Click to jump to signature section
Source: 00000003.00000002.4128824097.00000000034A1000.00000004.00000800.00020000.00000000.sdmp | Malware Configuration Extractor: AsyncRAT {"Server": "pepecasas123.net", "Port": "4608", "Version": "AsyncRAT", "MutexName": "AsyncMutex_5952", "Autorun": "false", "Group": "true"} |
Source: Submited Sample | Integrated Neural Analysis Model: Matched 85.1% probability |
Source: Yara match | File source: 00000000.00000002.1881870338.000001EA5CE6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: sWXyzk4Kv3.exe PID: 7400, type: MEMORYSTR |
Source: sWXyzk4Kv3.exe | Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: | Binary string: \??\C:\Users\user\Desktop\sWXyzk4Kv3.PDB source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbA3C5B7 ByRef) source: sWXyzk4Kv3.exe, 00000000.00000002.1880731857.000001EA5B1DC000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: \??\C:\Windows\dll\mscorlib.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Windows.Forms.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbf source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Drawing.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: Yassembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880318480.00000059BD733000.00000004.00000010.00020000.00000000.sdmp |
Source: | Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32P source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880731857.000001EA5B25A000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: 0C:\Windows\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880318480.00000059BD733000.00000004.00000010.00020000.00000000.sdmp |
Source: | Binary string: System.Drawing.ni.pdbRSDS source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880731857.000001EA5B25A000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Xml.ni.pdbRSDS# source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Core.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: Microsoft.VisualBasic.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Windows.Forms.ni.pdbRSDS source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: mscorlib.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Xml.pdbSystem.Configuration.ni.dll source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\mscorlib.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76D90000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: mscorlib.pdbP source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Configuration.ni.pdbRSDScUN source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\symbols\dll\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: symbols\dll\System.pdb.pdbt source: sWXyzk4Kv3.exe, 00000000.00000002.1880318480.00000059BD733000.00000004.00000010.00020000.00000000.sdmp |
Source: | Binary string: Microsoft.VisualBasic.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Xml.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\System.pdbk source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76D90000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: C:\Windows\System.pdbpdbtem.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.ni.pdbRSDS source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Configuration.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: Microsoft.VisualBasic.pdbH source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Configuration.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76D90000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Xml.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp, WERF26.tmp.dmp.6.dr |
Source: | Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880731857.000001EA5B1DC000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.Windows.Forms.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb0'n source: sWXyzk4Kv3.exe, 00000000.00000002.1880731857.000001EA5B1DC000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: \??\C:\Windows\dll\System.pdbB7 ByRef)' source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: System.pdbA source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: \??\C:\Windows\dll\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: mscorlib.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Drawing.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Core.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbc source: sWXyzk4Kv3.exe, 00000000.00000002.1886228408.000001EA76DA7000.00000004.00000020.00020000.00000000.sdmp |
Source: | Binary string: YindoC:\Windows\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880318480.00000059BD733000.00000004.00000010.00020000.00000000.sdmp |
Source: | Binary string: System.pdbSystem.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: sWXyzk4Kv3.exe, 00000000.00000002.1880318480.00000059BD733000.00000004.00000010.00020000.00000000.sdmp |
Source: | Binary string: System.Configuration.pdbP source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.ni.pdb source: WERF26.tmp.dmp.6.dr |
Source: | Binary string: System.Core.ni.pdbRSDS source: WERF26.tmp.dmp.6.dr |
Source: Traffic | Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 195.10.205.90:4608 -> 192.168.2.4:49741 |
Source: Traffic | Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 195.10.205.90:4608 -> 192.168.2.4:49741 |
