Windows Analysis Report
ClientAny.exe

Source: Joe Sandbox View

ASN Name: HUGESERVER-NETWORKSUS HUGESERVER-NETWORKSUS

Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.84.229

Source: svchost.exe, 00000011.00000002.3714141011.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: svchost.exe, 00000011.00000002.3714141011.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.17.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000011.00000002.3714141011.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cd20a0bcf4b3a
Source: ClientAny.exe, 00000000.00000002.1277906302.000000000351C000.00000004.00000800.00020000.00000000.sdmp, ClientAny.exe, 00000000.00000002.1277906302.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.00000000036ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: Yara match	File source: ClientAny.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ClientAny.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: Yara match

File source: Process Memory Space: ClientAny.exe PID: 4472, type: MEMORYSTR

Source: ClientAny.exe, Keylogger.cs	.Net Code: KeyboardLayout
Source: svchost.exe.0.dr, Keylogger.cs	.Net Code: KeyboardLayout

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: 01 00 00 00	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: 00 00 00 00	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: 01 00 00 00	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: ClientAny.exe, type: SAMPLE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.ClientAny.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen

Source: C:\Users\user\Desktop\ClientAny.exe	Code function: 0_2_00007FFAACCC3D5E NtProtectVirtualMemory,	0_2_00007FFAACCC3D5E
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 16_2_00007FFAACCB3DBE NtProtectVirtualMemory,	16_2_00007FFAACCB3DBE
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 17_2_00007FFAACCB3DBE NtProtectVirtualMemory,	17_2_00007FFAACCB3DBE

Source: C:\Users\user\Desktop\ClientAny.exe	Code function: 0_2_00007FFAACCC3D5E	0_2_00007FFAACCC3D5E
Source: C:\Users\user\Desktop\ClientAny.exe	Code function: 0_2_00007FFAACCC0E70	0_2_00007FFAACCC0E70
Source: C:\Users\user\Desktop\ClientAny.exe	Code function: 0_2_00007FFAACCC0E5D	0_2_00007FFAACCC0E5D
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 16_2_00007FFAACCB0EA0	16_2_00007FFAACCB0EA0
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 16_2_00007FFAACCB3DBE	16_2_00007FFAACCB3DBE
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 17_2_00007FFAACCB0EA0	17_2_00007FFAACCB0EA0
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 17_2_00007FFAACCBA5CB	17_2_00007FFAACCBA5CB
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 17_2_00007FFAACCB3DBE	17_2_00007FFAACCB3DBE
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 17_2_00007FFAACCBB77B	17_2_00007FFAACCBB77B

Source: ClientAny.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.ClientAny.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI

Source: ClientAny.exe, Settings.cs	Base64 encoded string: 'uYwNeW8wXo0068fax2NmgJ2KWaT+OEZkupZxzyabgyx1h7IJXLDnjOF0kM6f5ykoG/kOwf1P41tz5BOJkqNQ6w==', 'QQbqz1ki/DYovZU+kYoj1aA97KEC4Ow3J2/Ubiz/bZlrp/kOIoy9iV4tvaB9c1+juuaRuv7OcF6EDj7s8igEuFZuv1LfT3OAEizmUNwYiGs=', 'qu8wvowzeE52vrSGu6tIBUVMnsjljQ9rTZynsenF6zhIlTOSA811NKdcAKNF3u1bzupfL8HzD4recATOMB7CIsvE2jEa+hJoUxarw+YvwXBvRHF5YHimQNPyCcay3BZS', 'rzRLvBmE8F/AAyEOp25WT/aZAQHcKdGFLPJ04dvncH8CpIhACNPVyBFE0AoGucjMw3/jiFrR0A3v0VWvyzBa0g==', 'g1++9857ASUHVKfF4lqKew23rD/ZswlDobMwp5CENUNJrsU55Uy64fMUpm39OQtsX7Rhma8dpBChNVcGTQSfuw==', 'Mg1eyZtG0UtqxBmkIAf0+9PWmHxwdheKV9hPn5h5PG67u2WpRtX8fq3GdQ9qQooIiA9hBj5xob0j80zRMbkhNzUaKqAJXDcpXES4Yl3KTRzbcnEcFBp9GJm5iaJ5KIjMngeLPOCJJ+dzDMykM2qykXq32Iez7F+UVaJUk3Ik9e4fr4+yjs5T1msVAtby/hj3tJrEnbizacUmv2k0mL8RDuWCbxh2hId/GALMbpQZnSgDmbl3C3anpzh+wK1VHi3cSzDeIq6bayzrf6FrHN2iYcwf2nV2Jozt6w33oLG4QgL80qfAOIrMtJT04sY0ByVrHQVIcV1pSt9ynoKBPTSaUYk/F/aFejuIy0Gy2twMQ08OyF6EUpoKe7C9go8PofyoTE0diI2nBOaxcGKMraHmwJJw7stVRra85p44qLEqGs91krDZ99zbZphZoOvedH1yc14GTWFjYHmVfPKSQQF0IPEm0j73lVlKVOQzesZ7q31nvHbVOyOFTSW5/r/dqkJ+e7KMog+FsZ3mS3/dnT3bMBbSUrnDwJeEvK8XPjWqqYkO4vdHyQZw+GoFecUbNrn4a9eKpN8XRifkfbxdWDjaS1l7JvOTadvXoB6GPg870xKQ8p/N6E7InIjeVz3MvYgSQ8u24GzXU9WKeWdPzG1hk2dVEKBmD7r2n9dwSj/GZDXI96T3f+E5i2mAoNUYm/LcA3Hj/V+5gCEmpqgnuMCUefHlhjd6uBfrMzQ57hEvFzFBc7LV4HpgptzTxHZJdJx8a1g8Mo0q/hnN6RjTrdMdlnS/rUZHc0qyfDgZcxy91mO1VIOfLHVJ5PsrkpFZDjYeLxhCpGI+pqadLUtzwYu+7hWcFsD4KBSZwHfIUuMxLcZXWUUODgaNK7dAOixJNbP5aOw64m7upwo51yH92iNSpACgnVSqKftDocNr7QZseVvLhrnN4OuguU0AMEjWfZeEEjLzGvJg1uZbptoYIlqLUIOCvY88H8itZhtQKmGtveZsn/vsVW0upHWHa2Ozf0p9F0pSnglCLr1/8ENgH+O2prVZYXtTGeuDISal0ol0iritVCIWlnBvbP0ClMqJEAG+', 'NzDFLHUblBOkuHk6s+n4xEUh97GKBT1NIy4L9JzgWgOWusOaBeHJhBwPpX09OneYESrr8gdlYxRmN20Z59INQg==', 'orfGCl1kjdrtxWL7gSWRtyooRLLVYaQKy0n3FiEJv3knkzoAT1/pH/AUNlQ/urqj1NmzGcx6HVGd+LA2Bx841g==', 'VlQ9bsTFoFtAP7RN4MidKiAetheBhN196k7nKTGA/Osga7p/V9ijgzh92jseBl2fHBEqhlM9chbbM8FTUTTLWg=='
