Edit tour

Windows Analysis Report
zvXPSu3dK5.exe

Overview

General Information

Sample name:	zvXPSu3dK5.exe renamed because original name is a hash value
Original sample name:	ce9371e8ef7c084640e3fcf59bfb4bd5439bea0a4649cd971a3517205574c7f0.exe
Analysis ID:	1573862
MD5:	b2e52a44834f06fba71aa8848714bf97
SHA1:	524d5653ebd1fb343f7cd8190536b25cec4082ff
SHA256:	ce9371e8ef7c084640e3fcf59bfb4bd5439bea0a4649cd971a3517205574c7f0
Tags:	envnuev1124-duckdns-orgexeuser-JAMESWT_MHT
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AsyncRAT

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

zvXPSu3dK5.exe (PID: 3524 cmdline: "C:\Users\user\Desktop\zvXPSu3dK5.exe" MD5: B2E52A44834F06FBA71AA8848714BF97)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"External_config_on_Pastebin": "null", "Server": "envnuev1124.duckdns.org", "Ports": "3013", "Version": "| CRACKED BY https://t.me/xworm_v2", "Autorun": "false", "Install_Folder": "cE5YcGRiQ2tZRmVnWFhWT1B5STFUNm9mVXhZbUtHMVc=", "Install_File": "u+IClhfNDH2v5/ITCehCWdlfT6x5HInctrFCAdC2ui1bgbclbh7z5M1BzH6qyKiyJENTQKeUFk+bfc/Qfv2QNolb9eoE6CtkgauKPpSWN6Y=", "AES_key": "pNXpdbCkYFegXXVOPyI1T6ofUxYmKG1W", "Mutex": "GtOED+Ry5OzQroqL8VTF7kRnABQjPDBSBK77Mx2Io0FIGol6em/XVswHzSV7DyFzu101/QhKQkOKD/GUYNEvv+k3v0LQX/jm6TNz1x7pm04w7sBMwlNmEC5EAlxfzI8zfcJTJtNDsOnrx13rhbpoRburdAlVGXVOnttBPIZDGIYZcb5X2LAVSXGOli1dFbfTyQQVC3uhvKwcW9wBL+wh6y7N8vuxV6b/yPPWxM6jdMtytgFIvl7cHXL3Aj452vWbQWYbx7yS+X5LPv/tJbg+pJ/b5//xTDDch+tUsrft8nh4R+MmwXIj2r5gHpmDtQ77cg6dDyGRV5yYQeSts5v413IToDTLFFGtPTfIsJnvUTZBqehoscm+d6M56X4Ir1apO2Nvs0Edf+d38xnDKBWXTmN3L3GAnvzAk3yRxXwU6UmEXfwodryGDe4J2wxs60USpB82EEGfS2VtKbB2irCbls7l/H9lnKdLgg9UR1BS5JUnzUvGvxhx4x0riFwcsqWP7cGXLI7ZGNRBLIh1yATD4fTJ9dTf5I8MTwOBQI/4LXELLecXjJxQPo0UVlMm6Re48Ac9Y4ewngAazpYw1dC1Ci+W5/54nyCe6BlhiXdvdqgs6RdloskDyE1FyA7YWxmdWOCID1NPL0cR7Ud2yVyr5GRPeXH99RwpU2/6v43R1nc=", "Certificate": "false", "ServerSignature": "false", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zvXPSu3dK5.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
zvXPSu3dK5.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
zvXPSu3dK5.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xc58c:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xf438:$a2: Stub.exe 0xf4c8:$a2: Stub.exe 0x8fe2:$a3: get_ActivatePong 0xc7a4:$a4: vmware 0xc61c:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9ee9:$a6: get_SslClient
zvXPSu3dK5.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc61e:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc41e:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: zvXPSu3dK5.exe PID: 3524	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: zvXPSu3dK5.exe PID: 3524	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb5c9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.zvXPSu3dK5.exe.550000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.zvXPSu3dK5.exe.550000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.zvXPSu3dK5.exe.550000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xc58c:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xf438:$a2: Stub.exe 0xf4c8:$a2: Stub.exe 0x8fe2:$a3: get_ActivatePong 0xc7a4:$a4: vmware 0xc61c:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9ee9:$a6: get_SslClient
0.0.zvXPSu3dK5.exe.550000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc61e:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zvXPSu3dK5.exe