Source: Malware configuration extractor | URLs: pepecasas123.net |
Source: Yara match | File source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.raw.unpack, type: UNPACKEDPE |
Source: global traffic | TCP traffic: 192.168.2.4:49741 -> 195.10.205.90:4608 |
Source: Joe Sandbox View | ASN Name: TSSCOM-ASRU TSSCOM-ASRU |
Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: global traffic | DNS traffic detected: DNS query: pepecasas123.net |
Source: sWXyzk4Kv3.exe | String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t |
Source: sWXyzk4Kv3.exe | String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# |
Source: CasPol.exe, 00000003.00000002.4127702737.00000000012C3000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en |
Source: CasPol.exe, 00000003.00000002.4128031325.0000000001304000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
Source: sWXyzk4Kv3.exe | String found in binary or memory: http://ocsp.sectigo.com0 |
Source: CasPol.exe, 00000003.00000002.4128824097.00000000034A1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Amcache.hve.6.dr | String found in binary or memory: http://upx.sf.net |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.carterandcone.coml |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/? |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers8 |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers? |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designersG |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fonts.com |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.founder.com.cn/cn |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.founder.com.cn/cn/bThe |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.founder.com.cn/cn/cThe |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.galapagosdesign.com/DPlease |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.goodfont.co.kr |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.jiyu-kobo.co.jp/ |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.sajatypeworks.com |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.sakkal.com |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.sandoll.co.kr |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.tiro.com |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.typography.netD |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.urwpp.deDPlease |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1885555518.000001EA768B2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.zhongyicts.com.cn |
Source: sWXyzk4Kv3.exe | String found in binary or memory: https://sectigo.com/CPS0 |
Source: Yara match | File source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000003.00000002.4128824097.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.4127542990.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.1881870338.000001EA5CE6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: sWXyzk4Kv3.exe PID: 7400, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: CasPol.exe PID: 7668, type: MEMORYSTR |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.raw.unpack, LimeLogger.cs | .Net Code: KeyboardLayout |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.raw.unpack, LimeLogger.cs | .Net Code: KeyboardLayout |
Source: dump.pcap, type: PCAP | Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.unpack, type: UNPACKEDPE | Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen |
Source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown |
Source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.unpack, type: UNPACKEDPE | Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown |
Source: 00000003.00000002.4128824097.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000003.00000002.4127702737.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000003.00000002.4127542990.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen |
Source: 00000003.00000002.4128031325.0000000001304000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000000.00000002.1881870338.000001EA5CE6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown |
Source: Process Memory Space: sWXyzk4Kv3.exe PID: 7400, type: MEMORYSTR | Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen |
Source: Process Memory Space: CasPol.exe PID: 7668, type: MEMORYSTR | Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen |
Source: Process Memory Space: CasPol.exe PID: 7668, type: MEMORYSTR | Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: C:\Users\user\Desktop\sWXyzk4Kv3.exe | Code function: 0_2_00007FFD9B8BDC39 | 0_2_00007FFD9B8BDC39 |
Source: C:\Users\user\Desktop\sWXyzk4Kv3.exe | Code function: 0_2_00007FFD9B8C1059 | 0_2_00007FFD9B8C1059 |
Source: C:\Users\user\Desktop\sWXyzk4Kv3.exe | Code function: 0_2_00007FFD9B8BAAB0 | 0_2_00007FFD9B8BAAB0 |
Source: C:\Users\user\Desktop\sWXyzk4Kv3.exe | Code function: 0_2_00007FFD9B9A026B | 0_2_00007FFD9B9A026B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 3_2_0174E328 | 3_2_0174E328 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 3_2_0749DAD8 | 3_2_0749DAD8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 3_2_074910B0 | 3_2_074910B0 |
Source: C:\Users\user\Desktop\sWXyzk4Kv3.exe | Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7400 -s 1172 |