Source: svchost.exe.0.dr, Settings.cs	Base64 encoded string: 'uYwNeW8wXo0068fax2NmgJ2KWaT+OEZkupZxzyabgyx1h7IJXLDnjOF0kM6f5ykoG/kOwf1P41tz5BOJkqNQ6w==', 'QQbqz1ki/DYovZU+kYoj1aA97KEC4Ow3J2/Ubiz/bZlrp/kOIoy9iV4tvaB9c1+juuaRuv7OcF6EDj7s8igEuFZuv1LfT3OAEizmUNwYiGs=', 'qu8wvowzeE52vrSGu6tIBUVMnsjljQ9rTZynsenF6zhIlTOSA811NKdcAKNF3u1bzupfL8HzD4recATOMB7CIsvE2jEa+hJoUxarw+YvwXBvRHF5YHimQNPyCcay3BZS', 'rzRLvBmE8F/AAyEOp25WT/aZAQHcKdGFLPJ04dvncH8CpIhACNPVyBFE0AoGucjMw3/jiFrR0A3v0VWvyzBa0g==', 'g1++9857ASUHVKfF4lqKew23rD/ZswlDobMwp5CENUNJrsU55Uy64fMUpm39OQtsX7Rhma8dpBChNVcGTQSfuw==', 'Mg1eyZtG0UtqxBmkIAf0+9PWmHxwdheKV9hPn5h5PG67u2WpRtX8fq3GdQ9qQooIiA9hBj5xob0j80zRMbkhNzUaKqAJXDcpXES4Yl3KTRzbcnEcFBp9GJm5iaJ5KIjMngeLPOCJJ+dzDMykM2qykXq32Iez7F+UVaJUk3Ik9e4fr4+yjs5T1msVAtby/hj3tJrEnbizacUmv2k0mL8RDuWCbxh2hId/GALMbpQZnSgDmbl3C3anpzh+wK1VHi3cSzDeIq6bayzrf6FrHN2iYcwf2nV2Jozt6w33oLG4QgL80qfAOIrMtJT04sY0ByVrHQVIcV1pSt9ynoKBPTSaUYk/F/aFejuIy0Gy2twMQ08OyF6EUpoKe7C9go8PofyoTE0diI2nBOaxcGKMraHmwJJw7stVRra85p44qLEqGs91krDZ99zbZphZoOvedH1yc14GTWFjYHmVfPKSQQF0IPEm0j73lVlKVOQzesZ7q31nvHbVOyOFTSW5/r/dqkJ+e7KMog+FsZ3mS3/dnT3bMBbSUrnDwJeEvK8XPjWqqYkO4vdHyQZw+GoFecUbNrn4a9eKpN8XRifkfbxdWDjaS1l7JvOTadvXoB6GPg870xKQ8p/N6E7InIjeVz3MvYgSQ8u24GzXU9WKeWdPzG1hk2dVEKBmD7r2n9dwSj/GZDXI96T3f+E5i2mAoNUYm/LcA3Hj/V+5gCEmpqgnuMCUefHlhjd6uBfrMzQ57hEvFzFBc7LV4HpgptzTxHZJdJx8a1g8Mo0q/hnN6RjTrdMdlnS/rUZHc0qyfDgZcxy91mO1VIOfLHVJ5PsrkpFZDjYeLxhCpGI+pqadLUtzwYu+7hWcFsD4KBSZwHfIUuMxLcZXWUUODgaNK7dAOixJNbP5aOw64m7upwo51yH92iNSpACgnVSqKftDocNr7QZseVvLhrnN4OuguU0AMEjWfZeEEjLzGvJg1uZbptoYIlqLUIOCvY88H8itZhtQKmGtveZsn/vsVW0upHWHa2Ozf0p9F0pSnglCLr1/8ENgH+O2prVZYXtTGeuDISal0ol0iritVCIWlnBvbP0ClMqJEAG+', 'NzDFLHUblBOkuHk6s+n4xEUh97GKBT1NIy4L9JzgWgOWusOaBeHJhBwPpX09OneYESrr8gdlYxRmN20Z59INQg==', 'orfGCl1kjdrtxWL7gSWRtyooRLLVYaQKy0n3FiEJv3knkzoAT1/pH/AUNlQ/urqj1NmzGcx6HVGd+LA2Bx841g==', 'VlQ9bsTFoFtAP7RN4MidKiAetheBhN196k7nKTGA/Osga7p/V9ijgzh92jseBl2fHBEqhlM9chbbM8FTUTTLWg=='

