File name:

Bawless Cracked By @Drcrypt0r.rar

Full analysis: https://app.any.run/tasks/f25e8bbf-2d59-4cbd-b7fd-84f9f65cce98
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 19, 2025, 14:11:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
asyncrat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

246CC39EA43377D516318ABC5B20793B

SHA1:

75B24BD1E92BC0F246A099107B6C1C10FB5E4768

SHA256:

C54403022C42B42367502611961498E31867F08B4EEC3B81F2C38323A18A039F

SSDEEP:

98304:kc4lVh0HSpJFQV6Owx7+I15oNA5zbZiPO1Bm7R5KUC4F7gx6TDXyb3D7cIM8IB84:A35PbspX0Wpf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (YARA)

      • Bawless.exe (PID: 4976)
      • bawless-client.exe (PID: 3920)

  • SUSPICIOUS

    • Executes application which crashes

      • Bawless.exe (PID: 732)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 5268)

    • The process checks if it is being run in the virtual environment

      • Bawless.exe (PID: 4976)

    • Reads security settings of Internet Explorer

      • Bawless.exe (PID: 4976)

    • There is functionality for taking screenshot (YARA)

      • Bawless.exe (PID: 4976)

    • Creates file in the systems drive root

      • Bawless.exe (PID: 4976)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2672)
      • WinRAR.exe (PID: 5268)
      • Bawless.exe (PID: 4976)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3836)
      • Bawless.exe (PID: 4976)

    • Checks supported languages

      • Bawless.exe (PID: 732)
      • Bawless.exe (PID: 4976)
      • bawless-client.exe (PID: 3920)

    • Reads the software policy settings

      • WerFault.exe (PID: 3836)

    • Manual execution by a user

      • WinRAR.exe (PID: 5268)
      • Bawless.exe (PID: 732)
      • Bawless.exe (PID: 4976)
      • bawless-client.exe (PID: 3920)

    • Reads the machine GUID from the registry

      • Bawless.exe (PID: 732)
      • bawless-client.exe (PID: 3920)
      • Bawless.exe (PID: 4976)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2672)
      • WinRAR.exe (PID: 5268)

    • Checks proxy server information

      • WerFault.exe (PID: 3836)

    • Reads the computer name

      • Bawless.exe (PID: 732)
      • Bawless.exe (PID: 4976)
      • bawless-client.exe (PID: 3920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 2432844
UncompressedSize: 15375872
OperatingSystem: Win32
ArchivedFileName: Bawless.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs bawless.exe werfault.exe winrar.exe #ASYNCRAT bawless.exe no specs #ASYNCRAT bawless-client.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\Bawless.exe" C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\Bawless.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bawless
Exit code:
3762504530
Version:
1.0.0
Modules
Images
c:\users\admin\desktop\bawless cracked by @drcrypt0r\bawless.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2672"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3836C:\WINDOWS\SysWOW64\WerFault.exe -u -p 732 -s 1140C:\Windows\SysWOW64\WerFault.exe
Bawless.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3920"C:\Users\admin\Desktop\bawless-client.exe" C:\Users\admin\Desktop\bawless-client.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
5.0.0.3
Modules
Images
c:\users\admin\desktop\bawless-client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4628C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4976"C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\Bawless.exe" C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\Bawless.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bawless
Version:
1.0.0
Modules
Images
c:\users\admin\desktop\bawless cracked by @drcrypt0r\bawless.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5268"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
14 129
Read events
14 006
Write events
107
Delete events
16

Modification events

(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r.rar
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(2672) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
35
Suspicious files
12
Text files
34
Unknown types
0

Dropped files

PID
Process
Filename
Type
3836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Bawless.exe_f3ed497eb31eae66681c12c94d78b3fd0bc22dc_51272107_245f8b2f-9ab4-4119-b62f-b51d62be23b6\Report.wer —
MD5:—
SHA256:—
3836WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Bawless.exe.732.dmp —
MD5:—
SHA256:—
3836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A3.tmp.dmpbinary
MD5:F2464F330D2FD9D63534DCF73A14FF50
SHA256:648638A4C57F32A6884DB0FEB60BF592457F0D098D4EB843B5554FAFA29930D4
3836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE3CE.tmp.xmlxml
MD5:80EAE51A8042B670CEF5B141FFA8A8B2
SHA256:CECBF69E7FEB760FCCFECA2D18996AE3B21098F9DCB7F6F7238D42AF4A67B080
3836WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
2672WinRAR.exeC:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\Bawless.exeexecutable
MD5:2FD36877F3C0F74CB98FDD041C06C5E2
SHA256:C39C732ACCFAFC55F30D9E6CD8352731D66752886C054D75811B1581739B22CD
5268WinRAR.exeC:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\ServerCertificate.p12binary
MD5:BC287F55B62CF3AC94BFD74CA6CBA679
SHA256:E64DA0484597A0A9547C4C9CC5047EAD686FB783C35502C026AD91069FA8034D
5268WinRAR.exeC:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\Guna.Charts.WinForms.dllexecutable
MD5:70FC3B097DBB077EF99490DA7BE6FC15
SHA256:09906A9154B088E3B86909ED960C961E874A07543D6EF44EE2A48142C4D5ADDE
3836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE39E.tmp.WERInternalMetadata.xmlxml
MD5:326BD9C461C18EF5715ED89F8C56102F
SHA256:1DBB1B9D43E40CFEC1F47262D3B0C7141958833BAE8C48E1941897A4FA1D48B4
5268WinRAR.exeC:\Users\admin\Desktop\Bawless Cracked By @Drcrypt0r\FontsInstaller.dllexecutable
MD5:5063ADA08270D629A051121A8ECB4160
SHA256:3C357E4D067D2C9322B6D4A4A691698913A76570982AF561C6C9438832F42CCC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
38
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3732
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2940
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3836
WerFault.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3836
WerFault.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.138:443
www.bing.com
Akamai International B.V.
DE
whitelisted
3220
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
736
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.204.138
  • 2.16.204.135
  • 2.16.204.151
  • 2.16.204.156
  • 2.16.204.159
  • 2.16.204.136
  • 2.16.204.157
  • 2.16.204.139
  • 2.16.204.161
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
google.com
  • 142.250.185.142
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.68
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.25
  • 2.16.164.97
  • 2.16.164.18
  • 2.16.164.99
  • 2.16.164.10
  • 2.16.164.89
  • 2.16.164.122
  • 2.16.164.114
  • 2.16.164.24
  • 23.32.238.107
  • 23.32.238.115
  • 23.32.238.153
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.37.237.227
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bawless Cracked By @Drcrypt0r.rar