File name:

DOCUMENTO_00001111_879985445822562232326598562659865.exe

Full analysis: https://app.any.run/tasks/05570ec2-26d7-4927-a935-654e69c5c90b
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 17:19:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
asyncrat
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, InstallShield self-extracting archive, 9 sections
MD5:

43468419FEE8EE89FBC7F0D2ECE3C97D

SHA1:

5DE64AF4E77DBBDE29B1653D16BA6163741643A5

SHA256:

9841B2B0EEDD10CA072DED35EB49117B5941378996C3DD4D3CD3B6DE50087763

SSDEEP:

98304:wSdDQecsFyqtCerQPoSCqsHbQha54pblQbLw+iX6lk9rImwXEaGxgUSLelkrSgzd:vUmZF8Yf0G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Logic_Pilot32.exe (PID: 7184)
      • XPFix.exe (PID: 7808)
      • ThreadAggre.exe (PID: 7632)
      • Logic_Pilot32.exe (PID: 7236)

    • ASYNCRAT has been detected (SURICATA)

      • ThreadAggre.exe (PID: 7632)

  • SUSPICIOUS

    • Starts itself from another location

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 4300)
      • Logic_Pilot32.exe (PID: 7184)

    • Process drops legitimate windows executable

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 7020)
      • Logic_Pilot32.exe (PID: 7184)

    • Executable content was dropped or overwritten

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 7020)
      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 4300)
      • Logic_Pilot32.exe (PID: 7184)
      • Logic_Pilot32.exe (PID: 7236)

    • The process drops C-runtime libraries

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 7020)
      • Logic_Pilot32.exe (PID: 7184)

    • Contacting a server suspected of hosting an CnC

      • ThreadAggre.exe (PID: 7632)

    • Connects to unusual port

      • ThreadAggre.exe (PID: 7632)

  • INFO

    • Checks supported languages

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 4300)
      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 7020)
      • Logic_Pilot32.exe (PID: 7184)
      • ThreadAggre.exe (PID: 7632)
      • XPFix.exe (PID: 7808)
      • Logic_Pilot32.exe (PID: 7236)

    • Create files in a temporary directory

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 4300)
      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 7020)
      • Logic_Pilot32.exe (PID: 7236)
      • XPFix.exe (PID: 7808)

    • The sample compiled with english language support

      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 4300)
      • DOCUMENTO_00001111_879985445822562232326598562659865.exe (PID: 7020)
      • Logic_Pilot32.exe (PID: 7184)

    • Reads the computer name

      • Logic_Pilot32.exe (PID: 7184)
      • Logic_Pilot32.exe (PID: 7236)
      • ThreadAggre.exe (PID: 7632)
      • XPFix.exe (PID: 7808)

    • Creates files in the program directory

      • Logic_Pilot32.exe (PID: 7184)

    • The sample compiled with chinese language support

      • Logic_Pilot32.exe (PID: 7236)

    • Creates files or folders in the user directory

      • Logic_Pilot32.exe (PID: 7236)

    • Reads the machine GUID from the registry

      • ThreadAggre.exe (PID: 7632)

