File name:

HiPatchService.exe

Full analysis: https://app.any.run/tasks/1c3ab893-f908-49fd-9b50-78471862b475
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: September 17, 2024, 13:18:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

6970AB30BF0F5A74E06C951EAFD0FFE8

SHA1:

7D45C3695789828F3DBD8F16301D78E8C50E552D

SHA256:

E44FBABA33D5A2E8E90DEF68C97ABFBC740D2792669EEC2011A6EB6D18C48A27

SSDEEP:

3072:U4WQwaDX3lSlXSTNOdgR7mNfyEc/3SkyxV7MqAYFBdKqLl/FqUhJ4p+v:U4VwWX3AIOdgwhiKkyrndK2dqUhJ4p+v

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (YARA)

      • RegAsm.exe (PID: 7036)

  • SUSPICIOUS

    • Starts itself from another location

      • HiPatchService.exe (PID: 4236)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2256)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(7036) RegAsm.exe
C2 (1)corporation.warzonedns.com
Ports (1)9341
Version0.4.9G
BotnetNewj
Options
AutoRunfalse
Mutex480-28105c055659
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE+DCCAuCgAwIBAgIQAPNFlH8tlGzUrldx/RPOfTANBgkqhkiG9w0BAQ0FADAdMRswGQYDVQQDDBJBc3luY1JBVCBTZXJ2ZXIgQ0EwIBcNMTkwNjAzMTc1ODI0WhgPOTk5OTEyMzEyMzU5NTlaMB0xGzAZBgNVBAMMEkFzeW5jUkFUIFNlcnZlciBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMwjcrGzM5qdt3vi+X+HInUR/3wqlDNbYCwKzBevCPBcDZ7C8I+oQUn1KHvssIISnZNm...
Server_SignaturejUH/q1ELXf1yW1ggdQ7a47JORxb8YVC+n0bNLozveSyrrs2g7oJj+rSjmqmpKsNhPswQfCh7faQeSc1iLPxJG+Wp2NXN63SJZwDOh7anju5nX4GleNaT3/UTygVps7pV8zDeoGtYidTaVNFt4xXGsVdUw0HrmsJDNT/hU4DRpXbuGeQYIEKjIyfc9D6CN5G7j4WUC6T6ixN5Gio23OM5sI2ibXFCveJJ6y4AgBuvqTLnF0JDxU95csopp0jcvytdn7kUKNxAPa018FjX5UU1TDCl/Ty1HuQzazG4tHcYVNZW...
Keys
AES3e6da243638bbdc19657b329e82a6bcdf57b79c192e5db5195d779ff2e5978ff
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:08:08 00:16:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 161792
InitializedDataSize: 102400
UninitializedDataSize: -
EntryPoint: 0x2970e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.1.6.3
ProductVersionNumber: 5.1.6.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: HiPatchService
CompanyName: Hi-Rez Studios
FileDescription: HiPatchService.exe
FileVersion: 5.1.6.3.
InternalName: Squirt.exe
LegalCopyright: Copyright © Hi-Rez Studios 2011
LegalTrademarks: Copyright © Hi-Rez Studios 2011
OriginalFileName: Squirt.exe
ProductName: HiPatchService
ProductVersion: 5.1.6.3.
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hipatchservice.exe hipatchservice.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT regasm.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1564C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\HiPatch\HiPatchService.bat""C:\Windows\SysWOW64\cmd.exe—HiPatchService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2824"C:\Users\admin\AppData\Roaming\HiPatch\HiPatchService.exe" C:\Users\admin\AppData\Roaming\HiPatch\HiPatchService.exe—HiPatchService.exe
User:
admin
Company:
Hi-Rez Studios
Integrity Level:
MEDIUM
Description:
HiPatchService.exe
Exit code:
0
Version:
5.1.6.3.
Modules
Images
c:\users\admin\appdata\roaming\hipatch\hipatchservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4236"C:\Users\admin\Desktop\HiPatchService.exe" C:\Users\admin\Desktop\HiPatchService.exe
explorer.exe
User:
admin
Company:
Hi-Rez Studios
Integrity Level:
MEDIUM
Description:
HiPatchService.exe
Exit code:
0
Version:
5.1.6.3.
Modules
Images
c:\users\admin\desktop\hipatchservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6908\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7036"C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
HiPatchService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(7036) RegAsm.exe
C2 (1)corporation.warzonedns.com
Ports (1)9341
Version0.4.9G
BotnetNewj
Options
AutoRunfalse
Mutex480-28105c055659
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE+DCCAuCgAwIBAgIQAPNFlH8tlGzUrldx/RPOfTANBgkqhkiG9w0BAQ0FADAdMRswGQYDVQQDDBJBc3luY1JBVCBTZXJ2ZXIgQ0EwIBcNMTkwNjAzMTc1ODI0WhgPOTk5OTEyMzEyMzU5NTlaMB0xGzAZBgNVBAMMEkFzeW5jUkFUIFNlcnZlciBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMwjcrGzM5qdt3vi+X+HInUR/3wqlDNbYCwKzBevCPBcDZ7C8I+oQUn1KHvssIISnZNm...
Server_SignaturejUH/q1ELXf1yW1ggdQ7a47JORxb8YVC+n0bNLozveSyrrs2g7oJj+rSjmqmpKsNhPswQfCh7faQeSc1iLPxJG+Wp2NXN63SJZwDOh7anju5nX4GleNaT3/UTygVps7pV8zDeoGtYidTaVNFt4xXGsVdUw0HrmsJDNT/hU4DRpXbuGeQYIEKjIyfc9D6CN5G7j4WUC6T6ixN5Gio23OM5sI2ibXFCveJJ6y4AgBuvqTLnF0JDxU95csopp0jcvytdn7kUKNxAPa018FjX5UU1TDCl/Ty1HuQzazG4tHcYVNZW...
Keys
AES3e6da243638bbdc19657b329e82a6bcdf57b79c192e5db5195d779ff2e5978ff
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
7108timeout /t 180C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
745
Read events
743
Write events
2
Delete events
0

Modification events

(PID) Process:(4236) HiPatchService.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HiPatch
Value:
C:\Users\admin\AppData\Roaming\HiPatch\HiPatchService.exe
(PID) Process:(4236) HiPatchService.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4236HiPatchService.exeC:\Users\admin\AppData\Roaming\HiPatch\HiPatchService.exebinary
MD5:1009D59C3F9523E1DE4AFB97E0477EC8
SHA256:9ADFF89E613D6ACDA86396659F33DF4E63B201B95AFDE11A47847B874ED543E5
4236HiPatchService.exeC:\Users\admin\AppData\Roaming\HiPatch\HiPatchService.battext
MD5:54E72853A8CEA99EE118D3FDB49AA2B7
SHA256:3C130F4A2A49D63B36899015F1D3A169AFD32B2F1D5F199052890F49A6AD8404
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
17
DNS requests
27
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6344
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2968
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6344
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6496
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6344
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2968
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
corporation.warzonedns.com
  • —
unknown
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted

Threats

Found threats are available for the paid subscriptions
22 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HiPatchService.exe