Edit tour

Windows Analysis Report
client.exe

Overview

General Information

Sample name:	client.exe
Analysis ID:	1502288
MD5:	3fdaf7d43edcbf138a3f282199a0a576
SHA1:	66f799325fb310bc4e3c810433a53b31256fe6cd
SHA256:	876d061cbbf6c1a4a8cdcfbdbdf5ef74e25476e5da77e502eb586eba8a871ac0
Tags:	asyncratexe
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Yara detected DcRat

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

client.exe (PID: 5248 cmdline: "C:\Users\user\Desktop\client.exe" MD5: 3FDAF7D43EDCBF138A3F282199A0A576)

cmd.exe (PID: 6948 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6300 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 5624 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3376 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

Defender_procesed.exe (PID: 5632 cmdline: "C:\Users\user\AppData\Roaming\Defender_procesed.exe" MD5: 3FDAF7D43EDCBF138A3F282199A0A576)

Defender_procesed.exe (PID: 6404 cmdline: C:\Users\user\AppData\Roaming\Defender_procesed.exe MD5: 3FDAF7D43EDCBF138A3F282199A0A576)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "193.233.74.21", "Ports": "7777", "Version": "1.0.7", "Autorun": "true", "Install_Folder": "%AppData%", "Install_File": "Defender_procesed.exe", "AES_key": "sP48QSay4lIcCh5wtcyw6wMTrOXpM5eO", "Mutex": "DcRatMutex_qwgsfhgthfhftgd", "Certificate": "MIICMDCCAZmgAwIBAgIVAIAvr+xnAooWELwX+dWiE+A73DCdMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMTAyMzEwNDgwNloXDTM0MDgwMTEwNDgwNlowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJlW3VdlWo/jLozpSks/CApCj8zc5KTWmgGGennIVe3m6oENa7BB2TnaZb0PsKsCCETsXp5NGHIujqtrWF18KKk+c9+oTWSWY9PF74YiJwZqgnVPBldtmMeewc5+BPSd4oN/E0jzUmQDiMLtkB3oA+hA8GTXVuKl5ivfMXIUYA8nAgMBAAGjMjAwMB0GA1UdDgQWBBRB9bjiYs2uSWB2a8sKS5WJNZP9oDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAG4ZU968oJuJ3luZR3ImPFAjZCS9b7hHx9m+Idb/zhiEB1EahbfF9ayo1MdHntzTSlsOXR/n/iFutfE7uBdHfM0jgf/Cq29h+XCxwqWoToiLSiq/kMhxMzExiANI2LYs3qRdmOw9C6w1tLdBbDXCg/gwup/QCBHY+oCrhZ2RTm4K", "ServerSignature": "hdfxig1SxinCkdw8JJZKMtMtKB4dMrzycak57JOpzUaoOQXqLNOWP/Yw9E41iOO1DEA/u6LlbgQJTBZSBydWyeNUL3ou+LfZ/Uc9Z6FL3YYXS8RZL/1ZdbOuWbx3UIVLApYPBgPV0xHs+LE/S5pjEThUA49lDg9BidB96yMDpcQ=", "External_config_on_Pastebin": "null", "BDOS": "false", "Startup_Delay": "1", "Group": "Default", "AntiProcess": "false", "AntiVM": "false"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
client.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
client.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd11c:$q1: Select * from Win32_CacheMemory 0xd15c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd1aa:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1f8:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
client.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd758:$s1: DcRatBy

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4d1:$b2: DcRat By qwqdanchun1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Defender_procesed.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\Defender_procesed.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd11c:$q1: Select * from Win32_CacheMemory 0xd15c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd1aa:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1f8:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
C:\Users\user\AppData\Roaming\Defender_procesed.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd758:$s1: DcRatBy

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x7198:$b2: DcRat By qwqdanchun1 0xee3c:$b2: DcRat By qwqdanchun1 0xf08c:$b2: DcRat By qwqdanchun1
00000009.00000002.2093139250.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x61c:$b2: DcRat By qwqdanchun1
00000000.00000002.2046407660.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1d38c:$a2: timeout 3 > NUL 0x514d6:$a2: timeout 3 > NUL 0x1d3c4:$a3: START "" " 0x5488:$b1: DcRatByqwqdanchun
00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xaa68:$b2: DcRat By qwqdanchun1 0x353dc:$b2: DcRat By qwqdanchun1
00000008.00000002.3265329144.000000001B6C3000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11970:$b2: DcRat By qwqdanchun1
00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x12cac:$a2: timeout 3 > NUL 0x12ce4:$a3: START "" " 0x53a8:$b1: DcRatByqwqdanchun 0x3f124:$b2: DcRat By qwqdanchun1
00000000.00000002.2045845766.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x55c:$b2: DcRat By qwqdanchun1
00000000.00000002.2046407660.0000000003107000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x247fac:$b2: DcRat By qwqdanchun1
00000008.00000002.3260450714.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x21c0b4:$b2: DcRat By qwqdanchun1
00000009.00000002.2093797285.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x54f0:$b1: DcRatByqwqdanchun 0x29e0b4:$b2: DcRat By qwqdanchun1
Process Memory Space: client.exe PID: 5248	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: client.exe PID: 5248	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: client.exe PID: 5248	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xf23c:$a1: havecamera 0x2f83e:$a1: havecamera 0x8252:$b1: DcRatByqwqdanchun 0x16e74:$b1: DcRatByqwqdanchun 0x37476:$b1: DcRatByqwqdanchun 0x23792:$b2: DcRat By qwqdanchun1 0x2dcd6:$b2: DcRat By qwqdanchun1
Process Memory Space: Defender_procesed.exe PID: 6404	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Defender_procesed.exe PID: 6404	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: Defender_procesed.exe PID: 6404	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3e45:$b1: DcRatByqwqdanchun 0xf812:$b2: DcRat By qwqdanchun1 0x1764c:$b2: DcRat By qwqdanchun1 0x29b0f:$b2: DcRat By qwqdanchun1 0x38aa1:$b2: DcRat By qwqdanchun1 0x40c17:$b2: DcRat By qwqdanchun1
Process Memory Space: Defender_procesed.exe PID: 5632	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xed45:$b1: DcRatByqwqdanchun 0x92cf:$b2: DcRat By qwqdanchun1 0x168cb:$b2: DcRat By qwqdanchun1
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.client.exe.e40000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.client.exe.e40000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd11c:$q1: Select * from Win32_CacheMemory 0xd15c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd1aa:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1f8:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.0.client.exe.e40000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd758:$s1: DcRatBy
0.2.client.exe.36af198.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.client.exe.36af198.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd11c:$q1: Select * from Win32_CacheMemory 0xd15c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd1aa:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd1f8:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.client.exe.36af198.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xd758:$s1: DcRatBy
0.2.client.exe.36af198.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.client.exe.36af198.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xb31c:$q1: Select * from Win32_CacheMemory 0xb35c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xb3aa:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xb3f8:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.client.exe.36af198.1.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xb958:$s1: DcRatBy
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\client.exe", ParentImage: C:\Users\user\Desktop\client.exe, ParentProcessId: 5248, ParentProcessName: client.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit, ProcessId: 6948, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.233.74.21, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Initiated: true, ProcessId: 6404, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6948, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' , ProcessId: 6300, ProcessName: schtasks.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) - Source IP: 193.233.74.21 - Destination IP: 192.168.2.5

Timestamp:	2024-08-31T23:03:00.468176+0200
SID:	2842478
Severity:	1
Source Port:	7777
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Observed Malicious SSL Cert (AsyncRAT) - Source IP: 193.233.74.21 - Destination IP: 192.168.2.5

Timestamp:	2024-08-31T23:03:00.468176+0200
SID:	2034847
Severity:	1
Source Port:	7777
Destination Port:	49704
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT) - Source IP: 193.233.74.21 - Destination IP: 192.168.2.5

Timestamp:	2024-08-31T23:03:00.468176+0200
SID:	2848048
Severity:	1
Source Port:	7777
Destination Port:	49704
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: client.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe

Avira: detection malicious, Label: HEUR/AGEN.1307453

Found malware configuration

Source: client.exe

Malware Configuration Extractor: AsyncRAT {"Server": "193.233.74.21", "Ports": "7777", "Version": "1.0.7", "Autorun": "true", "Install_Folder": "%AppData%", "Install_File": "Defender_procesed.exe", "AES_key": "sP48QSay4lIcCh5wtcyw6wMTrOXpM5eO", "Mutex": "DcRatMutex_qwgsfhgthfhftgd", "Certificate": "MIICMDCCAZmgAwIBAgIVAIAvr+xnAooWELwX+dWiE+A73DCdMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMTAyMzEwNDgwNloXDTM0MDgwMTEwNDgwNlowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJlW3VdlWo/jLozpSks/CApCj8zc5KTWmgGGennIVe3m6oENa7BB2TnaZb0PsKsCCETsXp5NGHIujqtrWF18KKk+c9+oTWSWY9PF74YiJwZqgnVPBldtmMeewc5+BPSd4oN/E0jzUmQDiMLtkB3oA+hA8GTXVuKl5ivfMXIUYA8nAgMBAAGjMjAwMB0GA1UdDgQWBBRB9bjiYs2uSWB2a8sKS5WJNZP9oDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAG4ZU968oJuJ3luZR3ImPFAjZCS9b7hHx9m+Idb/zhiEB1EahbfF9ayo1MdHntzTSlsOXR/n/iFutfE7uBdHfM0jgf/Cq29h+XCxwqWoToiLSiq/kMhxMzExiANI2LYs3qRdmOw9C6w1tLdBbDXCg/gwup/QCBHY+oCrhZ2RTm4K", "ServerSignature": "hdfxig1SxinCkdw8JJZKMtMtKB4dMrzycak57JOpzUaoOQXqLNOWP/Yw9E41iOO1DEA/u6LlbgQJTBZSBydWyeNUL3ou+LfZ/Uc9Z6FL3YYXS8RZL/1ZdbOuWbx3UIVLApYPBgPV0xHs+LE/S5pjEThUA49lDg9BidB96yMDpcQ=", "External_config_on_Pastebin": "null", "BDOS": "false", "Startup_Delay": "1", "Group": "Default", "AntiProcess": "false", "AntiVM": "false"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Virustotal: Detection: 74%			Perma Link

Multi AV Scanner detection for submitted file

Source: client.exe	ReversingLabs: Detection: 78%
Source: client.exe	Virustotal: Detection: 74%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: client.exe

Joe Sandbox ML: detected

Source: client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 193.233.74.21:7777 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2034847 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT) : 193.233.74.21:7777 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2848048 - Severity 1 - ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT) : 193.233.74.21:7777 -> 192.168.2.5:49704

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.233.74.21:7777

Source: Joe Sandbox View

ASN Name: MGNHOST-ASRU MGNHOST-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.74.21

Source: Defender_procesed.exe, 00000008.00000002.3259844986.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3265329144.000000001B6C3000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Defender_procesed.exe, 00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/ene0895
Source: client.exe, 00000000.00000002.2046407660.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000002.2046407660.00000000036A6000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.000000000300A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: client.exe, type: SAMPLE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: client.exe, type: SAMPLE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000009.00000002.2093139250.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2046407660.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000008.00000002.3265329144.000000001B6C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2045845766.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2046407660.0000000003107000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000008.00000002.3260450714.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000009.00000002.2093797285.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: Defender_procesed.exe PID: 5632, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen

Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_00007FF848D931EE NtProtectVirtualMemory,	0_2_00007FF848D931EE
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D931EE NtProtectVirtualMemory,	8_2_00007FF848D931EE
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 9_2_00007FF848D631C5 NtProtectVirtualMemory,	9_2_00007FF848D631C5

Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_00007FF848D931EE	0_2_00007FF848D931EE
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_00007FF848D92A85	0_2_00007FF848D92A85
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_00007FF848D92AFD	0_2_00007FF848D92AFD
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D931EE	8_2_00007FF848D931EE
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D992A6	8_2_00007FF848D992A6
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D92A85	8_2_00007FF848D92A85
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D943DD	8_2_00007FF848D943DD
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D9A052	8_2_00007FF848D9A052
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D92AFD	8_2_00007FF848D92AFD
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D9D4CF	8_2_00007FF848D9D4CF
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 9_2_00007FF848D631C5	9_2_00007FF848D631C5
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 9_2_00007FF848D62AFD	9_2_00007FF848D62AFD

Source: client.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: client.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000009.00000002.2093139250.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2046407660.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000008.00000002.3265329144.000000001B6C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2045845766.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2046407660.0000000003107000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000008.00000002.3260450714.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000009.00000002.2093797285.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: Defender_procesed.exe PID: 5632, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy

Source: client.exe, Settings.cs	Base64 encoded string: 'Y3op0SYni0JK8FYsjcqZFnrndAhIUXBKomxC8+3FQRvVl+kQsl0yf4pAc8GeYVsOX8BBwrw5IEdUWU0KIuAUvg==', 'uLuWIT/ZdQV89A9VMa5Wj2tV1b5FyRRTAbJzrUpVculocBD+En+CftY/KwTF1rU6phbzUZ586jEbVzKar6k1zA==', 'kRGw1DoWEH/D+OdyBRAj5CMWfV5VBQFuiYVQ9z9CbLPE9k2eRV4lo/bJ4P95ANU5TklVcbom+MBhcLWkVdRubw==', 'M6vUBOi+AsaiREUmpLmi5KqFqa0qdcJWqg91pygvinwgdAsnuzdhy4iG3NTcopZJVeOCX6HE1vFX+6H96M0YPQ==', 'uoni9bz3QsHiCR1S6WS19/uTQhlVin5KuxVKMGUhagYEihUCQQ7qazGKa1EOI7jmunADcltU+0r0bjTTuWOYDBSxIOdfZOJmZeaXuPNWbMY=', 'ljpdPRfmQ7f1BWSohecPl1SZ4rDRyatgO+ZdWnG/KBCbWuScwXpeg9jn7mUwgTqcexLNmIb98N/8NHXpxBJOSOaPRf1sKjboBKLuRjsVlZzWR/GuGMg6EQysA06thP37lzBbV+QCk6fvhAtf6EQvyryEn5XecorV+2/lEdy+GM2YcsbhESAXnlp6caGaCcDRDe09GdKRFMYJB/smcObP4WfzNmz3l8HJUFsmYVDckMWXt9S3EwAAHNULXqTh0WIjnGm6Z+8DJWVBCPiYrhGsahxdmnYoD3LMJuCF4rRh7TP22U09UxG2wx5gosbaHhnOBAM3i9sdDxyfk0vCSEFjLj37FbfBcQqqWv1imJOx03ERp3lGUAa0AoApdDIFLGPtjllINX+h9eidZdoDk+8yHGFiMlloE90nI7F14uQQ5fKgnsTg9fonrj0+MI+2z6tZnrSHM7eyPm2ICI7asoFDvDpQMZIK6o3V4UYcBlA9p+/kXdSmAF9+gu8l8z0YiHPmfQ/18Fb4NiPnlEM//JgsTn+/d9pHfOTqdDcwsZ4dNpZTFLMoPKqUSYSOeEkE3yGb1Bxs2kfTnFqixwUPbHKI4YhS53W0HeoHBKzI9yPgj3rMNgSVfCXTL3zRF+dJeRorDv+1XT74GqtmU8bSbfyJayosK6lDpOWDWYQ8EYaoPxqMQqnzGc3rrDylUxZ4hmnd2kjJ8mcFb+LEzSpdWTu6tLcCRopm9aQw2jr+zif84y0gPfSaOu8dEYzmxmBY699aqDVi0+kRiRvxVuHLKhXPWf+fISJCf2Zvv9YYohU4OFWxp5l/eAup+4lCU6/cAAeyBlbpyDfs+uNpzBQ03rSckWYJ65veHWpxIgmI1RAkSmHWF+j+LOD9ugVm64G68XQSp/ZSsxegmCUZDmr2HFZdz8U09feGx0rPKK4cRbZSXBvpIK1kRS3yhB59wu5PGaAVHNHSgyg72owOcuHxU7v196fccM4j1SyAGsNoZRly4vtCn9yDecz0QqQOIF5kjZxS8nHixlSTZcP1e5MencaSI94oOsYhAr2+lCsBvGoPCKPhdAhhJzifmKXrnv8OLR29', 'tS7ag1AVDJCkso1qNjPvU66TcYbMa9es6+PoOMYaXogjQ5e8i/laDD7weXh8GhC+WXZyFNGcWCXJYyRyHdGM6AISaZtnHNvYLieLmjktkKCa+DWGHQx1qaQowx1Ri4tTfijraTigr13UbK84zdTudyC/IiHNr07VSw1KADpqqNhgI+wicqiC5RtYUHlPLzi+XHyl1ajP/WfKbHt7SiKt/WOVEk5ZchhNDIvYGYZ05y0fwNO3XE7vRl03t42iCoLmhI8LkYHn8Azz3CBh7ZyRkBVXQciysqRASF996nSzv94=', 'Xb68L+RypjuzwLMMoMuMT+IfdYhCQX4fdzLzjFy6rw9Yzq+gzXxfGfPI5GloVJzcUNQLjAPdAuvPZ3S8eiEbEQ==', 'Is6R+l4XfLD/cwJJR+1XtvScXcXNI/IfJwF/sI3zBTmJ/ocPpndEfvWp+zWymU9kS3gd4NRbeo6fBmbIqPKATg==', 'XXO4uB+zM2SgocWlimOjYSfISV9RwKGBXQyt4HvLDBmkQL3uCuwC29LqL64H8i/fnfR5eA1pjBIqoqvbuaTL4g=='
Source: Defender_procesed.exe.0.dr, Settings.cs	Base64 encoded string: 'Y3op0SYni0JK8FYsjcqZFnrndAhIUXBKomxC8+3FQRvVl+kQsl0yf4pAc8GeYVsOX8BBwrw5IEdUWU0KIuAUvg==', 'uLuWIT/ZdQV89A9VMa5Wj2tV1b5FyRRTAbJzrUpVculocBD+En+CftY/KwTF1rU6phbzUZ586jEbVzKar6k1zA==', 'kRGw1DoWEH/D+OdyBRAj5CMWfV5VBQFuiYVQ9z9CbLPE9k2eRV4lo/bJ4P95ANU5TklVcbom+MBhcLWkVdRubw==', 'M6vUBOi+AsaiREUmpLmi5KqFqa0qdcJWqg91pygvinwgdAsnuzdhy4iG3NTcopZJVeOCX6HE1vFX+6H96M0YPQ==', 'uoni9bz3QsHiCR1S6WS19/uTQhlVin5KuxVKMGUhagYEihUCQQ7qazGKa1EOI7jmunADcltU+0r0bjTTuWOYDBSxIOdfZOJmZeaXuPNWbMY=', 'ljpdPRfmQ7f1BWSohecPl1SZ4rDRyatgO+ZdWnG/KBCbWuScwXpeg9jn7mUwgTqcexLNmIb98N/8NHXpxBJOSOaPRf1sKjboBKLuRjsVlZzWR/GuGMg6EQysA06thP37lzBbV+QCk6fvhAtf6EQvyryEn5XecorV+2/lEdy+GM2YcsbhESAXnlp6caGaCcDRDe09GdKRFMYJB/smcObP4WfzNmz3l8HJUFsmYVDckMWXt9S3EwAAHNULXqTh0WIjnGm6Z+8DJWVBCPiYrhGsahxdmnYoD3LMJuCF4rRh7TP22U09UxG2wx5gosbaHhnOBAM3i9sdDxyfk0vCSEFjLj37FbfBcQqqWv1imJOx03ERp3lGUAa0AoApdDIFLGPtjllINX+h9eidZdoDk+8yHGFiMlloE90nI7F14uQQ5fKgnsTg9fonrj0+MI+2z6tZnrSHM7eyPm2ICI7asoFDvDpQMZIK6o3V4UYcBlA9p+/kXdSmAF9+gu8l8z0YiHPmfQ/18Fb4NiPnlEM//JgsTn+/d9pHfOTqdDcwsZ4dNpZTFLMoPKqUSYSOeEkE3yGb1Bxs2kfTnFqixwUPbHKI4YhS53W0HeoHBKzI9yPgj3rMNgSVfCXTL3zRF+dJeRorDv+1XT74GqtmU8bSbfyJayosK6lDpOWDWYQ8EYaoPxqMQqnzGc3rrDylUxZ4hmnd2kjJ8mcFb+LEzSpdWTu6tLcCRopm9aQw2jr+zif84y0gPfSaOu8dEYzmxmBY699aqDVi0+kRiRvxVuHLKhXPWf+fISJCf2Zvv9YYohU4OFWxp5l/eAup+4lCU6/cAAeyBlbpyDfs+uNpzBQ03rSckWYJ65veHWpxIgmI1RAkSmHWF+j+LOD9ugVm64G68XQSp/ZSsxegmCUZDmr2HFZdz8U09feGx0rPKK4cRbZSXBvpIK1kRS3yhB59wu5PGaAVHNHSgyg72owOcuHxU7v196fccM4j1SyAGsNoZRly4vtCn9yDecz0QqQOIF5kjZxS8nHixlSTZcP1e5MencaSI94oOsYhAr2+lCsBvGoPCKPhdAhhJzifmKXrnv8OLR29', 'tS7ag1AVDJCkso1qNjPvU66TcYbMa9es6+PoOMYaXogjQ5e8i/laDD7weXh8GhC+WXZyFNGcWCXJYyRyHdGM6AISaZtnHNvYLieLmjktkKCa+DWGHQx1qaQowx1Ri4tTfijraTigr13UbK84zdTudyC/IiHNr07VSw1KADpqqNhgI+wicqiC5RtYUHlPLzi+XHyl1ajP/WfKbHt7SiKt/WOVEk5ZchhNDIvYGYZ05y0fwNO3XE7vRl03t42iCoLmhI8LkYHn8Azz3CBh7ZyRkBVXQciysqRASF996nSzv94=', 'Xb68L+RypjuzwLMMoMuMT+IfdYhCQX4fdzLzjFy6rw9Yzq+gzXxfGfPI5GloVJzcUNQLjAPdAuvPZ3S8eiEbEQ==', 'Is6R+l4XfLD/cwJJR+1XtvScXcXNI/IfJwF/sI3zBTmJ/ocPpndEfvWp+zWymU9kS3gd4NRbeo6fBmbIqPKATg==', 'XXO4uB+zM2SgocWlimOjYSfISV9RwKGBXQyt4HvLDBmkQL3uCuwC29LqL64H8i/fnfR5eA1pjBIqoqvbuaTL4g=='
Source: 0.2.client.exe.36af198.1.raw.unpack, Settings.cs	Base64 encoded string: 'Y3op0SYni0JK8FYsjcqZFnrndAhIUXBKomxC8+3FQRvVl+kQsl0yf4pAc8GeYVsOX8BBwrw5IEdUWU0KIuAUvg==', 'uLuWIT/ZdQV89A9VMa5Wj2tV1b5FyRRTAbJzrUpVculocBD+En+CftY/KwTF1rU6phbzUZ586jEbVzKar6k1zA==', 'kRGw1DoWEH/D+OdyBRAj5CMWfV5VBQFuiYVQ9z9CbLPE9k2eRV4lo/bJ4P95ANU5TklVcbom+MBhcLWkVdRubw==', 'M6vUBOi+AsaiREUmpLmi5KqFqa0qdcJWqg91pygvinwgdAsnuzdhy4iG3NTcopZJVeOCX6HE1vFX+6H96M0YPQ==', 'uoni9bz3QsHiCR1S6WS19/uTQhlVin5KuxVKMGUhagYEihUCQQ7qazGKa1EOI7jmunADcltU+0r0bjTTuWOYDBSxIOdfZOJmZeaXuPNWbMY=', 'ljpdPRfmQ7f1BWSohecPl1SZ4rDRyatgO+ZdWnG/KBCbWuScwXpeg9jn7mUwgTqcexLNmIb98N/8NHXpxBJOSOaPRf1sKjboBKLuRjsVlZzWR/GuGMg6EQysA06thP37lzBbV+QCk6fvhAtf6EQvyryEn5XecorV+2/lEdy+GM2YcsbhESAXnlp6caGaCcDRDe09GdKRFMYJB/smcObP4WfzNmz3l8HJUFsmYVDckMWXt9S3EwAAHNULXqTh0WIjnGm6Z+8DJWVBCPiYrhGsahxdmnYoD3LMJuCF4rRh7TP22U09UxG2wx5gosbaHhnOBAM3i9sdDxyfk0vCSEFjLj37FbfBcQqqWv1imJOx03ERp3lGUAa0AoApdDIFLGPtjllINX+h9eidZdoDk+8yHGFiMlloE90nI7F14uQQ5fKgnsTg9fonrj0+MI+2z6tZnrSHM7eyPm2ICI7asoFDvDpQMZIK6o3V4UYcBlA9p+/kXdSmAF9+gu8l8z0YiHPmfQ/18Fb4NiPnlEM//JgsTn+/d9pHfOTqdDcwsZ4dNpZTFLMoPKqUSYSOeEkE3yGb1Bxs2kfTnFqixwUPbHKI4YhS53W0HeoHBKzI9yPgj3rMNgSVfCXTL3zRF+dJeRorDv+1XT74GqtmU8bSbfyJayosK6lDpOWDWYQ8EYaoPxqMQqnzGc3rrDylUxZ4hmnd2kjJ8mcFb+LEzSpdWTu6tLcCRopm9aQw2jr+zif84y0gPfSaOu8dEYzmxmBY699aqDVi0+kRiRvxVuHLKhXPWf+fISJCf2Zvv9YYohU4OFWxp5l/eAup+4lCU6/cAAeyBlbpyDfs+uNpzBQ03rSckWYJ65veHWpxIgmI1RAkSmHWF+j+LOD9ugVm64G68XQSp/ZSsxegmCUZDmr2HFZdz8U09feGx0rPKK4cRbZSXBvpIK1kRS3yhB59wu5PGaAVHNHSgyg72owOcuHxU7v196fccM4j1SyAGsNoZRly4vtCn9yDecz0QqQOIF5kjZxS8nHixlSTZcP1e5MencaSI94oOsYhAr2+lCsBvGoPCKPhdAhhJzifmKXrnv8OLR29', 'tS7ag1AVDJCkso1qNjPvU66TcYbMa9es6+PoOMYaXogjQ5e8i/laDD7weXh8GhC+WXZyFNGcWCXJYyRyHdGM6AISaZtnHNvYLieLmjktkKCa+DWGHQx1qaQowx1Ri4tTfijraTigr13UbK84zdTudyC/IiHNr07VSw1KADpqqNhgI+wicqiC5RtYUHlPLzi+XHyl1ajP/WfKbHt7SiKt/WOVEk5ZchhNDIvYGYZ05y0fwNO3XE7vRl03t42iCoLmhI8LkYHn8Azz3CBh7ZyRkBVXQciysqRASF996nSzv94=', 'Xb68L+RypjuzwLMMoMuMT+IfdYhCQX4fdzLzjFy6rw9Yzq+gzXxfGfPI5GloVJzcUNQLjAPdAuvPZ3S8eiEbEQ==', 'Is6R+l4XfLD/cwJJR+1XtvScXcXNI/IfJwF/sI3zBTmJ/ocPpndEfvWp+zWymU9kS3gd4NRbeo6fBmbIqPKATg==', 'XXO4uB+zM2SgocWlimOjYSfISV9RwKGBXQyt4HvLDBmkQL3uCuwC29LqL64H8i/fnfR5eA1pjBIqoqvbuaTL4g=='

Source: Defender_procesed.exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Defender_procesed.exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: client.exe, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: client.exe, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.client.exe.36af198.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.client.exe.36af198.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: client.exe, DInvokeCore.cs	Suspicious method names: .DInvokeCore.DynamicAPIInvoke
Source: 0.2.client.exe.36af198.1.raw.unpack, DInvokeCore.cs	Suspicious method names: .DInvokeCore.DynamicAPIInvoke
Source: Defender_procesed.exe.0.dr, DInvokeCore.cs	Suspicious method names: .DInvokeCore.DynamicAPIInvoke

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/7@0/1

Source: C:\Users\user\Desktop\client.exe

File created: C:\Users\user\AppData\Roaming\Defender_procesed.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5272:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcRatMutex_qwgsfhgthfhftgd

Source: C:\Users\user\Desktop\client.exe

File created: C:\Users\user\AppData\Local\Temp\tmpA640.tmp

Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat""

Source: client.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: client.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\client.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: client.exe	ReversingLabs: Detection: 78%
Source: client.exe	Virustotal: Detection: 74%

Source: C:\Users\user\Desktop\client.exe

File read: C:\Users\user\Desktop\client.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\client.exe "C:\Users\user\Desktop\client.exe"
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Defender_procesed.exe C:\Users\user\AppData\Roaming\Defender_procesed.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Defender_procesed.exe "C:\Users\user\AppData\Roaming\Defender_procesed.exe"
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Defender_procesed.exe "C:\Users\user\AppData\Roaming\Defender_procesed.exe"	Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: client.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: client.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_00007FF848D900BD pushad ; iretd	0_2_00007FF848D900C1
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D9BAD8 push E85C9A4Eh; ret	8_2_00007FF848D9BAF9
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 8_2_00007FF848D900BD pushad ; iretd	8_2_00007FF848D900C1
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Code function: 9_2_00007FF848D600BD pushad ; iretd	9_2_00007FF848D600C1

Source: C:\Users\user\Desktop\client.exe

File created: C:\Users\user\AppData\Roaming\Defender_procesed.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"'

Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: client.exe, Defender_procesed.exe.0.dr

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\client.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Memory allocated: 1B0B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Memory allocated: F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Memory allocated: 1AC40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Memory allocated: 1AAE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Window / User API: threadDelayed 4528			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Window / User API: threadDelayed 5326			Jump to behavior

Source: C:\Users\user\Desktop\client.exe TID: 5284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe TID: 1864	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe TID: 5764	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe TID: 5752	Thread sleep count: 4528 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe TID: 5752	Thread sleep count: 5326 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe TID: 5040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\client.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Defender_procesed.exe, 00000008.00000002.3265329144.000000001B6C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpM
Source: Defender_procesed.exe, 00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWion="Uses RsaCryptoServiceProvider to encrypt and decrypt"
Source: client.exe, 00000000.00000002.2045845766.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: Defender_procesed.exe, 00000008.00000002.3265181822.000000001B598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\client.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Defender_procesed.exe "C:\Users\user\AppData\Roaming\Defender_procesed.exe"	Jump to behavior

Source: Defender_procesed.exe, 00000008.00000002.3265181822.000000001B5B6000.00000004.00000020.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.0000000003076000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Defender_procesed.exe, 00000008.00000002.3260450714.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.0000000002CBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\client.exe	Queries volume information: C:\Users\user\Desktop\client.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Queries volume information: C:\Users\user\AppData\Roaming\Defender_procesed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe	Queries volume information: C:\Users\user\AppData\Roaming\Defender_procesed.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.client.exe.36af198.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, type: DROPPED

Source: client.exe, 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Defender_procesed.exe.0.dr	Binary or memory string: MSASCui.exe
Source: client.exe, 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Defender_procesed.exe.0.dr	Binary or memory string: procexp.exe
Source: Defender_procesed.exe, 00000008.00000002.3264828058.000000001B510000.00000004.00000020.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: client.exe, 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Defender_procesed.exe.0.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 5248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Defender_procesed.exe PID: 6404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	2 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Scheduled Task/Job	1 Scripting	2 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
client.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
client.exe	74%	Virustotal		Browse
client.exe	100%	Avira	HEUR/AGEN.1307453
client.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Defender_procesed.exe	100%	Avira	HEUR/AGEN.1307453
C:\Users\user\AppData\Roaming\Defender_procesed.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Defender_procesed.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
C:\Users\user\AppData\Roaming\Defender_procesed.exe	74%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	client.exe, 00000000.00000002.2046407660.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000002.2046407660.00000000036A6000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Defender_procesed.exe, 00000008.00000002.3260450714.000000000300A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.74.21	unknown	Russian Federation		202423	MGNHOST-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502288
Start date and time:	2024-08-31 23:02:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	client.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/7@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 4 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:03:00	API Interceptor	2x Sleep call for process: Defender_procesed.exe modified
23:02:56	Task Scheduler	Run new task: Defender_procesed path: "C:\Users\user\AppData\Roaming\Defender_procesed.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	TsLvuUO.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://sin1.contabostorage.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	BankPaymAdviceVend.Report.docx	Get hash	malicious	Unknown	Browse	199.232.214.172
	TradingStationPublisher.msi	Get hash	malicious	Unknown	Browse	199.232.214.172
	DFweD7fjxj.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	http://lobster.cloudserver1097.com/3f9vxbkr4q83r4aq	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://find-phone.za.com/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://sharefile8.pages.dev/b08+zb2ylref0qax	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://seoservicesiox.firebaseapp.com/?err=tdn8ci80q...~311~...1bab28021k78dd4g97a557ek2c2e4	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MGNHOST-ASRU	file.exe	Get hash	malicious	RedLine	Browse	193.233.74.8
	server.bin.exe	Get hash	malicious	Ursnif	Browse	5.44.43.17
	server.exe	Get hash	malicious	Ursnif	Browse	5.44.43.17
	server.exe	Get hash	malicious	Ursnif	Browse	5.44.43.17
	server.exe	Get hash	malicious	Ursnif	Browse	5.44.43.17
	marzo.txt.url	Get hash	malicious	Ursnif	Browse	5.44.43.17
	login.dll	Get hash	malicious	Ursnif	Browse	194.116.163.130
	login.dll	Get hash	malicious	Ursnif	Browse	194.116.163.130
	Informazion.exe	Get hash	malicious	Ursnif, zgRAT	Browse	193.0.178.157
	47gcdr4nlI.exe	Get hash	malicious	DanaBot	Browse	185.142.98.118

Process:	C:\Users\user\AppData\Roaming\Defender_procesed.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\Defender_procesed.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kK/pF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3psDImsLNkPlE99SNxAhUe/3
MD5:	E59F3438D69C79DA791E070F3B334BDF
SHA1:	21B9561260FFA7C1779E5733F0E9411C5DC19557
SHA-256:	85E8F33AC9D5E43D2A3A012AF5C947117AD51D290039F8F3A2046CBF3A2D7AC6
SHA-512:	5D12F21D951B0C1E406DEF54DC60C6E567C2FB524A4F799B086943CCA7E85EDEBC3565D4233C8D22DA3C48AD9673920D156E9957BFD000DDD6230A830FAB2722
Malicious:	false
Reputation:	low
Preview:	p...... ...........)....(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Defender_procesed.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Defender_procesed.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\client.exe.log

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	5.0489293989803405
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oUkh4EaKC5Eu2nGAh0ZmqRDUkh4E2J5xAInTRIOTRVS7ZPy:hWKqTtT69aZ5EvnXh0Zmq1923fTvC7k
MD5:	81BE8B72128C0F9405CA37B612C0AB54
SHA1:	279CE6F79D0383F0DC15B33CAEAA977AC0BA11EB
SHA-256:	FF094F6EDD771522158D56462BE13B14AB27F6E005B42510015C229867F84901
SHA-512:	2BAB3C373729E136B519AB72830B5EF56F42A3DAAC99F9185DFB32A34132437098060787B8FB68C1A590C2691D252B776E7633A308291AF8BC870B6E46E7C75D
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\Defender_procesed.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpA640.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\Defender_procesed.exe

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.820055111530962
Encrypted:	false
SSDEEP:	1536:zJs1Tn8I8Q7vIh5teeiMl8GbbXwRKGdZVclN:zJs1Tn8I8Q7e5QeFmGbbXOzY
MD5:	3FDAF7D43EDCBF138A3F282199A0A576
SHA1:	66F799325FB310BC4E3C810433A53B31256FE6CD
SHA-256:	876D061CBBF6C1A4A8CDCFBDBDF5EF74E25476E5DA77E502EB586EBA8A871AC0
SHA-512:	7986E68D2DD0F827025790602C1B546FF8D441075947867497CF70D3CB05435D2F2BFDE678867E071892CA971BD4CDDD7D2C7BA0F86C50004AAA9CE6C066D5B6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^O.a............................n.... ... ....@.. .......................`............@................................. ...K.... .......................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................P.......H........e..@............................................................W......H3.......W......3........./.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(C......2~.....oD....s....%r...po....(h...r...p(....o....o....o....( ... ....(.....s....%r...po....r...po....%r...po.....o....o....( ...Vs.........si.........~"......"...F.(+...~!...o....*&...o.

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.820055111530962
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	client.exe
File size:	64'512 bytes
MD5:	3fdaf7d43edcbf138a3f282199a0a576
SHA1:	66f799325fb310bc4e3c810433a53b31256fe6cd
SHA256:	876d061cbbf6c1a4a8cdcfbdbdf5ef74e25476e5da77e502eb586eba8a871ac0
SHA512:	7986e68d2dd0f827025790602c1b546ff8d441075947867497cf70d3cb05435d2f2bfde678867e071892ca971bd4cddd7d2c7ba0f86c50004aaa9ce6c066d5b6
SSDEEP:	1536:zJs1Tn8I8Q7vIh5teeiMl8GbbXwRKGdZVclN:zJs1Tn8I8Q7e5QeFmGbbXOzY
TLSH:	94535B002798C965E2AD4AF8ACF2950146B5D5772102DB5E7CC804DBAB9FFC64A133EF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^O.a............................n.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41096e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x61DE4F5E [Wed Jan 12 03:47:42 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10920	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0xdf7	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe974	0xea00	c8f68f0fc8ed7c176c0f9b5a9112de49	False	0.49180355235042733	data	5.853302769232655	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0xdf7	0xe00	6abcb87f121c4b14112361dcefec0ef9	False	0.40122767857142855	data	5.110115746826057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	b0e0535106ee2612393c6c4ee578322a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x2d4	data			0.4350828729281768
RT_MANIFEST	0x12374	0xa83	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.40245261984392416

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T23:03:00.468176+0200	TCP	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	7777	49704	193.233.74.21	192.168.2.5
2024-08-31T23:03:00.468176+0200	TCP	2034847	ET MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	7777	49704	193.233.74.21	192.168.2.5
2024-08-31T23:03:00.468176+0200	TCP	2848048	ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	7777	49704	193.233.74.21	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 23:02:59.778247118 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:02:59.784352064 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:02:59.784420967 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:02:59.803155899 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:02:59.808377028 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:00.454355955 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:00.461930037 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:00.468175888 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:00.670675039 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:00.716878891 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:01.849870920 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:01.854731083 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:01.854799032 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:01.859601974 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:12.593904018 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:12.598767042 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:12.598851919 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:12.783216953 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:12.984242916 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:13.029386997 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:13.149488926 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:13.185339928 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:13.190195084 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:13.190239906 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:13.195044994 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:23.279937029 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:23.286382914 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:23.286458969 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:23.292632103 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:23.652812004 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:23.701322079 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:23.822230101 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:23.823964119 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:23.828763962 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:23.828835011 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:23.833636999 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:31.462178946 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:31.513786077 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:31.620507956 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:31.670075893 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:33.982939959 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:33.990681887 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:33.991278887 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:33.996253014 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:34.374655962 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:34.420181036 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:34.526264906 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:34.528151989 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:34.534363985 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:34.535247087 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:34.540497065 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:44.686211109 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:44.691081047 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:44.691137075 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:44.695884943 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:45.074045897 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:45.123208046 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:45.228512049 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:45.230452061 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:45.235528946 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:45.235596895 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:45.240350008 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:55.389250040 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:55.394309998 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:55.394386053 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:55.399204969 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:55.769220114 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:55.810767889 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:55.932657003 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:55.934432030 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:55.939253092 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:03:55.939316988 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:03:55.946350098 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:01.456001043 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:01.498322010 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:01.619746923 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:01.670078039 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:06.092468023 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:06.097436905 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:06.097506046 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:06.102372885 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:06.472543955 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:06.513818979 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:06.635138035 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:06.637044907 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:06.641864061 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:06.641913891 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:06.646625042 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:16.795512915 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:16.800437927 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:16.800523996 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:16.808314085 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:17.180066109 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:17.232645988 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:17.343544960 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:17.346858978 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:17.351819038 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:17.351881027 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:17.356749058 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:27.498790026 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:27.503760099 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:27.503827095 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:27.508650064 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:27.880882978 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:27.923718929 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:28.043142080 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:28.074548006 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:28.079642057 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:28.079699039 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:28.084615946 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:31.760428905 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:31.761223078 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:31.761346102 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:31.761442900 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:31.761442900 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:38.201910019 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:38.207387924 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:38.207462072 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:38.213263988 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:38.576025963 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:38.623228073 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:38.744688988 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:38.746349096 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:38.751122952 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:38.751187086 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:38.755930901 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:49.000099897 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:49.004975080 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:49.005049944 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:49.009918928 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:49.380290985 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:49.435717106 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:49.544950008 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:49.546761990 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:49.551542044 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:49.551599026 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:49.556499004 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:58.139203072 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:58.144119024 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:58.147433996 CEST	49704	7777	192.168.2.5	193.233.74.21
Aug 31, 2024 23:04:58.152266026 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:58.753854036 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:58.753904104 CEST	7777	49704	193.233.74.21	192.168.2.5
Aug 31, 2024 23:04:58.753993034 CEST	49704	7777	192.168.2.5	193.233.74.21

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 23:03:00.870378971 CEST	1.1.1.1	192.168.2.5	0xfded	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Aug 31, 2024 23:03:00.870378971 CEST	1.1.1.1	192.168.2.5	0xfded	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	17:02:52
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\client.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\client.exe"
Imagebase:	0xe40000
File size:	64'512 bytes
MD5 hash:	3FDAF7D43EDCBF138A3F282199A0A576
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.2046407660.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2046407660.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.2013553263.0000000000E42000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2045845766.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2046407660.0000000003107000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:02:55
Start date:	31/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"' & exit
Imagebase:	0x7ff6db010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:02:55
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:02:55
Start date:	31/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat""
Imagebase:	0x7ff6db010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:02:55
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:02:55
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "Defender_procesed" /tr '"C:\Users\user\AppData\Roaming\Defender_procesed.exe"'
Imagebase:	0x7ff700190000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:02:55
Start date:	31/08/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff796130000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:02:56
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\Defender_procesed.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Defender_procesed.exe
Imagebase:	0x9e0000
File size:	64'512 bytes
MD5 hash:	3FDAF7D43EDCBF138A3F282199A0A576
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.3260450714.000000000305C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.3259844986.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.3265329144.000000001B6C3000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.3260450714.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000008.00000002.3260450714.0000000002CC3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Roaming\Defender_procesed.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:02:58
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\Defender_procesed.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Defender_procesed.exe"
Imagebase:	0x7c0000
File size:	64'512 bytes
MD5 hash:	3FDAF7D43EDCBF138A3F282199A0A576
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000009.00000002.2093139250.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000009.00000002.2093797285.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848D931EE Relevance: 1.9, APIs: 1, Instructions: 446
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FF848D93544

Memory Dump Source

Source File: 00000000.00000002.2050129463.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_client.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 3ba481b46499d43ac9cdcccccef3634be35b7cbdc9c5f989933fa82ff793a277
Instruction ID: 17a02e2aa3afd4e7bef2c48fe01349c75cdf3603ba03c8b4b54fc664fee057c5
Opcode Fuzzy Hash: 3ba481b46499d43ac9cdcccccef3634be35b7cbdc9c5f989933fa82ff793a277
Instruction Fuzzy Hash: A1C14731E1DA495FE71DEB6898162FA7BE1EF95360F04417ED08AC3197DE38680A8781

Function 00007FF848D92A85 Relevance: .9, Instructions: 887
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2050129463.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9955ec42c87a49df61f418466874c85c26d56dbb01c40943a11d24d19e4233
Instruction ID: bd4440213b83bd9962232bd2eb4b4637a769996d2e9874c559e85d4e86d2a5b8
Opcode Fuzzy Hash: fc9955ec42c87a49df61f418466874c85c26d56dbb01c40943a11d24d19e4233
Instruction Fuzzy Hash: D3423731E0EA4A4FE759AB3C98592B57BD1EF99354F0801BED04EC3197DF28A84A8345

Non-executed Functions

Function 00007FF848D92AFD Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050129463.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848d90000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638c51416cd64f2828e4ac580a457e0840ee1a373dda929cccdc45c7012b068c
Instruction ID: 5b9af50334b5164b58d1cde15f8df65859d18aa07a17e01dffa8a879bbe7a351
Opcode Fuzzy Hash: 638c51416cd64f2828e4ac580a457e0840ee1a373dda929cccdc45c7012b068c
Instruction Fuzzy Hash: 6C41F431D1DA095EE72CFB2598561FA73E1EFA5354F44443ED48BC349AEE38B40A8681

Analysis Process: Defender_procesed.exePID: 6404, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848D931EE Relevance: 1.9, APIs: 1, Instructions: 446
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FF848D93544

Memory Dump Source

Source File: 00000008.00000002.3266853144.00007FF848D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848d90000_Defender_procesed.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 597939f55208d47cec4509fc5517c1d05c10818969585dbdfdc81daec66f987f
Instruction ID: 17a02e2aa3afd4e7bef2c48fe01349c75cdf3603ba03c8b4b54fc664fee057c5
Opcode Fuzzy Hash: 597939f55208d47cec4509fc5517c1d05c10818969585dbdfdc81daec66f987f
Instruction Fuzzy Hash: A1C14731E1DA495FE71DEB6898162FA7BE1EF95360F04417ED08AC3197DE38680A8781

Analysis Process: Defender_procesed.exePID: 5632, Parent PID: 5624COMMON

Execution Graph

Execution Coverage:	32%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF848D631C5 Relevance: 2.0, APIs: 1, Instructions: 464
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FF848D63544

Memory Dump Source

Source File: 00000009.00000002.2097797155.00007FF848D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848d60000_Defender_procesed.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e2e14ce3de106d2f9d30320bc72f250c75a2c459fa5867e423ec91ab75dcf674
Instruction ID: bc100ddb621c730c8e63181b1d8920359e99f34354ca937b0a2083339c21234b
Opcode Fuzzy Hash: e2e14ce3de106d2f9d30320bc72f250c75a2c459fa5867e423ec91ab75dcf674
Instruction Fuzzy Hash: 8AD13831A1DA495FE71DAB6898562FA77E1EF95360F0441BFD08AC3197DE38680B8381

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report client.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Defender_procesed.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\client.exe.log

C:\Users\user\AppData\Local\Temp\tmpA640.tmp.bat

C:\Users\user\AppData\Roaming\Defender_procesed.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
client.exe

Function 00007FF848D931EE Relevance: 1.9, APIs: 1, Instructions: 446
nativeCOMMON

Function 00007FF848D92A85 Relevance: .9, Instructions: 887
COMMON

Function 00007FF848D931EE Relevance: 1.9, APIs: 1, Instructions: 446
nativeCOMMON

Function 00007FF848D631C5 Relevance: 2.0, APIs: 1, Instructions: 464
nativeCOMMON