Source: sWXyzk4Kv3.exe | Static PE information: invalid certificate |
Source: sWXyzk4Kv3.exe | Static PE information: No import functions for PE file found |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1882677655.000001EA6D0DF000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameAxeyabubuv4 vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1881534233.000001EA5B430000.00000004.08000000.00040000.00000000.sdmp | Binary or memory string: OriginalFilenameNativeMethods.dll" vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe, 00000000.00000000.1674436883.000001EA5B042000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenameNativeMethods.dll" vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe, 00000000.00000000.1674436883.000001EA5B042000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenameAperulirebuyeyiderecJ vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1881870338.000001EA5CE6D000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameStub.exe" vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe, 00000000.00000002.1884804463.000001EA75630000.00000004.08000000.00040000.00000000.sdmp | Binary or memory string: OriginalFilenameAxeyabubuv4 vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe | Binary or memory string: OriginalFilenameNativeMethods.dll" vs sWXyzk4Kv3.exe |
Source: sWXyzk4Kv3.exe | Binary or memory string: OriginalFilenameAperulirebuyeyiderecJ vs sWXyzk4Kv3.exe |
Source: dump.pcap, type: PCAP | Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04 |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys |
Source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04 |
Source: 3.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04 |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04 |
Source: 0.2.sWXyzk4Kv3.exe.1ea5cebeed0.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04 |
Source: 00000003.00000002.4128824097.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000003.00000002.4127702737.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000003.00000002.4127542990.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys |
Source: 00000003.00000002.4128031325.0000000001304000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000000.00000002.1881870338.000001EA5CE6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04 |
Source: Process Memory Space: sWXyzk4Kv3.exe PID: 7400, type: MEMORYSTR | Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys |
Source: Process Memory Space: CasPol.exe PID: 7668, type: MEMORYSTR | Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys |
Source: Process Memory Space: CasPol.exe PID: 7668, type: MEMORYSTR | Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0.2.sWXyzk4Kv3.exe.1ea5ceaf890.2.raw.unpack, Settings.cs | Base64 encoded string: 'Q61GNjFrAhhWihFEKRHD3Jy/ruxSUUDwSYbmuAMFMeEWgWrPS09dcyAEGP3CD/apzeigN8NGmXNgXuoW/jPGOg==', 'Vnf6t1Or7dOLcMzJFAe68WPJlI1wMlcWqnIVMtCjJR11dc8T8nqf2HKUnFF0XtmsrkF5rNIOl5oqm+8RHQinhf/C4tjc01u/YtMWj4sOCw4=', 'nZFf12qOGL846xUbSD12+0JLsVnClxSXMliBKnOBRXosPzkJGxF+Rnx5M9YX+Va3lNbC3dopw//hgs6+t26oYA==', 'OPw3p/+Z2XjfKdZllBmVpDSgQXAMGAC0NbOhDuDrEBMT+T7Vus8FWR4S3FeJADE6Djfp4xFKxNRYWpNSq2TyFA==', '+G3vNo3uOLy4addorcQy5gXz9g8XCPBqfLsV4EXBV505qEXR8njI+wiPEgzResuS5LbxNCE2dwDVPs3mr9WUzKDkA3cyimSI0/h0mjLIrzhZuHWoEmuBktNZT1xXZcdoGGiD6yrfQcXNvD5kkZOm8Nbn/OfiQU2YQnzXaGHIOpljLkif6lq51XFqZ55VKnopPbo3HUBzM3eOz9YHJZPHKxN2EuhHVSVBbiJdZ4NiTgeIMTVRPP1Z64vRJ0HYZ9HZUZw4JZmUUhQTHyYIpMUawBMNONR8vVYVPOvi1hj3EABPYJR1cXPpblN28yn/DPMo7sYiA7Tgw1qlYN+MvvM7gnizvMT0hNKCwpJIJXiWsXbuHdmlZF6PvPBxUhAqRI5wHtrvOJEeJw+BR1SNFOyZbc1iYEdJlbk3YpOTojizQmaLD7Dsmli2Ta3gCr1o/Eiq37YOvGeZXcgiQCBZMLjhBaFZDCkLTGH0MejikLTl8Vst8UDMjmo4pRA6bqcc8OzIZ4WQbEuqpGpGX6wHzMeMtEeAzBWFuYBPCmo8axvJAxdryWW7lU6TGm/IfpSRzqlII7NxCPPHqsPbwQNr6qfjN8B5BVXlwRhqTy6AppuuCEtBHzFUQTcItbNsQo58DMPrlGvWm3AdzahcDYnVvk21sb6ucIu+wXudK0CIYecINdXfu9jwkBcGL8FiRsREuE2wwXd74LN4J3wc5E33rnNtNkvxia7Dx4LGv7Uq/d2BIGrbe7A7XTRT8NmkYefNqOLDtR0oibEyCx71XO7aovhusxen+fCQTy/FvuXwTkCX196k0ArqNpcHRHPAKML0tdqBYrb2M46WLGIijgrBSeO0aitfrfBrQbyhGvvSP5UeEZODO+qb2og3929BlbL3S4C4PFn2gmqvH1pq9eFUTv59v7XSx19zOWpWTEh08hH5kzvO1N9MMhRzttAYQDiHQGH4+haCvMm933l55ZU29XZ8aITFdScWjwXgmy7z8zundHV1MkdEw/e5IL1jJkenPsjNW3CBFZJvVkznTCzk9XKJUwgsKP/aoiMN8+Uot6KemEM3Dyjrz5Bh6JOJRfV1rwtCsbc+G/KqkMC4qf0LCnNOjfncUXe4DCprxy1qlAjj0eUJI0vVuHu4Gn/N0cmLs15RwDdjJJGMHqo16tT7cJHDP6K94XxuZnSAnf0QmoUrBqmSAz2TpqwO1vXw1y/wDl1f+GfkiubQyQYQON9vIbAED08FXc8WZ47y2rs5QTXvszYLU80sveJl+pT3cABvHg+0aW0/9ejyYh7sHrKyYuNkKqcT4w6UaRU8CRC/wFcEUGgLw/bXCoXTLEkNZtZR9Gx3TJMnt7Z+DuoXY8Hf2clv8roKJd4Bk9EnjxT8WUYXv4fclCrYAKcBVy48gMvA61zYMg/em90KaUhovkhEGJrO+/KPhAdFy/dE69tKQ4ZAP4FIStUu7Vhvzojf/ISPSz1o8OKgiXN4M41yCEepX3hr3vBWbABb/dWmPkedd8B76B4igzb240LLGcdQ9nvqbqHFcje7jrVuBkgo+uEoNhUfeS8Tkoks9AJTHZymjiE+oIoNEvs9w20yR7H4SEALV9/GWtzMpZXxXuXcopsO7QSDweEpYeGdCovVXRbw+U9jGwBzFHnqa6NFJqGAR/gC49ejjrVbdMrVPBXZdhNBrEVGvekNWTW5L7xqG420LBGGx2cFnQsupLd9+Ev1arRHkbB1eO7Sab0ZKOd+RRBqNBkF0IX7tkFxHSDPSPj2UkvTtpekVPDcgA7tShMBgNQgmGX7CJLnQNBQX/hr7HuR8HN5xge2D6SFGVmBjzTggmyxMDOWYs/UYzs2LL0CL2GHfOiCnJEn4RECH3gr3RkgavgbMhUW90SyM4C1OUrLNSESwJFZeyWEEn6tP/NpqzS+F4wx03noc8QdWDrFgccfrFvadTWDyVI0zeEv05fY8x+d3qLV0o9VwEWsc1kR94d6N8G6KJdCMePYtEc6DVHxGEe/ZDJ0q2/79nnnH6auqYuTsdJyxj0mgDQjD4Gz7SfWNiPFNps4XuPOWf9TfkYJxSu9lHgd7ZkxTtfIo |