File name:

cozios Image Logger.exe

Full analysis: https://app.any.run/tasks/4ee861ed-7d81-41f7-9e5a-83ff48880441
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: April 17, 2024, 01:18:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

9A6F6CACA9DD58075C1B428ACD8A5F16

SHA1:

20B4DCF9B06EFAD871116EB14D271BF8344E5907

SHA256:

9C633404D41A3C07F7EA28683BA909FF5DD64F06E6680D0C143C6FDC66EF33A2

SSDEEP:

1536:R3SSEuqmcv0OrEcKKasLV1zKk20sH1bY/9BsNLVclN:R3SSEuqmcvMcKKasLV1UBH1bYViBY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cozios Image Logger.exe (PID: 1020)

    • Changes the autorun value in the registry

      • cozios Image Logger.exe (PID: 1020)

    • ASYNCRAT has been detected (YARA)

      • image logger.exe (PID: 2984)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • cozios Image Logger.exe (PID: 1020)

    • Executable content was dropped or overwritten

      • cozios Image Logger.exe (PID: 1020)

    • Starts CMD.EXE for commands execution

      • cozios Image Logger.exe (PID: 1020)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3252)

    • The executable file from the user directory is run by the CMD process

      • image logger.exe (PID: 2984)

    • Connects to unusual port

      • image logger.exe (PID: 2984)

  • INFO

    • Creates files or folders in the user directory

      • cozios Image Logger.exe (PID: 1020)

    • Reads the computer name

      • cozios Image Logger.exe (PID: 1020)
      • image logger.exe (PID: 2984)

    • Checks supported languages

      • cozios Image Logger.exe (PID: 1020)
      • image logger.exe (PID: 2984)

    • Reads the machine GUID from the registry

      • cozios Image Logger.exe (PID: 1020)
      • image logger.exe (PID: 2984)

    • Reads Environment values

      • cozios Image Logger.exe (PID: 1020)
      • image logger.exe (PID: 2984)

    • Create files in a temporary directory

      • cozios Image Logger.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(2984) image logger.exe
C2 (3)127.0.0.1
127.0.0.144
87.100.214.103
Ports (1)4449
BotnetDefault
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRuntrue
Mutexpodqoeugtxfrsvjfnm
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureK9TqTf5G/a9tGA2uk+KfOdMZsta5NSue5nTipz2rqNAlJZgcw20RdKYZSJmV+JkB2l52QRRjUqUFNH7m7grsUAU/xTtMWTGeLWE0uJ2/ojif4gzuPRFtLSh9kmvcnQt6jcKNstRh4xzS1OkpqglzZtuNtRkrNBkaxvxYr3yjjlg=
Keys
AES3414d772e9bb01d7048da53d3edbc0b5d63eda448ecb4e5fb6bffbc076fe9e52
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:08 22:10:28+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 71168
InitializedDataSize: 4096
UninitializedDataSize: -
EntryPoint: 0x134de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.0.1.0
ProductVersionNumber: 6.0.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 6.0.1
InternalName: ClientAny.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: ClientAny.exe
ProductName: -
ProductVersion: 6.0.1
AssemblyVersion: 6.0.1.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cozios image logger.exe cmd.exe no specs timeout.exe no specs #ASYNCRAT image logger.exe

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\Users\admin\AppData\Local\Temp\cozios Image Logger.exe" C:\Users\admin\AppData\Local\Temp\cozios Image Logger.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\cozios image logger.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2984"C:\Users\admin\AppData\Roaming\image logger.exe" C:\Users\admin\AppData\Roaming\image logger.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\roaming\image logger.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
AsyncRat
(PID) Process(2984) image logger.exe
C2 (3)127.0.0.1
127.0.0.144
87.100.214.103
Ports (1)4449
BotnetDefault
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRuntrue
Mutexpodqoeugtxfrsvjfnm
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureK9TqTf5G/a9tGA2uk+KfOdMZsta5NSue5nTipz2rqNAlJZgcw20RdKYZSJmV+JkB2l52QRRjUqUFNH7m7grsUAU/xTtMWTGeLWE0uJ2/ojif4gzuPRFtLSh9kmvcnQt6jcKNstRh4xzS1OkpqglzZtuNtRkrNBkaxvxYr3yjjlg=
Keys
AES3414d772e9bb01d7048da53d3edbc0b5d63eda448ecb4e5fb6bffbc076fe9e52
SaltVenomRATByVenom
3252C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmpE7BB.tmp.bat""C:\Windows\System32\cmd.exe—cozios Image Logger.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3312timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
Total events
892
Read events
863
Write events
29
Delete events
0

Modification events

(PID) Process:(1020) cozios Image Logger.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1020) cozios Image Logger.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:image logger
Value:
"C:\Users\admin\AppData\Roaming\image logger.exe"
(PID) Process:(2984) image logger.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1020cozios Image Logger.exeC:\Users\admin\AppData\Roaming\MyData\DataLogs.conftext
MD5:—
SHA256:—
1020cozios Image Logger.exeC:\Users\admin\AppData\Local\Temp\tmpE7BB.tmp.battext
MD5:—
SHA256:—
1020cozios Image Logger.exeC:\Users\admin\AppData\Roaming\image logger.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2984
image logger.exe
87.100.214.103:4449
—
DNA Oyj
FI
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cozios Image Logger.exe