File name:

c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652

Full analysis: https://app.any.run/tasks/0c3f5178-1e3a-477a-9289-1164b242c3ef
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 19:22:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

489D68109D6B37FE0568B10DE6FCE488

SHA1:

07058F67DF9BC1733EAC67D4744C596EC3CB682B

SHA256:

C5A8CE7B514A38C567F2E8B606E7CA4F1B49BA9846E685FC409FB997C61EA652

SSDEEP:

3072:3qZkKHtk8U7bkWoOelYxtfXxI2HQlsUIKl:3qZk4G82b1oOJBIGeBp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8104)
      • cmd.exe (PID: 904)

    • ASYNCRAT has been detected (YARA)

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 8028)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 8188)

    • Application launched itself

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 7608)
      • SandboxiePlusx86.exe (PID: 1452)

    • Starts CMD.EXE for commands execution

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 7608)
      • SandboxiePlusx86.exe (PID: 1452)

    • The process executes via Task Scheduler

      • SandboxiePlusx86.exe (PID: 1452)
      • SandboxiePlusx86.exe (PID: 5960)

    • Connects to unusual port

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 8028)

  • INFO

    • Reads the machine GUID from the registry

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 7608)
      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 8028)
      • SandboxiePlusx86.exe (PID: 7228)
      • SandboxiePlusx86.exe (PID: 5960)
      • SandboxiePlusx86.exe (PID: 1452)

    • Reads the computer name

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 7608)
      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 8028)
      • SandboxiePlusx86.exe (PID: 7228)
      • SandboxiePlusx86.exe (PID: 5960)
      • SandboxiePlusx86.exe (PID: 1452)

    • Checks supported languages

      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 7608)
      • c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe (PID: 8028)
      • SandboxiePlusx86.exe (PID: 7228)
      • SandboxiePlusx86.exe (PID: 5960)
      • SandboxiePlusx86.exe (PID: 1452)

    • Creates a new folder

      • cmd.exe (PID: 8044)
      • cmd.exe (PID: 5968)

    • Reads the software policy settings

      • slui.exe (PID: 7324)

    • Checks proxy server information

      • slui.exe (PID: 7324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(8028) c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe
C2 (1)px01nathan.duckdns.org
Ports (1)7784
Version| CRACKED BY https://t.me/xworm_v2
Options
AutoRunfalse
MutexW&#5432$%&"2345T43qd@
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAI9M6XfrJndUWO4pmJKlUTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMwNTI1MDUxOTUxWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKEnOhTEaqfj+VWw4xZWun0+cBhi2VwZcjq63ImsrzZAKnNWDOOezfjNETAj5yvUn1d6IsWsePIw...
Server_SignatureHUKaosWu6pdd0PKGuUHeKjEGGXOFnwNs/Ja+u74oP26MKf5ivflb/l/QPllmZOAJ4iCieYtnwX0HJAFYrTMXl9rm2T9iah0xcYDYz1fJmoXQTvISD+I6ZcCZeYBfpkPXCvn+QgF6L7n7hDzNUL+H3dgAPAssBctG5MoiXUyfAorR89O4MtI4kl5RTfitiTEdyPoOVd8u1dmxWim5OmRdKlVCRgFAtIt3ai7KNr0ONPjr4q2fLNj7wYz6xEoJF2xz8GAf0Kas8/Zvae0gn5TxfHDf/8JT47ibZylKC2lcigZi...
Keys
AESe559cc29e2328b175e7e01f321349e01e954d3978f0ad0f15cfd12c1ed26f9bb
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:14 14:43:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 118272
InitializedDataSize: 72704
UninitializedDataSize: -
EntryPoint: 0x1ece6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.14.10.0
ProductVersionNumber: 1.14.10.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: German (Austrian)
CharacterSet: Unicode
CompanyName: sandboxie-plus.com
FileDescription: Sandboxie Manager
FileVersion: 1.14.10
InternalName: SandMan.exe
LegalCopyright: Copyright (C) 2020-2024 by David Xanatos (xanasoft.com)
OriginalFileName: SandMan.exe
ProductName: Sandboxie-Plus
ProductVersion: 1.14.10
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
21
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe no specs #ASYNCRAT c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe conhost.exe no specs svchost.exe slui.exe sandboxieplusx86.exe no specs sandboxieplusx86.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs sandboxieplusx86.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe'" /fC:\Windows\SysWOW64\cmd.exe—SandboxiePlusx86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe"C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe—svchost.exe
User:
admin
Company:
sandboxie-plus.com
Integrity Level:
MEDIUM
Description:
Sandboxie Manager
Exit code:
4294967295
Version:
1.14.10
Modules
Images
c:\users\admin\appdata\roaming\sandboxieplusx86\sandboxieplusx86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2108\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3888"cmd.exe" /C copy "C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe" "C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe"C:\Windows\SysWOW64\cmd.exe—SandboxiePlusx86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4608schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe'" /fC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5216\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5960"C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe"C:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exe—svchost.exe
User:
admin
Company:
sandboxie-plus.com
Integrity Level:
MEDIUM
Description:
Sandboxie Manager
Version:
1.14.10
Modules
Images
c:\users\admin\appdata\roaming\sandboxieplusx86\sandboxieplusx86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
4 307
Read events
4 307
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
8188cmd.exeC:\Users\admin\AppData\Roaming\SandboxiePlusx86\SandboxiePlusx86.exeexecutable
MD5:489D68109D6B37FE0568B10DE6FCE488
SHA256:C5A8CE7B514A38C567F2E8B606E7CA4F1B49BA9846E685FC409FB997C61EA652
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
20
DNS requests
8
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
8028
c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652.exe
190.165.81.87:7784
px01nathan.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
unknown
7404
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7324
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
px01nathan.duckdns.org
  • 190.165.81.87
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c5a8ce7b514a38c567f2e8b606e7ca4f1b49ba9846e685fc409fb997c61ea652