Source: svchost.exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svchost.exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ClientAny.exe, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: ClientAny.exe, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/8@0/1

Source: C:\Users\user\Desktop\ClientAny.exe

File created: C:\Users\user\AppData\Roaming\MyData

Source: C:\Users\user\AppData\Roaming\svchost.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\svchost.exe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03

Source: C:\Users\user\Desktop\ClientAny.exe

File created: C:\Users\user\AppData\Local\Temp\tmp73F0.tmp

Source: C:\Users\user\Desktop\ClientAny.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp73F0.tmp.bat""

Source: ClientAny.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ClientAny.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Users\user\Desktop\ClientAny.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\ClientAny.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: ClientAny.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\ClientAny.exe

File read: C:\Users\user\Desktop\ClientAny.exe

Source: unknown	Process created: C:\Users\user\Desktop\ClientAny.exe "C:\Users\user\Desktop\ClientAny.exe"
Source: C:\Users\user\Desktop\ClientAny.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ClientAny.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp73F0.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe C:\Users\user\AppData\Roaming\svchost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\Desktop\ClientAny.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp73F0.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: msdmo.dll	Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

.NET source code contains potential unpacker

Source: ClientAny.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ClientAny.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: ClientAny.exe, ClientSocket.cs	.Net Code: Invoke System.AppDomain.Load(byte[])
Source: svchost.exe.0.dr, ClientSocket.cs	.Net Code: Invoke System.AppDomain.Load(byte[])

Source: C:\Users\user\Desktop\ClientAny.exe	Code function: 0_2_00007FFAACCC00BD pushad ; iretd	0_2_00007FFAACCC00C1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 16_2_00007FFAACCB00BD pushad ; iretd	16_2_00007FFAACCB00C1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 17_2_00007FFAACCB00BD pushad ; iretd	17_2_00007FFAACCB00C1

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\ClientAny.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ClientAny.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Boot Survival

Source: Yara match	File source: ClientAny.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ClientAny.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: Yara match

File source: Process Memory Space: ClientAny.exe PID: 4472, type: MEMORYSTR

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'

Source: C:\Users\user\AppData\Roaming\svchost.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: Yara match	File source: ClientAny.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ClientAny.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: Yara match

File source: Process Memory Space: ClientAny.exe PID: 4472, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ClientAny.exe, svchost.exe.0.dr

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\ClientAny.exe	Memory allocated: 13F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Memory allocated: 1B0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 3100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1B100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1B2A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe	Window / User API: threadDelayed 6132			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Window / User API: threadDelayed 3702			Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe TID: 2412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 7688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 7844	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 7864	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ClientAny.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000011.00000002.3721841793.000000001BE00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@~
Source: svchost.exe, 00000011.00000002.3723487469.000000001D80A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3723582553.000000001D813000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\ClientAny.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\ClientAny.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\AppData\Roaming\svchost.exe

Network Connect: 2.58.84.229 80

.NET source code references suspicious native API functions

Source: ClientAny.exe, Keylogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: ClientAny.exe, DInvokeCore.cs	Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: ClientAny.exe, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)

Source: C:\Users\user\Desktop\ClientAny.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\ClientAny.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp73F0.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior

Source: svchost.exe, 00000011.00000002.3715653540.000000000332E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.000000000335E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.0000000003312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000011.00000002.3715653540.000000000332E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.000000000335E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.0000000003312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\ClientAny.exe	Queries volume information: C:\Users\user\Desktop\ClientAny.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ClientAny.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Source: Yara match	File source: ClientAny.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ClientAny.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Source: Yara match

File source: Process Memory Space: ClientAny.exe PID: 4472, type: MEMORYSTR

Source: ClientAny.exe, 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, ClientAny.exe, 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.0.dr	Binary or memory string: MSASCui.exe
Source: ClientAny.exe, 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, ClientAny.exe, 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.0.dr	Binary or memory string: procexp.exe
Source: ClientAny.exe, 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, ClientAny.exe, 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.0.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	3 Scheduled Task/Job	112 Process Injection	11 Masquerading	1 Input Capture	1 Query Registry	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Scheduled Task/Job	1 Scripting	3 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	112 Process Injection	NTDS	151 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	211 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ClientAny.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
ClientAny.exe	100%	Avira	HEUR/AGEN.1307453
ClientAny.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\svchost.exe	100%	Avira	HEUR/AGEN.1307453
C:\Users\user\AppData\Roaming\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\svchost.exe	81%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
windowsupdatebg.s.llnwi.net	87.248.205.0	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ClientAny.exe, 00000000.00000002.1277906302.000000000351C000.00000004.00000800.00020000.00000000.sdmp, ClientAny.exe, 00000000.00000002.1277906302.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3715653540.00000000036ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
2.58.84.229	unknown	Lithuania		25780	HUGESERVER-NETWORKSUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1463773
Start date and time:	2024-06-27 19:39:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ClientAny.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/8@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 10 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 87.248.205.0
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, time.windows.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ClientAny.exe

Simulations

Behavior and APIs

Time	Type	Description
13:40:11	API Interceptor	12004721x Sleep call for process: svchost.exe modified
19:40:04	Task Scheduler	Run new task: svchost path: "C:\Users\user\AppData\Roaming\svchost.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
windowsupdatebg.s.llnwi.net	InstallnSign3.3.6.zip	Get hash	malicious	Unknown	Browse	87.248.204.0
	http://blogairmasonwp.wpuserpowered.com	Get hash	malicious	Unknown	Browse	87.248.205.0
	https://pieuvowjuiywddjd.pages.dev#myemailis@nunja.biz	Get hash	malicious	HTMLPhisher	Browse	178.79.208.1
	CONFIRM BANK DETAILS.exe	Get hash	malicious	AgentTesla	Browse	87.248.202.1
	Our Order Inquiry N1120092018.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	87.248.205.0
	https://liteblue-usps-gov.com/	Get hash	malicious	Unknown	Browse	178.79.242.128
	http://www.services-nickel.yayra-food.com/	Get hash	malicious	Unknown	Browse	87.248.204.0
	http://pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.205.0
	https://worker2.kenneth-ho-yk.workers.dev/	Get hash	malicious	Unknown	Browse	95.140.236.0
	https://a.poigmj555.space	Get hash	malicious	Unknown	Browse	178.79.238.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HUGESERVER-NETWORKSUS	https://denizfirsatgsmtektikbuo.xyz/	Get hash	malicious	HTMLPhisher	Browse	2.58.85.5
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	107.161.53.91
	lKXAJFq3ih.exe	Get hash	malicious	AsyncRAT	Browse	2.58.85.145
	peign94sXb.elf	Get hash	malicious	Unknown	Browse	171.22.79.111
	jSlv5GLHad.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	185.133.35.50
	hajime-like-20231028-0250.elf	Get hash	malicious	Gafgyt, Mirai	Browse	62.192.173.7
	HDyd3HGFG9.elf	Get hash	malicious	Mirai	Browse	62.192.173.7
	qBY3LYayGE.elf	Get hash	malicious	Mirai	Browse	62.192.173.7
	KZAfYAtFzk.elf	Get hash	malicious	Mirai	Browse	62.192.173.7
	ks1gsuIm6L.elf	Get hash	malicious	Mirai	Browse	62.192.173.7

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.9637323044861796
Encrypted:	false
SSDEEP:	6:kKYo9Usw9L+N+SkQlPlEGYRMY9z+4KlDA3RUe/:gzD9LNkPlE99SNxAhUe/
MD5:	E26CABAA17E3C38C6A721F78DB690108
SHA1:	ABF27FA5CDC678BF91A76E835B118BD999C8B482
SHA-256:	6D287158BAD2DDE991AB5C6E162C79B6F3D6DBA97DE03007E6162A0C7EC89E0D
SHA-512:	8077CD5AD7C63AE9A9D9E744D753D90BABAB9E4C2863D7BF83C72B943AD853C835CD852F3BD6B7FBF6BFA32A2C8DBE9B2C05A8A9B2DFB9A25900F12C4A4FE4CE
Malicious:	false
Reputation:	low
Preview:	p...... ...............(....................................................... ........G..@.......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ClientAny.exe.log

Process:	C:\Users\user\Desktop\ClientAny.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\tmp73F0.tmp.bat

Process:	C:\Users\user\Desktop\ClientAny.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	5.097083958152738
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5o0nacwREaKC5ZACSmqRD0nacwRE2J5xAInTRI4WjhGZPy:hWKqTtT6cNwiaZ5Omq1cNwi23fTZWjhN
MD5:	49582B066916743A7BD8A3C5C7D9EB15
SHA1:	E49A39C93917CF702593475D8B1A3F23D412490B
SHA-256:	EEA4DC16D3CA701BBBB3E211401128D1BFFDBA95B8686F71DACDB761E19E172C
SHA-512:	CC83027406DD39CBAE97C3E68D3CC8018A6828E7B01A7EB8E0E5D3A2E2DE9DD815755B4D7783D66575A45E46247394893C7C231BE26BD9DA65842AA278DDED71
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\svchost.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp73F0.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\MyData\DataLogs.conf

Process:	C:\Users\user\Desktop\ClientAny.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:Rt:v
MD5:	CF759E4C5F14FE3EEC41B87ED756CEA8
SHA1:	C27C796BB3C2FAC929359563676F4BA1FFADA1F5
SHA-256:	C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
SHA-512:	C7F832AEE13A5EB36D145F35D4464374A9E12FA2017F3C2257442D67483B35A55ECCAE7F7729243350125B37033E075EFBC2303839FD86B81B9B4DCA3626953B
Malicious:	false
Preview:	.5.False

C:\Users\user\AppData\Roaming\svchost.exe

Process:	C:\Users\user\Desktop\ClientAny.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	6.374262639682198
Encrypted:	false
SSDEEP:	1536:uUaUcxoyR1CriPMVzrqVBYgImH1bz/psRo2Qzcxop3KBv3RiDKLVclN:uUDcxoyXkiPMVzrqVHH1bzRahQxUYKBY
MD5:	51A43245ECF3A5F9871D4E2003A36032
SHA1:	14F0576F0639189C6252467ABA08EB8D8E557578
SHA-256:	F5958EAE1D68011FC17A9FBB2F22C18221C36DB1984DE47A294E274EB4B62F32
SHA-512:	68EBFFA51C9ACA71CB4DE71D287A434DE15DD3F04FFDE513631DA3BB6F348614BF9E13B99612E90FF07B1D70F05E5732D76457195E8432B4420D08913614B0FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.....................P......n4... ...@....@.. ....................................@..................................4..S....@..XM........................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...XM...@...N..................@..@.reloc...............f..............@..B................P4......H.......Py.........0....................................................W......H3.......W......3........./.\.....{...."..}......{...."..}......{...."..}.....~....(....9.....~....(....(.....(....n~....(....~.....(....(.....r...p.(.....(.....@....(.....A...(....f.~#...}......}.....($.....($....~....%:....&~....../...sM...%.....sN...(O...~....(..........~....o....9 ...~.....(....(G...9....~.....(.....s................s)........~J................s.........r~....o

\Device\Null

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.374262639682198
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ClientAny.exe
File size:	92'160 bytes
MD5:	51a43245ecf3a5f9871d4e2003a36032
SHA1:	14f0576f0639189c6252467aba08eb8d8e557578
SHA256:	f5958eae1d68011fc17a9fbb2f22c18221c36db1984de47a294e274eb4b62f32
SHA512:	68ebffa51c9aca71cb4de71d287a434de15dd3f04ffde513631da3bb6f348614bf9e13b99612e90ff07b1d70f05e5732d76457195e8432b4420d08913614b0fe
SSDEEP:	1536:uUaUcxoyR1CriPMVzrqVBYgImH1bz/psRo2Qzcxop3KBv3RiDKLVclN:uUDcxoyXkiPMVzrqVHH1bzRahQxUYKBY
TLSH:	5C938C0137D88D6AF26E47B9ADF156074EB4D5476012CE5E7CC800CD6A67BC68A037EE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.....................P......n4... ...@....@.. ....................................@................................

File Icon


Icon Hash:	d7fbf9b2b3ccccbb

Static PE Info

General

Entrypoint:	0x41346e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63E41DD4 [Wed Feb 8 22:10:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13418	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x4d58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11474	0x11600	cc6b5e41bd78a639c7b95f82274c7e3f	False	0.4828153102517986	data	5.828490293829448	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x4d58	0x4e00	a261cd71600c6f61125660bb36b2a097	False	0.8700420673076923	data	7.720796135914121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	b5456319a3019d6d3680593bec713244	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x14130	0x3ebb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9697988666791207
RT_GROUP_ICON	0x17fec	0x14	data	0.95
RT_VERSION	0x18000	0x2d4	data	0.4447513812154696
RT_MANIFEST	0x182d4	0xa83	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.40245261984392416