    • Reads the software policy settings

      • ThreadAggre.exe (PID: 7632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:04:05 13:00:45+00:00
ImageFileCharacteristics: Executable, Large address aware, Removable run from swap, Net run from swap
PEType: PE32+
LinkerVersion: 14.34
CodeSize: 515584
InitializedDataSize: 267776
UninitializedDataSize: -
EntryPoint: 0x53dd0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.2.5.0
ProductVersionNumber: 5.2.5.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Polacca
FileDescription: Durra
FileVersion: 5.2.5.0
InternalName: burn
OriginalFileName: perimysium.exe
ProductName: Durra
ProductVersion: 5.2.5.0
LegalCopyright: Copyright (c) Polacca. All rights reserved.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
10
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start documento_00001111_879985445822562232326598562659865.exe documento_00001111_879985445822562232326598562659865.exe sppextcomobj.exe no specs slui.exe no specs logic_pilot32.exe logic_pilot32.exe #ASYNCRAT threadaggre.exe conhost.exe no specs xpfix.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2136"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3132C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4300"C:\Users\admin\AppData\Local\Temp\DOCUMENTO_00001111_879985445822562232326598562659865.exe" C:\Users\admin\AppData\Local\Temp\DOCUMENTO_00001111_879985445822562232326598562659865.exe
explorer.exe
User:
admin
Company:
Polacca
Integrity Level:
MEDIUM
Description:
Durra
Exit code:
0
Version:
5.2.5.0
Modules
Images
c:\users\admin\appdata\local\temp\documento_00001111_879985445822562232326598562659865.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7020"C:\Users\admin\AppData\Local\Temp\{D14ED76C-D460-4E27-A0CD-B218DAAA101A}\.cr\DOCUMENTO_00001111_879985445822562232326598562659865.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\DOCUMENTO_00001111_879985445822562232326598562659865.exe" -burn.filehandle.attached=616 -burn.filehandle.self=684C:\Users\admin\AppData\Local\Temp\{D14ED76C-D460-4E27-A0CD-B218DAAA101A}\.cr\DOCUMENTO_00001111_879985445822562232326598562659865.exe
DOCUMENTO_00001111_879985445822562232326598562659865.exe
User:
admin
Company:
Polacca
Integrity Level:
MEDIUM
Description:
Durra
Exit code:
0
Version:
5.2.5.0
Modules
Images
c:\users\admin\appdata\local\temp\{d14ed76c-d460-4e27-a0cd-b218daaa101a}\.cr\documento_00001111_879985445822562232326598562659865.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7184C:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\Logic_Pilot32.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\Logic_Pilot32.exe
DOCUMENTO_00001111_879985445822562232326598562659865.exe
User:
admin
Company:
TechSmith Corporation
Integrity Level:
MEDIUM
Description:
Camtasia MenuMaker Author
Exit code:
0
Version:
8.1.2.1327
Modules
Images
c:\users\admin\appdata\local\temp\{e07dd941-1087-4689-a45f-90bb50714bb8}\.ba\logic_pilot32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7236C:\ProgramData\authchrome_XWv4\Logic_Pilot32.exeC:\ProgramData\authchrome_XWv4\Logic_Pilot32.exe
Logic_Pilot32.exe
User:
admin
Company:
TechSmith Corporation
Integrity Level:
MEDIUM
Description:
Camtasia MenuMaker Author
Exit code:
0
Version:
8.1.2.1327
Modules
Images
c:\programdata\authchrome_xwv4\logic_pilot32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7632C:\Users\admin\AppData\Local\Temp\ThreadAggre.exeC:\Users\admin\AppData\Local\Temp\ThreadAggre.exe
Logic_Pilot32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe IPC Broker Custom Hook
Version:
5.1.0.50
Modules
Images
c:\users\admin\appdata\local\temp\ebfcf88.tmp
c:\users\admin\appdata\local\temp\threadaggre.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ThreadAggre.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7808"C:\Users\admin\AppData\Roaming\authchrome_XWv4\XPFix.exe" "C:\Users\admin\AppData\Roaming\authchrome_XWv4\XPFix.exe" /updateC:\Users\admin\AppData\Roaming\authchrome_XWv4\XPFix.exe—Logic_Pilot32.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全卫士 安全防护中心模块
Exit code:
0
Version:
1, 0, 0, 1013
Modules
Images
c:\windows\syswow64\input.dll
c:\users\admin\appdata\roaming\authchrome_xwv4\xpfix.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
4 112
Read events
4 112
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
8
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\Jaggrousved.egbinary
MD5:E3750F971C32BC4F5CB1A9BFFD221707
SHA256:4351BF3024F9558E7820E82C39AA336B52651E61F13437BEC6520029CCC540AE
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\Gymnosperm.dllexecutable
MD5:B08BFDEED4E411C9B2591FD86141D6F7
SHA256:8EC40D6BDA05841B14108515E8F2CFA3FF64282C4E3A750CA64C85526CFEFB39
7184Logic_Pilot32.exeC:\ProgramData\authchrome_XWv4\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\Kling.gnbinary
MD5:3A83A8D92460490D3FD5EBC88E7364E7
SHA256:B895C67BDA75BFF787F16D315705031F53B9D1000595C30971B0FD7C070541C6
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\mfc100enu.dllexecutable
MD5:2A2C442F00B45E01D4C882EEA69A01BC
SHA256:D71DB839DE0BC1FCC01A125D57CED2AAEA3F444A992426C316CE18C267C33A8C
7236Logic_Pilot32.exeC:\Users\admin\AppData\Local\Temp\EBFCF88.tmp —
MD5:—
SHA256:—
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\msvcp100.dllexecutable
MD5:BC83108B18756547013ED443B8CDB31B
SHA256:B2AD109C15EAA92079582787B7772BA0A2F034F7D075907FF87028DF0EAEA671
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\BootstrapperApplicationData.xmlxml
MD5:24B9E276595BF2445143A4ABB221DD14
SHA256:5A8547082FFE75989A4E44ED1C5D3A2B76206CC070FDC0049133DC7D3E93C775
7184Logic_Pilot32.exeC:\ProgramData\authchrome_XWv4\Logic_Pilot32.exeexecutable
MD5:0AA5410C7565C20AEBBB56A317E578DA
SHA256:88A1F9A40EB7ECE8999092B2872B6AFDE0FB3776E29384C5B00631BB0FCA34D1
7020DOCUMENTO_00001111_879985445822562232326598562659865.exeC:\Users\admin\AppData\Local\Temp\{E07DD941-1087-4689-A45F-90BB50714BB8}\.ba\XceedZip.dllexecutable
MD5:882E0B32BBC7BABEC02C0F84B4BD45E0
SHA256:FDC388887E4AB3B72CDE0063E4060C7D8F059BB20468AF7BD18E86E976001390
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7816
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7816
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7816
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.129
  • 40.126.31.69
  • 40.126.31.128
  • 20.190.159.64
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
delamanodedios7.dynuddns.com
  • 176.65.141.141
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.dynuddns .com Domain
7632
ThreadAggre.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
7632
ThreadAggre.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
7632
ThreadAggre.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
7632
ThreadAggre.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DOCUMENTO_00001111_879985445822562232326598562659865.exe