)
      • RegSvcs.exe (PID: 6648)

    • Reads the computer name

      • RegSvcs.exe (PID: 6648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(6648) RegSvcs.exe
C2 (1)69.174.100.131
Ports (1)6606
Version0.5.8
BotnetDefault
Options
AutoRunfalse
MutexabkZfsCYRZhk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQANuvcDyw7qEgH8/hHGWHqzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwNTEyMTI0OTA3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJdzTz3Veou5WnDQ98+tWByIlrDRKQGKkbazCczn0Ct7+4sThlLPimklMZ+f4RT57OsAzLlnLTta...
Server_SignatureUjRwEnqLww5G9RSDah9yeHMK6/wtykdUdUcfd8XhcHriDRQo/b1dEs55ZIcrcYDcOE+4d2djpdKU3gM61no1Rzq+0WHCcJt2RsLBfXwbhWjxuRlDCpRToPBAo8qxSSgln5xVcZ//c7sR6gGyB0o+kxIjVbYGpZw7qwJIqh+vpsGJY8P1jeUMp6a8TYzVOT0ywzyDCGO3TRhlHRhyl+9SweOLDYMoC2zh2y/uh2na6nNWkImclIRkJok0SnZ0lgQNoYAnkICBj3Yp0lcCoJ3TcAdgWo/BG9hiIHpBxIWAsZjF...
Keys
AES70da85b2bc283a94420fcc432cbfd1f102408e652890f85503bf8ffe7ef34638
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x27dcd
UninitializedDataSize: -
InitializedDataSize: 385536
CodeSize: 581120
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:03 05:34:39+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe wausaukee.exe #ASYNCRAT regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
6436"C:\Users\admin\AppData\Local\Temp\8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe" C:\Users\admin\AppData\Local\Temp\8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6624"C:\Users\admin\AppData\Local\Temp\8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe" C:\Users\admin\AppData\Local\preinhered\Wausaukee.exe
8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\preinhered\wausaukee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6648"C:\Users\admin\AppData\Local\Temp\8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wausaukee.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(6648) RegSvcs.exe
C2 (1)69.174.100.131
Ports (1)6606
Version0.5.8
BotnetDefault
Options
AutoRunfalse
MutexabkZfsCYRZhk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQANuvcDyw7qEgH8/hHGWHqzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwNTEyMTI0OTA3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJdzTz3Veou5WnDQ98+tWByIlrDRKQGKkbazCczn0Ct7+4sThlLPimklMZ+f4RT57OsAzLlnLTta...
Server_SignatureUjRwEnqLww5G9RSDah9yeHMK6/wtykdUdUcfd8XhcHriDRQo/b1dEs55ZIcrcYDcOE+4d2djpdKU3gM61no1Rzq+0WHCcJt2RsLBfXwbhWjxuRlDCpRToPBAo8qxSSgln5xVcZ//c7sR6gGyB0o+kxIjVbYGpZw7qwJIqh+vpsGJY8P1jeUMp6a8TYzVOT0ywzyDCGO3TRhlHRhyl+9SweOLDYMoC2zh2y/uh2na6nNWkImclIRkJok0SnZ0lgQNoYAnkICBj3Yp0lcCoJ3TcAdgWo/BG9hiIHpBxIWAsZjF...
Keys
AES70da85b2bc283a94420fcc432cbfd1f102408e652890f85503bf8ffe7ef34638
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
Total events
376
Read events
376
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
64368f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exeC:\Users\admin\AppData\Local\Temp\aut53E0.tmpbinary
MD5:360E888BD4500096C2EFCDE86DB752F3
SHA256:BB1C0B9570207DC968D0AD64E1F6A4D6F82F80B4E5EBFF4ED11C5B4DD61EA209
6624Wausaukee.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wausaukee.vbsbinary
MD5:5D8486869050F3CF7042550C8A5191C4
SHA256:9F5B46D76F011D0295A79BA1045ADE60008F6E2474588B918A85EA2DFB18B29F
6624Wausaukee.exeC:\Users\admin\AppData\Local\Temp\aut56ED.tmpbinary
MD5:360E888BD4500096C2EFCDE86DB752F3
SHA256:BB1C0B9570207DC968D0AD64E1F6A4D6F82F80B4E5EBFF4ED11C5B4DD61EA209
64368f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exeC:\Users\admin\AppData\Local\preinhered\Wausaukee.exeexecutable
MD5:BC18B6803A287E63B3668B5817F12419
SHA256:8F42D1E07595808544EED18A45E8D7220DFF40597D4D53D0F63FAB47554AFBDF
64368f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf.exeC:\Users\admin\AppData\Local\Temp\endochylousbinary
MD5:8409FF18F685EFF1B3AE18A11463A348
SHA256:C267167E1BAB18CF8A75063ADBFBF5D8927A97CFB3B549C85B6A9673CF7EDE69
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
36
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
716
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
716
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
184.24.77.35:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.24.77.35:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2736
svchost.exe
184.24.77.35:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2736
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.146:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 184.24.77.35
  • 184.24.77.37
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 104.126.37.146
  • 104.126.37.131
  • 104.126.37.153
  • 104.126.37.137
  • 104.126.37.145
  • 104.126.37.144
  • 104.126.37.147
  • 104.126.37.139
  • 104.126.37.155
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.140
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf