Edit tour

Windows Analysis Report
N1f691bk5G.ps1

Overview

General Information

Sample name:	N1f691bk5G.ps1 renamed because original name is a hash value
Original sample name:	d4f4d3196d92b306f65ba4f1f90ec73403803530a58196b48db38210e3e3047d.ps1
Analysis ID:	1562422
MD5:	33b6c435bdbbec12ae8cba21eb6d105f
SHA1:	41d43dc4ec1187e6120f26158e074e39475b0815
SHA256:	d4f4d3196d92b306f65ba4f1f90ec73403803530a58196b48db38210e3e3047d
Tags:	ducksex-ddnsfree-comps1user-JAMESWT_MHT
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AsyncRAT

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: AspNetCompiler Execution

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7288 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_compiler.exe (PID: 5420 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "ducksex.ddnsfree.com", "Port": "6161", "Version": "| CRACKED BY DEXTER-LY", "MutexName": "AsyncMutex_6SI8OkPnk", "Autorun": "false", "Group": "true"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcf68:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10238:$a2: Stub.exe 0x102c8:$a2: Stub.exe 0x9698:$a3: get_ActivatePong 0xd180:$a4: vmware 0xcff8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa7e8:$a6: get_SslClient
00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xcffa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x17d6e8:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1805d0:$a2: Stub.exe 0x180660:$a2: Stub.exe 0x179e18:$a3: get_ActivatePong 0x17d900:$a4: vmware 0x17d778:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x17af68:$a6: get_SslClient
00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x17d77a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x2db8f0:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x2de7c0:$a2: Stub.exe 0x2de850:$a2: Stub.exe 0x2d8020:$a3: get_ActivatePong 0x2dbb08:$a4: vmware 0x2db980:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x2d9170:$a6: get_SslClient
00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x11df58:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x13bd98:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x120e28:$a2: Stub.exe 0x120eb8:$a2: Stub.exe 0x13ec68:$a2: Stub.exe 0x13ecf8:$a2: Stub.exe 0x11a688:$a3: get_ActivatePong 0x1384c8:$a3: get_ActivatePong 0x11e170:$a4: vmware 0x13bfb0:$a4: vmware 0x11dfe8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x13be28:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x11b7d8:$a6: get_SslClient 0x139618:$a6: get_SslClient
Process Memory Space: powershell.exe PID: 7288	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 5420	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 5420	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x26c02:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.powershell.exe.23cb53fb788.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.23cb53fb788.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23cb53fb788.3.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
4.2.powershell.exe.23cb53fb788.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd1fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.powershell.exe.23cb485bc30.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.23cb485bc30.2.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
4.2.powershell.exe.23cb485bc30.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.powershell.exe.23cb53fb788.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.23cb53fb788.3.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
4.2.powershell.exe.23cb53fb788.3.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.powershell.exe.23cb483ddf0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.23cb483ddf0.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb368:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe238:$a2: Stub.exe 0xe2c8:$a2: Stub.exe 0x7a98:$a3: get_ActivatePong 0xb580:$a4: vmware 0xb3f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8be8:$a6: get_SslClient
4.2.powershell.exe.23cb483ddf0.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb3fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
7.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
7.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.aspnet_compiler.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
7.2.aspnet_compiler.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd1fa:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.powershell.exe.23cb485bc30.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.23cb485bc30.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23cb485bc30.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0xd380:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient
4.2.powershell.exe.23cb483ddf0.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.powershell.exe.23cb483ddf0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23cb483ddf0.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd168:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x2afa8:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x2de78:$a2: Stub.exe 0x2df08:$a2: Stub.exe 0x9898:$a3: get_ActivatePong 0x276d8:$a3: get_ActivatePong 0xd380:$a4: vmware 0x2b1c0:$a4: vmware 0xd1f8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x2b038:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa9e8:$a6: get_SslClient 0x28828:$a6: get_SslClient
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7288, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 5420, ProcessName: aspnet_compiler.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", ProcessId: 7288, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1", ProcessId: 7288, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000007.00000002.3746883357.0000000002F11000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "ducksex.ddnsfree.com", "Port": "6161", "Version": "| CRACKED BY DEXTER-LY", "MutexName": "AsyncMutex_6SI8OkPnk", "Autorun": "false", "Group": "true"}

Multi AV Scanner detection for submitted file

Source: N1f691bk5G.ps1

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: ducksex.ddnsfree.com

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.10:49715 -> 178.208.169.197:6161

Source: Joe Sandbox View

ASN Name: PHMGMT-AS1US PHMGMT-AS1US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ducksex.ddnsfree.com

Source: powershell.exe, 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB583A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316089103.0000023CB36E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB623A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://localhost:3030/Service.asmx
Source: powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1316341250.0000023CB4389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1316341250.0000023CB3761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1316341250.0000023CB4389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1316341250.0000023CB3761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1316341250.0000023CB4389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 5420, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: Process Memory Space: aspnet_compiler.exe PID: 5420, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: Process Memory Space: aspnet_compiler.exe PID: 5420, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: 4.2.powershell.exe.23cb36e0000.0.raw.unpack, c49e11983285d4ab2e059050de6df5a41.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 4.2.powershell.exe.23cb68fc0b8.6.raw.unpack, c49e11983285d4ab2e059050de6df5a41.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, jlsfKWsjaVv.cs

Base64 encoded string: 'N/H6Hlh9UzfrGgXXsKqTw7QaUGfZt9XtgiIL8EVzKcrzvNXdm2x6RZQh27SwPNYKQbRJGpDXCu/w0m0HaAdjnA==', 'J6Qn6itDdK9MeAKgTZn5oDjFgXZDNlA/AFE+yka5sFvAB4XOuS4camufsW+YkwPxs+x4+mor32+Bk5WMVUwVBANDmytwi8Fpt2aC/J8HP50=', 'Qd5EvSl5xgznJbQ8NJp5gUiVml0QQ91MMfoPjw12zdsbEEQX5Y1fojZc9v0OY7aNQMljPlMIQp1RR/ot/L2pBmEgjrd8tKblE0sAZa0gwdY=', 'K3ZCK2Ga97LDojWxHaWAjL00KyA0T79n3tIrOieoYGDoXhduDb6tGKoNpAzXSo20HYyJVASnvy/A3Ibkpuk/dA==', 'sM1ePJDTnlj3DtRAz7+dWOd5NGp5JQWsyrDZoPOlJQDTb6jNyWYXx3QMnyuazNtSs7TQ57FEdZieCqG12wLzhyExZMmCcwHl79x+3yuqL/o=', 'RWkUqy0UBTBfe/Bx61LSxJ1v8LNLNjalgm/38bcmSVpoQqPmkPFYFs3yvdTsSvqH0PWTJ3t9gIaHVTMEnACVgGT2n+w2RVYrPHsGFuK5KBExQaN+RjW3UQq9UwLkHAVRc3D6T7UOXRVHyKOYSXz0PEm8y9GzjNgW68ZqIY8MiidfQfKYyR8nNkItqpXiWhNKHWpFsmRqB+Hi5Z5QqUrhXlJInCVAq6M68doFKK9KE/HqBeVevYeF64syWrzi3ABGPFCp1ZoPsm1I0xgMeXGT25QoqSaNo5daI1Ss6uG8DKVlTnCEQwdKn3G3qlIkWFXjfSNhdobtUGTcZx2U4CaiQji21pmf+k+mvo1omoKWrkmwpTUt5wAoF+jlIkIlgtndE5U9HoZ79PUeo/t1jo71f4ta6oWvdOHVJJsO3UzzAJ1fOmssP5XAw18BWWfzlfYzftjFzSdR2AWduPApLtJHm1UmlFgDJKxuxIikdVhVEihlrmZFCDEi9HfjtN0btC8yt1I7BRNfGBLKx1/oS3+5sXhubH8+E9E74W50rJ8v3T2LLnSgDT3hoVwVsuVzl8iQ7mespBWCLbPtFCix1zV1Qb3v79+JAHXwWxwi7MLMaDRYvnrYaMII712ym13SZYari6Q7CqhHTW63vW51m9xIA69NnbgWRKqa/twggs/uyYnASD2azq2eZLI4gCJKlzMdDrpN7YoOsD0h//ga00KnMN7+kv6K8zQGwbO/TXHYvMMhI+fnXk12z/Iw2T8HBsQoq8/mUgTEYnNUUnCe1P3N3BDqSymoPgWdqE/UtN3pEdu41ZFVAQ0etGyUO97msgzqGh8rnlgIGbTIV0t32CaZqDopxQM1gQloyZmBGVCCnnZt1+IYTeDvfD+vJ++NzF1HhYKILWAPyl0taW0gnOyCj46NaaLY3f0eW8KVC8a3xZIBfwNYTDZXIef8aXmSf4pbdDCdw1uLy5LanyQO3kbTYSzcPLGrJuC8VHBbfV003XiwV+aPHStSWK8uKxxWkzE9qV7SzjYkwtltb8xmzIOY72sKw0HyH6JczfGRi2jsewxOzGYo8SIwQ2pfH+FGNfOk3NWwKSW9w/uAXmtacaPE47Khj/8E6VOAYw91v4FT0hxJPu7Tb51V8pb3FP9TOdPK2ZicNqcOv3PDba4+vSTi266QCvo1Isyj7VYhxVIttP2etWkLc7SrBv9KkmIw3I5GkHQsj9slR/qvcgDKQXFwnoUnQGxcYx9Ukor6cCeYHXKdh7J8ZV3W9dWc6elByTKxyRvRNLw4DUXPFMPUX4WvD8fgd21SkAcJqITC1GYvJeRHSaIGpuLXf9MHBaisrQGLcDwhDNBEAILWZNs7nx5o0feJv7BVAN+fGfToqajY0/ajOlqactTCio+8sQk5UEYaYn1WE/Zq8CgJaWKjycmAHk71UoQyNXoqP99Wtrdj8SNQ9tnAArb0WXzNPyooOpYzyU/aZPMzxhN8jI8H361RuBTdtX8GLKVQMM7xoGBZlSUOBIzikRJr/2QBbuoIX8qmynyykgMsSjx4jjzVWq0uFgZaA07/KBTZk0Jf2VNzcjel8WtGFlib6sAnEZ6RSsarG5TJJ+qVLEPf0eq9fa+0iU6BVsckJpTsFQJ1Ryc2pbSGwIGss/tRYwyjYIDNENp7z5HnKyYOYC5xX4SFRzQCG2O21eGFIZBc//+2eKAcuznrHAZ8htQpzT+Ka0JPUV1xCZRq/F67d54ep9Cie4P/JTVwqzB7wHBjwNHXvumVwrR6mCJzMuAGxW5OsWyLXzUoEU5/zX99VZ26oHuSwrq+pR5s66iMSSCCf40g3DJ+7NBJvsEusovAfgMgZ0BVi7QEt8l0JD4ZwCswr5Vo+g3N6lv7gvmf8h9pGfl2aLZ17TYWtzd7kjKwli9ygXgf9HWt/iV0lrn0O0GixT4oU3e1933kQfh8O7orfuMhqOUAbP4r6Fdcab/E+ZsAKLbWgWQV73WNmsgV4zCpCYtNAQWA9j+EYTYAifFwm4zZ6NIgsO6f9wBXL8d80ETU8GpoTYr4OyQs17/B/q7dFBG/NyxiFpXVoc6SB8kdVJ/JjhksZMGtSOx4zq4JgstiwBY9zfozKNjMAEstTLf3Ny81Kn5Bx9wPgrTAXr0V2aMgcEakTCzwOvg1X0Db0Gq5nVWL+eHVPjYtvWIhXoA1UdtbVxyClt253zAKVS9jRnX+5sky/asepjoAiaiGcO7Tyh8WQYoyLPzdHD/WQrtqdkgKUPn/+XPznzKyvXsXTDnDLUb9pdOZQQQTEnW3LZkmAtlfoyfxXm+bGwfzUFydnGhmkHUlXTzlRcZRPw98GHGX9/BBlmA=', 'NgUdLi02j9105GsOXgZgmA/efiX8Iex7x3bY5ksliBEO8VevhXo5hlIMMXwn8mgYaDJGRzewfzBJG1mNrk1ytQ==', 'nRv20pY7uhKCOgv4rOWdh0m5CUOmDH8tXQN

Source: classification engine

Classification label: mal100.troj.evad.winPS1@4/5@3/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxnp3xch.mql.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: N1f691bk5G.ps1

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: schannel.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

.NET source code contains potential unpacker

Source: 4.2.powershell.exe.23cb36e0000.0.raw.unpack, c599d343cac5014aad62aae883c42172b.cs	.Net Code: c14bb2c7302fd95407b5e64edfbc46414 System.Reflection.Assembly.Load(byte[])
Source: 4.2.powershell.exe.23cb68fc0b8.6.raw.unpack, c599d343cac5014aad62aae883c42172b.cs	.Net Code: c14bb2c7302fd95407b5e64edfbc46414 System.Reflection.Assembly.Load(byte[])
Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, xrossUpUgDCJrcSEI.cs	.Net Code: nOoZahaniTFF System.AppDomain.Load(byte[])

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7C105501B push 8B485E45h; iretd		4_2_00007FF7C1055020
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7C10500BD pushad ; iretd		4_2_00007FF7C10500C1

Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, BGdjDDpgXZdI.cs	High entropy of concatenated method names: 'VvznAZMSelWH', 'rZtkoDGEuzAf', 'NqXffOYeALLeoVmZl', 'cqhTNJjvrwLmZ', 'XAUzuNIIifMSBkBnA', 'aqMTzLLmknnK', 'opHXlstebrMYzK', 'vTYYhyfeTSN', 'QsBrxZsssig', 'OlbygUKhPPgbra'
Source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, TUsMcMDxLo.cs	High entropy of concatenated method names: 'CqnoGKqodh', 'SdYLFIZlxIrMD', 'NPukkKbqHQkAA', 'kQvJJnzylSR', 'dkNHbIsXjTEa', 'DqFabvntiuwcPmpJt', 'NoVTeUWwRrrordIQ', 'deTFpRPLpi', 'FcaBKFLMUTtkJ', 'xZLyKkTQEHR'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 5420, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 5420, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 1740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 4F10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3372	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3642	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 1548	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 8439	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6052	Thread sleep count: 1548 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6052	Thread sleep time: -1548000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6052	Thread sleep count: 8439 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6052	Thread sleep time: -8439000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: aspnet_compiler.exe, 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: aspnet_compiler.exe, 00000007.00000002.3758656562.0000000005520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_compiler.exe, 00000007.00000002.3758656562.0000000005520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 412000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 414000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: EEE008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb53fb788.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb485bc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23cb483ddf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 5420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	211 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
N1f691bk5G.ps1	21%	ReversingLabs	Script-PowerShell.Backdoor.Asyncrat

Source	Detection	Scanner	Label	Link
http://localhost:3030/Service.asmx	0%	Avira URL Cloud	safe
ducksex.ddnsfree.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ducksex.ddnsfree.com	178.208.169.197	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ducksex.ddnsfree.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://localhost:3030/Service.asmx	powershell.exe, 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB583A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316089103.0000023CB36E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB623A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1316341250.0000023CB3761000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1316341250.0000023CB4389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1316341250.0000023CB3761000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1316341250.0000023CB4389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1316341250.0000023CB4389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1358069077.0000023CC3D8B000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.208.169.197	ducksex.ddnsfree.com	Netherlands		22363	PHMGMT-AS1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562422
Start date and time:	2024-11-25 15:21:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	N1f691bk5G.ps1 renamed because original name is a hash value
Original Sample Name:	d4f4d3196d92b306f65ba4f1f90ec73403803530a58196b48db38210e3e3047d.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@4/5@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: N1f691bk5G.ps1

Simulations

Behavior and APIs

Time	Type	Description
09:22:18	API Interceptor	7x Sleep call for process: powershell.exe modified
09:22:56	API Interceptor	8207856x Sleep call for process: aspnet_compiler.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PHMGMT-AS1US	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	178.208.190.219
	amen.ppc.elf	Get hash	malicious	Mirai	Browse	45.255.208.12
	2xPiYIsfF2.exe	Get hash	malicious	AsyncRAT	Browse	128.90.103.230
	OhWWbQcp7Q.exe	Get hash	malicious	AveMaria, UACMe	Browse	128.90.129.125
	hb21QzBgft.exe	Get hash	malicious	AveMaria, UACMe	Browse	128.90.129.125
	U2DhKOFGy6.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	uVyl5BbR2M.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	ahMvIr4vjN.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	WlewaiA251.exe	Get hash	malicious	AsyncRAT	Browse	128.90.129.125
	meORoynQKS.exe	Get hash	malicious	ArrowRAT	Browse	128.90.129.125

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlty4eam.xnw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxnp3xch.mql.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7161084796710315
Encrypted:	false
SSDEEP:	48:yjATFdOL0CgDioU2fPiukvhkvklCyw3gq0jsAlLNSogZo4K0jsAl/NSogZoc1:7nTCgS4rkvhkvCCt7gsACH8gsAiHX
MD5:	7A222E9D288DE1D6C420B3788B4CD6A7
SHA1:	ABC1A3BD084C61D5820ADB79AB1D8B5BCBC1E387
SHA-256:	C8EC6F1894DEEC6C2210F4F824D00B3B95F64AC0ACC7C390114F04B6C4A93083
SHA-512:	B3C934C65C02BDA0EB5BE5094256E8458F6B608C6D44F2FDE7B5A39488887944E7136ABAF0D4FC0EE66AA5C43CF85E1B2296854CF9CD3A9D9F947D7A3474655D
Malicious:	false
Preview:	...................................FL..................F.".. ....N.5q...,.imE?..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........5q...fm.hE?..Y.wmE?......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)NyY.r...........................c..A.p.p.D.a.t.a...B.V.1.....yY.r..Roaming.@......EW)NyY.r..........................Y...R.o.a.m.i.n.g.....\.1.....EW.R..MICROS~1..D......EW)NyY.r..........................O~X.M.i.c.r.o.s.o.f.t.....V.1.....EW.S..Windows.@......EW)NyY.r..............................W.i.n.d.o.w.s.......1.....EW+N..STARTM~1..n......EW)NyY.r....................D......H..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW#O..Programs..j......EW)NyY.r....................@.......\|.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)NEW)N..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......EW)NyY.r................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9RQ765J2TNLQ7VMQB78E.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7161084796710315
Encrypted:	false
SSDEEP:	48:yjATFdOL0CgDioU2fPiukvhkvklCyw3gq0jsAlLNSogZo4K0jsAl/NSogZoc1:7nTCgS4rkvhkvCCt7gsACH8gsAiHX
MD5:	7A222E9D288DE1D6C420B3788B4CD6A7
SHA1:	ABC1A3BD084C61D5820ADB79AB1D8B5BCBC1E387
SHA-256:	C8EC6F1894DEEC6C2210F4F824D00B3B95F64AC0ACC7C390114F04B6C4A93083
SHA-512:	B3C934C65C02BDA0EB5BE5094256E8458F6B608C6D44F2FDE7B5A39488887944E7136ABAF0D4FC0EE66AA5C43CF85E1B2296854CF9CD3A9D9F947D7A3474655D
Malicious:	false
Preview:	...................................FL..................F.".. ....N.5q...,.imE?..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........5q...fm.hE?..Y.wmE?......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)NyY.r...........................c..A.p.p.D.a.t.a...B.V.1.....yY.r..Roaming.@......EW)NyY.r..........................Y...R.o.a.m.i.n.g.....\.1.....EW.R..MICROS~1..D......EW)NyY.r..........................O~X.M.i.c.r.o.s.o.f.t.....V.1.....EW.S..Windows.@......EW)NyY.r..............................W.i.n.d.o.w.s.......1.....EW+N..STARTM~1..n......EW)NyY.r....................D......H..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW#O..Programs..j......EW)NyY.r....................@.......\|.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)NEW)N..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......EW)NyY.r................

Static File Info

General

File type:	ASCII text, with very long lines (64623)
Entropy (8bit):	3.1900458877489832
TrID:
File name:	N1f691bk5G.ps1
File size:	255'748 bytes
MD5:	33b6c435bdbbec12ae8cba21eb6d105f
SHA1:	41d43dc4ec1187e6120f26158e074e39475b0815
SHA256:	d4f4d3196d92b306f65ba4f1f90ec73403803530a58196b48db38210e3e3047d
SHA512:	8b11308f7e16dc54e1559591d2d741f0a53d0a90c7ddb33bc817d15edcdc46dc4ebedd121925da4c791d7bb8b0a6a74334f63253f6fc3af453765f62826e4a4f
SSDEEP:	1536:NYzrwIovquFT/TO5HiSujupnwIE6YcG47rwnv1IJ5YH1llykZXvyd2b5uDSPVZrB:b
TLSH:	3044385303851BBDF69D0EC9C94B245B20F2D46B7D251298EBB36EE7BC3B9849430636
File Content Preview:	.$love = "C:\Windows\Microsoft.".$love1 ="NET\Framework\v4.0.30319\aspnet_compiler.exe".$GBDWVQYONBIQDJWMDKUVUR = $love + $love1.$love2 = "C:\Windows\Microsoft.".$love22 = "NET\Framework\v2.0.50727\aspnet_compiler.exe".$TPNSJKKGOXEEPYKERBJHCHD = $love2 +

File Icon


Icon Hash:	3270d6baae77db44

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 15:22:25.181282997 CET	49715	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:25.305130959 CET	6161	49715	178.208.169.197	192.168.2.10
Nov 25, 2024 15:22:25.306546926 CET	49715	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:25.320569038 CET	49715	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:25.440721989 CET	6161	49715	178.208.169.197	192.168.2.10
Nov 25, 2024 15:22:47.196825027 CET	6161	49715	178.208.169.197	192.168.2.10
Nov 25, 2024 15:22:47.198156118 CET	49715	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:52.394501925 CET	49715	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:52.395572901 CET	49780	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:52.514466047 CET	6161	49715	178.208.169.197	192.168.2.10
Nov 25, 2024 15:22:52.515522957 CET	6161	49780	178.208.169.197	192.168.2.10
Nov 25, 2024 15:22:52.515639067 CET	49780	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:52.516222000 CET	49780	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:22:52.636230946 CET	6161	49780	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:14.503267050 CET	6161	49780	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:14.503439903 CET	49780	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:19.517131090 CET	49780	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:19.518198013 CET	49840	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:19.687825918 CET	6161	49780	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:19.687866926 CET	6161	49840	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:19.688067913 CET	49840	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:19.688605070 CET	49840	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:19.808636904 CET	6161	49840	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:41.603882074 CET	6161	49840	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:41.604089975 CET	49840	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:46.667383909 CET	49840	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:46.771020889 CET	49901	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:46.787462950 CET	6161	49840	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:46.891284943 CET	6161	49901	178.208.169.197	192.168.2.10
Nov 25, 2024 15:23:46.891405106 CET	49901	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:46.906605005 CET	49901	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:23:47.030575037 CET	6161	49901	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:08.823280096 CET	6161	49901	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:08.823343039 CET	49901	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:13.830061913 CET	49901	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:13.834255934 CET	49961	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:13.954343081 CET	6161	49901	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:13.959095001 CET	6161	49961	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:13.959450006 CET	49961	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:13.959801912 CET	49961	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:14.084722042 CET	6161	49961	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:35.895684004 CET	6161	49961	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:35.895781994 CET	49961	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:40.908123970 CET	49961	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:41.263326883 CET	6161	49961	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:41.285124063 CET	49981	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:41.405666113 CET	6161	49981	178.208.169.197	192.168.2.10
Nov 25, 2024 15:24:41.407054901 CET	49981	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:41.407558918 CET	49981	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:24:41.529247999 CET	6161	49981	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:03.365143061 CET	6161	49981	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:03.365223885 CET	49981	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:08.376687050 CET	49981	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:08.496691942 CET	6161	49981	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:08.518354893 CET	49982	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:08.638715029 CET	6161	49982	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:08.638804913 CET	49982	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:08.639359951 CET	49982	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:08.759788990 CET	6161	49982	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:30.544533968 CET	6161	49982	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:30.544610023 CET	49982	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:35.548753023 CET	49982	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:35.550199032 CET	49983	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:35.669038057 CET	6161	49982	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:35.670193911 CET	6161	49983	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:35.670289993 CET	49983	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:35.670928001 CET	49983	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:25:35.792011023 CET	6161	49983	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:57.622186899 CET	6161	49983	178.208.169.197	192.168.2.10
Nov 25, 2024 15:25:57.622255087 CET	49983	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:26:02.658389091 CET	49983	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:26:02.678416014 CET	49984	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:26:02.779140949 CET	6161	49983	178.208.169.197	192.168.2.10
Nov 25, 2024 15:26:02.800168991 CET	6161	49984	178.208.169.197	192.168.2.10
Nov 25, 2024 15:26:02.803518057 CET	49984	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:26:02.806425095 CET	49984	6161	192.168.2.10	178.208.169.197
Nov 25, 2024 15:26:02.929914951 CET	6161	49984	178.208.169.197	192.168.2.10
Nov 25, 2024 15:26:24.716734886 CET	6161	49984	178.208.169.197	192.168.2.10
Nov 25, 2024 15:26:24.716856003 CET	49984	6161	192.168.2.10	178.208.169.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 15:22:24.582618952 CET	51014	53	192.168.2.10	1.1.1.1
Nov 25, 2024 15:22:25.178617954 CET	53	51014	1.1.1.1	192.168.2.10
Nov 25, 2024 15:24:40.909413099 CET	49676	53	192.168.2.10	1.1.1.1
Nov 25, 2024 15:24:41.284198999 CET	53	49676	1.1.1.1	192.168.2.10
Nov 25, 2024 15:25:08.377644062 CET	60506	53	192.168.2.10	1.1.1.1
Nov 25, 2024 15:25:08.516274929 CET	53	60506	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 15:22:24.582618952 CET	192.168.2.10	1.1.1.1	0x5ade	Standard query (0)	ducksex.ddnsfree.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:24:40.909413099 CET	192.168.2.10	1.1.1.1	0x31a	Standard query (0)	ducksex.ddnsfree.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:25:08.377644062 CET	192.168.2.10	1.1.1.1	0xae59	Standard query (0)	ducksex.ddnsfree.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 15:22:25.178617954 CET	1.1.1.1	192.168.2.10	0x5ade	No error (0)	ducksex.ddnsfree.com	178.208.169.197	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:24:41.284198999 CET	1.1.1.1	192.168.2.10	0x31a	No error (0)	ducksex.ddnsfree.com	178.208.169.197	A (IP address)	IN (0x0001)	false
Nov 25, 2024 15:25:08.516274929 CET	1.1.1.1	192.168.2.10	0xae59	No error (0)	ducksex.ddnsfree.com	178.208.169.197	A (IP address)	IN (0x0001)	false

Target ID:	4
Start time:	09:22:15
Start date:	25/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\N1f691bk5G.ps1"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000004.00000002.1316341250.0000023CB6DDA000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000004.00000002.1316341250.0000023CB512D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000004.00000002.1316341250.0000023CB472D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:22:15
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:22:19
Start date:	25/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0xc60000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000007.00000002.3742761083.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF7C1058F9D Relevance: 2.1, APIs: 1, Instructions: 598
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF7C10593F3

Memory Dump Source

Source File: 00000004.00000002.1379201273.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1050000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5fc37e36a3241825235ace4910bdc8742d84f66c20e3661bcad9017574f50abb
Instruction ID: aeba876b90884385f9f3cd63f805226004ae71b36f6629992b526bca072270ea
Opcode Fuzzy Hash: 5fc37e36a3241825235ace4910bdc8742d84f66c20e3661bcad9017574f50abb
Instruction Fuzzy Hash: EB124D70918A8D8FEBA8EF18CC597E977E1FB59310F40413AD80ED7291DB74A681CB85

Function 00007FF7C1058A7D Relevance: 1.7, APIs: 1, Instructions: 217
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FF7C1058BF2

Memory Dump Source

Source File: 00000004.00000002.1379201273.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1050000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 56fce12b41d2cef80e22e9d7164228436f1dbe7bb21b33f7f1ccd227a06ae83e
Instruction ID: 50a912d9f4d478d39c934bd12bf4bdb4feb8983677e6291375b18ea2192f1d8e
Opcode Fuzzy Hash: 56fce12b41d2cef80e22e9d7164228436f1dbe7bb21b33f7f1ccd227a06ae83e
Instruction Fuzzy Hash: 8C614970908A1C8FDB94DF68C885BE9BBF1FB69311F1082AAD44CE3255DB74A985CF40

Function 00007FF7C1058725 Relevance: 1.7, APIs: 1, Instructions: 181
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FF7C1058855

Memory Dump Source

Source File: 00000004.00000002.1379201273.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1050000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bea52138693507e126838b0f9e126697ded0431d09804274d5d6f42e80f1ad95
Instruction ID: 3ac4e2645a1d5c366dec94c35d8e230978b0d6d10f817115d6baa04aede86dab
Opcode Fuzzy Hash: bea52138693507e126838b0f9e126697ded0431d09804274d5d6f42e80f1ad95
Instruction Fuzzy Hash: 93514970908A4D8FDB54EFA8C845BEDBBF1FB59311F10826AD048E3255DB74A485CF40

Function 00007FF7C10585CD Relevance: 1.7, APIs: 1, Instructions: 156
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF7C10586BF

Memory Dump Source

Source File: 00000004.00000002.1379201273.00007FF7C1050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1050000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c2aa29921aa6a8098251d5790f72f47c807767ea7df746b8c35530f8ca4c8909
Instruction ID: 2ee7d0196c66253d6953fc7c472b0a849b653aa8d440ad782e819f8aefacde08
Opcode Fuzzy Hash: c2aa29921aa6a8098251d5790f72f47c807767ea7df746b8c35530f8ca4c8909
Instruction Fuzzy Hash: 4F516970D0874C8FDB55DFA8C885AEDBBF0FF56320F1041AAD449E7292DA74A486CB51

Function 00007FF7C1123219 Relevance: .3, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1379819151.00007FF7C1120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99abbe93ed0740fd21711513552102bd773a58e2508eb9407e1f3b02da3e685c
Instruction ID: 0a74750c6411d156171f698cac1eaa45d035d844d256fe64d4f3d1855957b387
Opcode Fuzzy Hash: 99abbe93ed0740fd21711513552102bd773a58e2508eb9407e1f3b02da3e685c
Instruction Fuzzy Hash: 20917931E1CAC98FE79EEE2868511B8BBD1EF4A670B8841FED049C7183DD58AC068351

Function 00007FF7C1122240 Relevance: .3, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1379819151.00007FF7C1120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2880f0a2de86a9dcb2d818cbab064f99f56c7c595cb14b3b38dd886f0f547bab
Instruction ID: 0804bdfab7c630d4c232042f4aa74aa05edb95f61167f71f49322da3bcd06f83
Opcode Fuzzy Hash: 2880f0a2de86a9dcb2d818cbab064f99f56c7c595cb14b3b38dd886f0f547bab
Instruction Fuzzy Hash: 6D914831E0CA898FE795EF2C68546B8BBE1EF59720B8802FAD04DC7193DD5CAC058761

Analysis Process: aspnet_compiler.exePID: 5420, Parent PID: 7288COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	3

Executed Functions

Function 01747EC0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01747F4F

Memory Dump Source

Source File: 00000007.00000002.3746438875.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1740000_aspnet_compiler.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c713a938a66bd5307548577aa4494aa29c3124c9d50fbce3e6c312887adc997c
Instruction ID: bb5c5e40e7e5f9bb3400fa35648525fb3838dea4c7b393abe142692a32b8c789
Opcode Fuzzy Hash: c713a938a66bd5307548577aa4494aa29c3124c9d50fbce3e6c312887adc997c
Instruction Fuzzy Hash: A821E0B59002589FDB10CFAAD584AEEBBF5EB48310F24841AE918A7350D374A951CFA0

Function 01747EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01747F4F

Memory Dump Source

Source File: 00000007.00000002.3746438875.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1740000_aspnet_compiler.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 435a603ca1b5d3e33b7d1e922f5ea1d616c0d64668a6b84eefd18c97556ae0f0
Instruction ID: 4411b8d36c52a2b7043a27b2bd1e9a08ef27e3e83db50be5a318fcf37b64865a
Opcode Fuzzy Hash: 435a603ca1b5d3e33b7d1e922f5ea1d616c0d64668a6b84eefd18c97556ae0f0
Instruction Fuzzy Hash: D521E2B59003089FDB10CFAAD984ADEFBF8EB48310F14841AE918A3350D374A941CFA4

Function 017429C2 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01742A43

Memory Dump Source

Source File: 00000007.00000002.3746438875.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1740000_aspnet_compiler.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2273e7f9f4d2a4c587e8733d9d7264ea1dab339963a41064fee79db5f36230b5
Instruction ID: ae95883b55ee2e8acfdd451bba4c713c07169e0b2637ec6fdf109f73c5f174cf
Opcode Fuzzy Hash: 2273e7f9f4d2a4c587e8733d9d7264ea1dab339963a41064fee79db5f36230b5
Instruction Fuzzy Hash: BC2135B5D002098FDB24DF9AD944BEEFBF5FB88310F14842AE814A7250C774A941CFA0

Function 017429C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01742A43

Memory Dump Source

Source File: 00000007.00000002.3746438875.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1740000_aspnet_compiler.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2f8bff2175be8be338030bb7dc709495cdb98570165e5d09f6868d2b00ddd85f
Instruction ID: aa2f6ea3dee3e4f6b7037c4d4b796655d14210208f7b3aa39a0f636def36643d
Opcode Fuzzy Hash: 2f8bff2175be8be338030bb7dc709495cdb98570165e5d09f6868d2b00ddd85f
Instruction Fuzzy Hash: E1211575D002098FDB24DF9AD944BEEFBF5FB88310F148429E815A7250C774A945CFA1

Function 0174D368 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0174D3DD

Memory Dump Source

Source File: 00000007.00000002.3746438875.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1740000_aspnet_compiler.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f29696a9f5d4a3638340dd2c2b502fc3d5012b139a866dee5357679b1c2ce620
Instruction ID: afe01a067f618dfc30eeea14879016ea337e7d55a4e841fa05d69b8c33cdfcff
Opcode Fuzzy Hash: f29696a9f5d4a3638340dd2c2b502fc3d5012b139a866dee5357679b1c2ce620
Instruction Fuzzy Hash: 7811E6B5804399DFDB20CF9AC5497EEBFF4EB08310F1444A9E588A7682C7399504CBB5

Function 0174D378 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0174D3DD

Memory Dump Source

Source File: 00000007.00000002.3746438875.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1740000_aspnet_compiler.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ab06a32784aef99b1523fae24aab02ab4e72f5545ad055565c98692a812e08d3
Instruction ID: 50407794f2830a691023622b9a28d3adffdb9a569b6cebf38622eec0f74b5946
Opcode Fuzzy Hash: ab06a32784aef99b1523fae24aab02ab4e72f5545ad055565c98692a812e08d3
Instruction Fuzzy Hash: 7D11C1B1804399CFDB20CF9AC5097EEBFF4EB08310F148099E599A3282C7396604CBB5

Function 0125D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3744030792.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b90a1b2a0ca70dc708ae557827a7f2ccdc7b4beb5a837a8acf89afe9162b3ca
Instruction ID: d14c54363e2d0d23d853e445c79d2ba03f57edac9d53b1f14e5cd5965e8ea815
Opcode Fuzzy Hash: 8b90a1b2a0ca70dc708ae557827a7f2ccdc7b4beb5a837a8acf89afe9162b3ca
Instruction Fuzzy Hash: FA2122B1514208DFEB45DF94C9C0B26BBA1EB88224F24C56DDD0A4B256C37AD846CA62

Function 0125D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3744030792.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f327db0e2ed1f5e683527615b2bec1ac9a86c970599db5efe8bf84bff6eed3
Instruction ID: 4294e0a96c84f512dd7894ff57b6575dc1dc070e4d0a301fa31219e8a50c51ad
Opcode Fuzzy Hash: d3f327db0e2ed1f5e683527615b2bec1ac9a86c970599db5efe8bf84bff6eed3
Instruction Fuzzy Hash: 1B11DD75504284CFDB06CF54D9C4B15BFB1FB84314F28C6AADD494B656C33AD44ACBA1

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report N1f691bk5G.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlty4eam.xnw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxnp3xch.mql.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9RQ765J2TNLQ7VMQB78E.temp

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
N1f691bk5G.ps1

Function 00007FF7C1058F9D Relevance: 2.1, APIs: 1, Instructions: 598
processCOMMON

Function 00007FF7C1058A7D Relevance: 1.7, APIs: 1, Instructions: 217
injectionCOMMON

Function 00007FF7C1058725 Relevance: 1.7, APIs: 1, Instructions: 181
threadCOMMON

Function 00007FF7C10585CD Relevance: 1.7, APIs: 1, Instructions: 156
threadCOMMON

Function 00007FF7C1123219 Relevance: .3, Instructions: 333
COMMON

Function 00007FF7C1122240 Relevance: .3, Instructions: 309
COMMON

Function 01747EC0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 01747EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 017429C2 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 017429C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 0174D368 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 0174D378 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON