| File name: | wow.exe |
| Full analysis: | https://app.any.run/tasks/c27e83ca-b78d-46b4-8a7c-2e193dd21d09 |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | December 17, 2024, 20:21:49 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (console) x86-64, for MS Windows, 6 sections |
| MD5: | B2C17E4AAA1AB07E2BE2C6E08120C7FE |
| SHA1: | 67EB0FBAFB9D75D7E95DC8429C09A99E73ED5C74 |
| SHA256: | D6427E58DFA1A8BFB69F510D4C3806C36CBB7FCFAC82984CAFCD2FF539631F0D |
| SSDEEP: | 196608:+7C92OaZ2NtTeRi/BqyndOugBe0vGEmop:lnNtKRi5qEOfCw |
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:12:17 20:15:46+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.41 |
| CodeSize: | 176640 |
| InitializedDataSize: | 152576 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xc380 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1016 | "C:\Users\admin\AppData\Roaming\18arge9.exe" | C:\Users\admin\AppData\Roaming\18arge9.exe | powershell.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1140 | "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer | C:\Windows\System32\GameBarPresenceWriter.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Gamebar Presence Writer Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1740 | findstr TCP | C:\Windows\System32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2132 | sc delete npf | C:\Windows\System32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Service Control Manager Configuration Tool Exit code: 1060 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2736 | cmd.exe /c start C:\Users\admin\AppData\Local\Temp\tilhai\ksoftriqd.exe | C:\Windows\System32\cmd.exe | — | 18arge9.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3224 | "C:\WINDOWS\system32\schtasks.exe" /create /F /sc minute /mo 1 /tn BrowserUpdate /tr C:\Users\admin\AppData\Roaming\18arge9.exe | C:\Windows\System32\schtasks.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3848 | "C:\WINDOWS\system32\findstr.exe" TCP | C:\Windows\System32\findstr.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4024 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 18arge9.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4052 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass "C:\Users\admin\Downloads\haus\ldr.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wow.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionMajor |
Value: 02002F76BB5DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionMinor |
Value: 22002F76BB5DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionBuild |
Value: 616D2F76BB5DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionRevision |
Value: 00002F76BB5DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | PreviousAppTerminationFromSuspended |
Value: 002F76BB5DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | CurrentDisplayMonitor |
Value: 670061006D00650000002640C05DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | StartupTipIndex |
Value: 01000000000000002F57C75DC150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionMajor |
Value: 0200432D9F62C150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionMinor |
Value: 2200432D9F62C150DB01 | |||
| (PID) Process: | (6520) GameBar.exe | Key: | \REGISTRY\A\{74ef0290-bcfc-7af0-dfff-2c1d22c02d03}\LocalState |
| Operation: | write | Name: | InstalledVersionBuild |
Value: 616D432D9F62C150DB01 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\VCRUNTIME140.dll | executable | |
MD5:F12681A472B9DD04A812E16096514974 | SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8 | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_asyncio.pyd | executable | |
MD5:2859C39887921DAD2FF41FEDA44FE174 | SHA256:AEBC378DB08617EA81A0A3A3BC044BCC7E6303E314630392DD51BAB12F879BD9 | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_cffi_backend.cp311-win_amd64.pyd | executable | |
MD5:739D352BD982ED3957D376A9237C9248 | SHA256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980 | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\VCRUNTIME140_1.dll | executable | |
MD5:75E78E4BF561031D39F86143753400FF | SHA256:1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_ctypes.pyd | executable | |
MD5:6A9CA97C039D9BBB7ABF40B53C851198 | SHA256:E662D2B35BB48C5F3432BDE79C0D20313238AF800968BA0FAA6EA7E7E5EF4535 | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_hashlib.pyd | executable | |
MD5:DE4D104EA13B70C093B07219D2EFF6CB | SHA256:39BC615842A176DB72D4E0558F3CDCAE23AB0623AD132F815D21DCFBFD4B110E | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_bz2.pyd | executable | |
MD5:4101128E19134A4733028CFAAFC2F3BB | SHA256:5843872D5E2B08F138A71FE9BA94813AFEE59C8B48166D4A8EB0F606107A7E80 | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_brotli.cp311-win_amd64.pyd | executable | |
MD5:D9FC15CAF72E5D7F9A09B675E309F71D | SHA256:1FCD75B03673904D9471EC03C0EF26978D25135A2026020E679174BDEF976DCF | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_lzma.pyd | executable | |
MD5:337B0E65A856568778E25660F77BC80A | SHA256:613DE58E4A9A80EFF8F8BC45C350A6EAEBF89F85FFD2D7E3B0B266BF0888A60A | |||
| 6388 | wow.exe | C:\Users\admin\AppData\Local\Temp\_MEI63882\_decimal.pyd | executable | |
MD5:D47E6ACF09EAD5774D5B471AB3AB96FF | SHA256:D0DF57988A74ACD50B2D261E8B5F2C25DA7B940EC2AAFBEE444C277552421E6E | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 184.24.77.24:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6808 | wow.exe | GET | — | 31.41.244.11:80 | http://31.41.244.11/files/6989783370/8oMoEDZ.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | 200 | 104.168.101.23:1234 | http://104.168.101.23:1234/windows/ph.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | — | 31.41.244.11:80 | http://31.41.244.11/files/6546212505/ON7ZDqr.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | — | 193.143.1.180:80 | http://193.143.1.180/download/av.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | — | 31.41.244.11:80 | http://31.41.244.11/files/6989783370/AwT7h8g.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | — | 193.143.1.180:80 | http://193.143.1.180/download/GOLD.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | — | 104.168.101.23:1234 | http://104.168.101.23:1234/windows/net.exe | unknown | — | — | unknown |
6808 | wow.exe | GET | — | 92.127.156.174:8880 | http://92.127.156.174:8880/master.exe | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 184.24.77.24:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6808 | wow.exe | 151.101.2.49:443 | urlhaus.abuse.ch | FASTLY | US | whitelisted |
6808 | wow.exe | 31.41.244.11:80 | — | Red Bytes LLC | RU | unknown |
6808 | wow.exe | 193.143.1.180:80 | — | LLC Baxet | RU | unknown |
6808 | wow.exe | 192.3.179.166:443 | — | AS-COLOCROSSING | US | unknown |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
urlhaus.abuse.ch |
| whitelisted |
github.com |
| shared |
raw.githubusercontent.com |
| shared |
e4l4.com |
| malicious |
hardcore-cartwright.194-26-192-76.plesk.page |
| unknown |
lsks.volamngayxua.net |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
6808 | wow.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |
6808 | wow.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 2 |
6808 | wow.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 14 |
6808 | wow.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
6808 | wow.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6808 | wow.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
6808 | wow.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
6808 | wow.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
6808 | wow.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |