File name:

Coffee.exe

Full analysis: https://app.any.run/tasks/20f10114-3ca7-47cf-b8f0-8a53b6432cc9
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: September 03, 2024, 20:23:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

961D8E0F1EC3C196499BFCBD0A9D19FA

SHA1:

88B7F13C633260A463127CE2BA6FBE38137E856A

SHA256:

CD903AD2211CF7D166646D75E57FB866000F4A3B870B5EC759929BE2FD81D334

SSDEEP:

1536:lSSKOND79CKF6BtJJQQpGbbXwxmPWEdpqKmY7:lSSKOh9CKStnppGbbXsmlGz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (YARA)

      • Coffee.exe (PID: 6836)

  • SUSPICIOUS

    • Connects to unusual port

      • Coffee.exe (PID: 6836)

  • INFO

    • Reads the machine GUID from the registry

      • Coffee.exe (PID: 6836)

    • Reads the computer name

      • Coffee.exe (PID: 6836)

    • Checks supported languages

      • Coffee.exe (PID: 6836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(6836) Coffee.exe
C2 (2)127.0.0.1
37.120.233.226
Ports (1)3451
Version5.0.5
Options
AutoRunfalse
MutexVenom_RAT_HVNC_Mutex_Venom RAT_HVNC
InstallFolder%AppData%
Certificates
Cert1MIICMzCCAZygAwIBAgIVALgbuadTIXCBGx92qk2Pt658vf8pMA0GCSqGSIb3DQEBDQUAMGcxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDExMjE3MzIzNloXDTMxMTAyMjE3MzIzNlowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQAD...
Server_SignatureIwB9RQlC32flq6ryLZGmcBhfBvBv6adjX+KlL9ziSaI3Ye9BjCJ71bRwShMCqyzwsQpdspcyU88ympvjbg2sZWnpq1yhzpWxRG3fc5myHUbezWYj3E0A0scAQ9YyyGlTWVd2Xbl53wJsxIM0rRYb9SvW7EMLrX3xoDwTu4hV7sc=
Keys
AES01c73307c503018919ee4e2d4764a596b802bd2eaa5733460aae4482afbe0f34
SaltVenomByVenom
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:02 11:47:30+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 59904
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x109be
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.546
ProductVersionNumber: 10.0.19041.546
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation.
FileDescription: COM Surrogate
FileVersion: 10.0.19041.546
InternalName: dllhost.exe
LegalCopyright: Microsoft Corporation. All rights reserved.
LegalTrademarks: Microsoft Corporation. All rights reserved.
OriginalFileName: dllhost.exe
ProductName: Microsoft®Windows®Operating System
ProductVersion: 10.0.19041.546
AssemblyVersion: 10.0.19041.546
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT coffee.exe

Process information

PID
CMD
Path
Indicators
Parent process
6836"C:\Users\admin\AppData\Local\Temp\Coffee.exe" C:\Users\admin\AppData\Local\Temp\Coffee.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation.
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.546
Modules
Images
c:\users\admin\appdata\local\temp\coffee.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(6836) Coffee.exe
C2 (2)127.0.0.1
37.120.233.226
Ports (1)3451
Version5.0.5
Options
AutoRunfalse
MutexVenom_RAT_HVNC_Mutex_Venom RAT_HVNC
InstallFolder%AppData%
Certificates
Cert1MIICMzCCAZygAwIBAgIVALgbuadTIXCBGx92qk2Pt658vf8pMA0GCSqGSIb3DQEBDQUAMGcxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDExMjE3MzIzNloXDTMxMTAyMjE3MzIzNlowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQAD...
Server_SignatureIwB9RQlC32flq6ryLZGmcBhfBvBv6adjX+KlL9ziSaI3Ye9BjCJ71bRwShMCqyzwsQpdspcyU88ympvjbg2sZWnpq1yhzpWxRG3fc5myHUbezWYj3E0A0scAQ9YyyGlTWVd2Xbl53wJsxIM0rRYb9SvW7EMLrX3xoDwTu4hV7sc=
Keys
AES01c73307c503018919ee4e2d4764a596b802bd2eaa5733460aae4482afbe0f34
SaltVenomByVenom
Total events
474
Read events
474
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
48
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5816
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6308
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6308
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2400
svchost.exe
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2120
MoUsoCoreWorker.exe
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4324
svchost.exe
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.182:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5816
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.185.211.133
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.110
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
www.bing.com
  • 2.23.209.182
  • 2.23.209.173
  • 2.23.209.178
  • 2.23.209.183
  • 2.23.209.176
  • 2.23.209.189
  • 2.23.209.188
  • 2.23.209.187
  • 2.23.209.186
whitelisted
r.bing.com
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.186
  • 2.23.209.183
  • 2.23.209.188
  • 2.23.209.178
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.192
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.76
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 2.23.209.182
  • 2.23.209.186
  • 2.23.209.176
  • 2.23.209.168
  • 2.23.209.187
  • 2.23.209.171
  • 2.23.209.178
  • 2.23.209.173
  • 2.23.209.183
whitelisted
browser.pipe.aria.microsoft.com
  • 13.89.179.14
  • 52.182.143.213
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Coffee.exe