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/27/24-19:40:09.697042	TCP	2052265	ET TROJAN Observed Malicious SSL Cert (VenomRAT)	80	49701	2.58.84.229	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 27, 2024 19:40:09.072289944 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:09.077166080 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:09.077244043 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:09.120377064 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:09.125694036 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:09.697041988 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:09.721103907 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:09.727552891 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:09.902292013 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:09.957293034 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:13.996295929 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:14.002075911 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:14.002145052 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:14.008913994 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:25.927148104 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:25.932101965 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:25.932162046 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:25.937196016 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:26.228858948 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:26.269841909 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:26.353058100 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:26.368257999 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:26.373652935 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:26.373714924 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:26.378566027 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:37.864211082 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:37.869190931 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:37.869268894 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:37.874103069 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:38.176691055 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:38.223073006 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:38.308398008 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:38.309834003 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:38.314845085 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:38.314904928 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:38.319818020 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:49.801965952 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:49.806910992 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:49.807063103 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:49.811816931 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:50.119080067 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:50.160429001 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:50.438900948 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:50.440859079 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:50.445624113 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:40:50.445702076 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:40:50.450516939 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:01.739022017 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:01.743913889 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:01.744005919 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:01.748914957 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:02.038544893 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:02.082307100 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:02.165488005 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:02.166903019 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:02.171696901 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:02.171823025 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:02.176718950 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:13.676634073 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:13.681503057 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:13.681628942 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:13.686537981 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:13.993484974 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:14.035516024 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:14.122694969 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:14.124557972 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:14.129427910 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:14.129522085 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:14.135148048 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.020283937 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.025425911 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.025501013 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.030343056 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.301743031 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.306612968 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.306679964 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.311572075 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.330075026 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.379163027 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.463603973 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.466599941 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.518146992 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.518362999 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.523257971 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.551739931 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.597943068 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.688093901 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.690005064 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.738032103 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:20.738152027 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:20.743135929 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:30.285795927 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:30.290847063 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:30.290916920 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:30.295924902 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:30.616945982 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:30.676107883 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:30.746637106 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:30.866549015 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:30.871493101 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:30.871591091 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:30.876420021 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:32.583395958 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:32.589684963 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:32.589745045 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:32.596354961 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:32.881752014 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:33.009840965 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:33.009964943 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:33.011333942 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:33.016155005 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:33.016308069 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:33.021497011 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:42.363879919 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:42.369025946 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:42.369081974 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:42.373909950 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:42.673867941 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:42.733278990 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:42.807032108 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:42.808799982 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:42.813713074 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:42.813760996 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:42.818569899 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:54.304300070 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:54.309251070 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:54.315284014 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:54.320218086 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:54.606178999 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:54.660459042 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:54.738584995 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:54.740191936 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:54.745035887 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:41:54.745079994 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:41:54.749833107 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:06.239006042 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:06.244349003 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:06.247384071 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:06.252903938 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:06.782778978 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:06.784562111 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:06.784607887 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:06.786329031 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:06.791390896 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:06.791429996 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:06.796215057 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:14.100238085 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:14.343270063 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:14.344347954 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:14.349610090 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:14.648423910 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:14.752223969 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:14.791887999 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:14.793803930 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:14.798814058 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:14.798892021 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:14.803741932 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.317100048 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:19.322671890 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.322730064 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:19.327563047 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.614018917 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:19.850269079 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.850399017 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:19.851246119 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.856925964 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.857054949 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:19.857403040 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:19.862162113 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:20.148442984 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:20.192235947 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:20.275840998 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:20.277573109 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:20.282390118 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:20.284317970 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:20.289103031 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.192147017 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.197004080 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.197092056 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.201837063 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.301583052 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.306490898 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.306538105 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.311309099 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.379733086 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.384526014 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.384578943 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.389467955 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.501147032 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.584250927 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.631207943 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.636251926 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.641105890 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.644661903 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.650015116 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.719916105 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.724265099 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.729042053 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:23.732300997 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:23.737129927 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:26.160844088 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:26.166130066 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:26.166208029 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:26.171078920 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:26.459980011 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:26.582328081 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:26.590658903 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:26.592437029 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:26.597296000 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:26.597342968 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:26.602175951 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:36.676873922 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:36.681704998 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:36.681762934 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:36.687375069 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:36.975445032 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:37.109453917 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:37.109518051 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:37.111156940 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:37.115902901 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:37.115994930 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:37.120737076 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:42.708117008 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:42.712961912 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:42.713021040 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:42.717782021 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:43.006988049 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:43.055488110 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:43.240747929 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:43.242299080 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:43.247107983 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:43.247159004 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:43.251928091 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:49.317230940 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:49.322088957 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:49.322201014 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:49.326950073 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:49.629072905 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:49.762167931 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:49.762304068 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:49.763878107 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:49.769025087 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:42:49.769104004 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:42:49.773926020 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:01.255471945 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:01.260842085 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:01.261107922 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:01.266618013 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:01.571001053 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:01.691741943 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:01.702558041 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:01.704687119 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:01.709575891 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:01.709712982 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:01.714560986 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:09.801892042 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:09.806876898 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:09.806947947 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:09.811850071 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:10.161989927 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:10.264019966 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:10.264146090 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:10.265580893 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:10.271049023 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:10.271157026 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:10.276293993 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:18.583127022 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:18.588215113 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:18.588331938 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:18.595149040 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:18.892355919 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:18.988612890 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:19.027231932 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:19.028947115 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:19.033821106 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:19.033919096 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:19.038851023 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:21.380130053 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:21.385026932 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:21.385150909 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:21.390007973 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:21.688106060 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:21.742450953 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:21.824666023 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:21.826998949 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:21.831774950 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:21.831824064 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:21.836843014 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.317364931 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.323460102 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.323549986 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.328562975 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.632332087 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.676130056 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.762408972 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.764027119 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.768980980 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.769124031 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.773952961 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.910856009 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.915750980 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:33.915848970 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:33.920599937 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:34.198457003 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:34.238617897 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:34.334462881 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:34.336451054 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:34.341269970 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:34.341398954 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:34.346344948 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:37.567468882 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:37.572585106 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:37.572935104 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:37.577785969 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:37.997543097 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:37.999115944 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:37.999181986 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:38.021615982 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:38.026360035 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:38.026417971 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:38.031316042 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:39.614331007 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:39.619286060 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:39.619345903 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:39.624202013 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:39.928385973 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:39.973014116 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:40.226648092 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:40.228117943 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:40.233283997 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:40.233383894 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:40.238220930 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:45.944103956 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:45.949156046 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:45.949409962 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:45.954325914 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:46.259030104 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:46.388031960 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:46.388252020 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:46.392087936 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:46.396858931 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:46.400167942 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:46.404961109 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:56.164201975 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:56.169228077 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:56.169400930 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:56.174367905 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:56.464131117 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:56.598273993 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:56.601047993 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:56.601047993 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:56.605869055 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:43:56.612088919 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:43:56.616945028 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:44:07.900110006 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:44:07.905653000 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:44:07.905896902 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:44:07.911006927 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:44:08.210047960 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:44:08.254470110 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:44:08.346132994 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:44:08.347059011 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:44:08.351780891 CEST	80	49701	2.58.84.229	192.168.2.7
Jun 27, 2024 19:44:08.351850986 CEST	49701	80	192.168.2.7	2.58.84.229
Jun 27, 2024 19:44:08.356590033 CEST	80	49701	2.58.84.229	192.168.2.7

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 27, 2024 19:40:10.087140083 CEST	1.1.1.1	192.168.2.7	0x2e3	No error (0)	windowsupdatebg.s.llnwi.net		87.248.205.0	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	2.58.84.229	80	7700	C:\Users\user\AppData\Roaming\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jun 27, 2024 19:40:09.120377064 CEST	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 66 7d a3 f8 be 62 af 1b 0b dc 47 80 78 bd 14 64 c2 ba 59 c9 b1 bb 24 5c 96 b9 45 e4 2b 61 3a 23 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVf}bGxdY$\E+a:#5/#
Jun 27, 2024 19:40:09.697041988 CEST	912	IN	Data Raw: 16 03 01 03 8b 02 00 00 51 03 01 66 7d a3 f9 e8 45 58 69 71 e2 4b 37 39 6b f1 c2 45 e5 28 d0 97 f9 a1 01 80 35 1a fb db d2 29 8a 20 a0 02 00 00 c5 a1 57 98 48 f8 39 49 b2 50 4f 96 f7 e4 0e c0 21 8b 62 b4 10 c6 3b fa 2d 33 22 35 c0 14 00 00 09 00 Data Ascii: Qf}EXiqK79kE(5) WH9IPO!b;-3"5C@=090QLqS&`k0H0j10UVenomRAT Server10Uqwqdanchun10UVenomRAT By qwqdanchun10U
Jun 27, 2024 19:40:09.721103907 CEST	166	OUT	Data Raw: 16 03 01 00 66 10 00 00 62 61 04 da c3 7f cf a2 b9 bd 6c 02 03 36 2c e4 67 33 a7 71 30 39 6d 6a be fe bb 16 82 e0 90 ab 9d 9a 6e b7 73 12 61 e0 4d 41 aa 83 dd 25 ba 0b 4f d6 2a a8 5c 62 b4 71 0a 7f 88 2a cd 85 ce 11 71 56 b9 ce 66 e6 83 fa 56 8a Data Ascii: fbal6,g3q09mjnsaMA%O\bqqVfV{Mn0g\|jnVrt9OZq=RL^%mes=C
Jun 27, 2024 19:40:09.902292013 CEST	59	IN	Data Raw: 14 03 01 00 01 01 16 03 01 00 30 1d 40 db 8e b1 ed 42 03 7d 3e 4f a8 58 3a a7 fb ba da d5 db 8c 61 c1 2c b4 62 5c ac 10 68 17 21 84 38 51 ce f8 d6 2f e0 3e a4 3b b1 44 c8 07 3f Data Ascii: 0@B}>OX:a,b\h!8Q/>;D?
Jun 27, 2024 19:40:13.996295929 CEST	74	OUT	Data Raw: 17 03 01 00 20 60 85 e6 5c 53 5e 4d 05 b4 86 4b 9c a6 83 50 06 93 3f 31 fd 6c 15 38 aa f3 a9 11 e1 90 b7 68 d3 17 03 01 00 20 4e 34 55 80 1d 11 f8 08 03 ce ca 30 74 15 08 f1 19 f4 fd 78 ad b1 e0 65 b6 4f fe 14 c3 3d c1 fc Data Ascii: `\S^MKP?1l8h N4U0txeO=
Jun 27, 2024 19:40:14.002145052 CEST	698	OUT	Data Raw: 17 03 01 00 20 ed aa ce 46 aa fc 09 11 86 1d fe d8 44 75 eb 15 1b 36 2e 9a 66 dd 1a 5b ae e2 97 73 e1 7c 9f 96 17 03 01 02 90 6b 05 2d 57 43 21 e1 ab cb 7b 1c 41 a8 1d ea 54 8e 81 d8 09 44 0f bf a4 6a 2d 02 1e d4 b2 55 34 ae dd b0 48 a8 1b 2a c4 Data Ascii: FDu6.f[s\|k-WC!{ATDj-U4H*&udNAaHx;HU!J--!TlI?dfo#2\|6`X66&2>z>nB2E-gaj76MFk@EB{(ctI76Xz@4uh%Prp C
Jun 27, 2024 19:40:25.927148104 CEST	74	OUT	Data Raw: 17 03 01 00 20 2c 34 59 4a 1a 57 b7 a6 f8 22 15 fe d9 be c9 01 24 f1 4a dc b8 3d ca b3 28 ae c1 e6 00 17 5d 3d 17 03 01 00 20 6f 55 ae 38 f1 27 56 b6 63 15 fb 44 c1 a6 f2 05 0e 27 a3 35 5b 14 ca 16 a0 5c 52 6e 29 de a1 1c Data Ascii: ,4YJW"$J=(]= oU8'VcD'5[\Rn)
Jun 27, 2024 19:40:25.932162046 CEST	138	OUT	Data Raw: 17 03 01 00 20 cd f8 3d f9 9e cb ab c4 f6 e2 b5 09 4a 8d ec f0 f1 d1 f5 87 ab 10 15 54 41 12 71 2b 7b 1d e3 18 17 03 01 00 60 f8 05 42 60 7a 19 f3 c4 ed 5a 4f 5d 96 46 e3 0f dc 4c b1 d2 a3 31 ba 13 5e 31 06 19 db 1d b8 5f b5 22 cc ca db 14 ce a6 Data Ascii: =JTAq+{`B`zZO]FL1^1_"\Ak`IvrIOs8t{!^2dOc
Jun 27, 2024 19:40:26.228858948 CEST	74	IN	Data Raw: 17 03 01 00 20 1f f1 f1 b5 1c e5 d6 78 13 87 d5 34 dc 59 13 32 4b 64 02 40 1d 2b aa a8 7a 97 f2 e5 75 05 f7 74 17 03 01 00 20 a3 8d eb 5e 60 12 36 bc fc ab 9d ba 34 db 44 76 7a f4 4b bc 87 94 b4 b4 f1 1d 1d 1c 0e 81 47 9d Data Ascii: x4Y2Kd@+zut ^`64DvzKG
Jun 27, 2024 19:40:26.353058100 CEST	106	IN	Data Raw: 17 03 01 00 20 2c e2 ff fd fd 55 08 6d 6c bf ec 0d f8 2e c9 64 25 0c 23 a1 f9 2a 28 e3 9c 5e cf 56 56 53 e9 55 17 03 01 00 40 7c 02 23 00 10 c1 12 c9 0b 15 33 49 a8 e7 1b 7e 07 1b b1 f5 cd 08 e9 4f bc 42 71 28 43 35 be 7f 73 b9 da 4e 0a 54 45 5c Data Ascii: ,Uml.d%#*(^VVSU@\|#3I~OBq(C5sNTE\&Elgg\|u~

Target ID:	0
Start time:	13:39:58
Start date:	27/06/2024
Path:	C:\Users\user\Desktop\ClientAny.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ClientAny.exe"
Imagebase:	0xda0000
File size:	92'160 bytes
MD5 hash:	51A43245ECF3A5F9871D4E2003A36032
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1239383107.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1283717322.0000000013135000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	13:40:02
Start date:	27/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit
Imagebase:	0x7ff756450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	13:40:02
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	13:40:02
Start date:	27/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp73F0.tmp.bat""
Imagebase:	0x7ff756450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	13:40:02
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	13:40:02
Start date:	27/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'
Imagebase:	0x7ff68c8e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	13:40:02
Start date:	27/06/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff68eb10000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	16
Start time:	13:40:04
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\svchost.exe
Imagebase:	0xd30000
File size:	92'160 bytes
MD5 hash:	51A43245ECF3A5F9871D4E2003A36032
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	13:40:05
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0xe00000
File size:	92'160 bytes
MD5 hash:	51A43245ECF3A5F9871D4E2003A36032
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false