Avira: detected

Antivirus detection for URL or domain

Source: envnuev1124.duckdns.org

Avira URL Cloud: Label: malware

Found malware configuration

Source: zvXPSu3dK5.exe

Malware Configuration Extractor: AsyncRAT {"External_config_on_Pastebin": "null", "Server": "envnuev1124.duckdns.org", "Ports": "3013", "Version": "| CRACKED BY https://t.me/xworm_v2", "Autorun": "false", "Install_Folder": "cE5YcGRiQ2tZRmVnWFhWT1B5STFUNm9mVXhZbUtHMVc=", "Install_File": "u+IClhfNDH2v5/ITCehCWdlfT6x5HInctrFCAdC2ui1bgbclbh7z5M1BzH6qyKiyJENTQKeUFk+bfc/Qfv2QNolb9eoE6CtkgauKPpSWN6Y=", "AES_key": "pNXpdbCkYFegXXVOPyI1T6ofUxYmKG1W", "Mutex": "GtOED+Ry5OzQroqL8VTF7kRnABQjPDBSBK77Mx2Io0FIGol6em/XVswHzSV7DyFzu101/QhKQkOKD/GUYNEvv+k3v0LQX/jm6TNz1x7pm04w7sBMwlNmEC5EAlxfzI8zfcJTJtNDsOnrx13rhbpoRburdAlVGXVOnttBPIZDGIYZcb5X2LAVSXGOli1dFbfTyQQVC3uhvKwcW9wBL+wh6y7N8vuxV6b/yPPWxM6jdMtytgFIvl7cHXL3Aj452vWbQWYbx7yS+X5LPv/tJbg+pJ/b5//xTDDch+tUsrft8nh4R+MmwXIj2r5gHpmDtQ77cg6dDyGRV5yYQeSts5v413IToDTLFFGtPTfIsJnvUTZBqehoscm+d6M56X4Ir1apO2Nvs0Edf+d38xnDKBWXTmN3L3GAnvzAk3yRxXwU6UmEXfwodryGDe4J2wxs60USpB82EEGfS2VtKbB2irCbls7l/H9lnKdLgg9UR1BS5JUnzUvGvxhx4x0riFwcsqWP7cGXLI7ZGNRBLIh1yATD4fTJ9dTf5I8MTwOBQI/4LXELLecXjJxQPo0UVlMm6Re48Ac9Y4ewngAazpYw1dC1Ci+W5/54nyCe6BlhiXdvdqgs6RdloskDyE1FyA7YWxmdWOCID1NPL0cR7Ud2yVyr5GRPeXH99RwpU2/6v43R1nc=", "Certificate": "false", "ServerSignature": "false", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Multi AV Scanner detection for submitted file

Source: zvXPSu3dK5.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: zvXPSu3dK5.exe

Joe Sandbox ML: detected

Source: zvXPSu3dK5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zvXPSu3dK5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: envnuev1124.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: envnuev1124.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: zvXPSu3dK5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 192.169.69.26 192.169.69.26
Source: Joe Sandbox View	IP Address: 192.169.69.26 192.169.69.26

Source: Joe Sandbox View

ASN Name: WOWUS WOWUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: envnuev1124.duckdns.org

Source: zvXPSu3dK5.exe, 00000000.00000002.4632419326.00000000028A1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: https://t.me/xworm_v2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: zvXPSu3dK5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zvXPSu3dK5.exe PID: 3524, type: MEMORYSTR

Contains functionality to log keystrokes (.Net Source)

Source: zvXPSu3dK5.exe, LimeLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: zvXPSu3dK5.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: zvXPSu3dK5.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: zvXPSu3dK5.exe PID: 3524, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: zvXPSu3dK5.exe, 00000000.00000000.2187491148.0000000000562000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs zvXPSu3dK5.exe
Source: zvXPSu3dK5.exe	Binary or memory string: OriginalFilenameStub.exe" vs zvXPSu3dK5.exe

Source: zvXPSu3dK5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zvXPSu3dK5.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: zvXPSu3dK5.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: zvXPSu3dK5.exe PID: 3524, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: zvXPSu3dK5.exe, Settings.cs

Base64 encoded string: 'JKU8JxGpHRZRuzjAxuPqlr/bgoKjjNDMVWjKm4s6ayBgpl3W9N3cfKmi/B+DWXKJz1AXDph1pynMRE2nP9F9Dg==', 'W6l2oqDdWTUJ/M0XW1kBIfO/el9Tg/xyTUchP4eRiGnt4Qp2s2Plj5FisGAjUopkJGWOQq8xLKHa8XHBnu8zDg0Ms0slsViKDqz2Iw+9Rr0=', 'tuQhJgJZ3dthwzwCl1ddIn0p5X/XxJjgXSMecrScbC+n97OHvSiqyVpcczAue0KtgAtj7j3w4Yv6UVmZ05Oa0AHPE4JI8EM49U6+vbYApEfOYVHn518laO9Vx43ojxo+', 'u+IClhfNDH2v5/ITCehCWdlfT6x5HInctrFCAdC2ui1bgbclbh7z5M1BzH6qyKiyJENTQKeUFk+bfc/Qfv2QNolb9eoE6CtkgauKPpSWN6Y=', 'ziz3oMie+BKmgAQGnaVBkMXZRQsmLHwG3+QJ493XVfkAyec5kBaAwkk6HKjg+5C/eV0ZSnNY3coEby0+bFZMeR148HOJRwfQ1q+Mzrk4ToBtNajvbvtTpzgdTC4JeWR0NWLNsQVySW5+Dvnj+dr4QwZi4SUwQq2EdOovpdqtVVgXtHeTeab/MOIdgY8ccn6HEMkpd6CxxF6AUb0aMWA1XvXPaNEYeFIRwCXUQ3DPxHD1gteA8kR1Go2wfhRnlJIZ5OPnP/2xYb013jNhDtZzp/U7tXduHjnQPmE4qDoBoYNPoE3x9bJU1y7nUNwwMg2mQkq/opHdvRxrqJg/mbEOG9pGQnoS+XrF0J0UeAT0E1LJeJZoSKtlFg0BxkdTUbJE479/cglaVnRR921Ac3kWLzo5IaYYMbfNv1A7jtVU9OdoCBsMMxHlTZTY5t37J/bU86CqWHO3FK1PnaabzwKXazNxdKkGg1y2KBGx/biuIsjYOhpMWM3M9JOjVjd4f/UFQ+FUHp4EcDDKw9PYuzKuSpW1ARicVquTaaHYWQFo8kanAUQVEYgZOtSE2pXnbBbuCFdAmn45fBUjLWx7j/JuHoT7+DgaRymfm/1IY2pQLv8sNNH9BHDePymswoxrEQnqkA2A6SFlkljKk9cd25y4qFswbcDMT5TAuVVIdxgAOear5j6FfS4yfiZIi3HNB7dkiKdsXiBrrbP5ZbvqRlwWcznX/BbVVIsgzLWtHHAEBHYhPoJl2TBiIvZK8BsfAxRWs1Sqs3SZjuTOj49iD0dOjTkRlPFrgpyOhtcgpUdysfVfr5JaEkgogrhIEgL2+ieSaFZywzk3o0deY2t25jO5tjliDU2tBByU4Qk/1rOiLnXekRSm0M93cylh7KgHbVtct+ZrqWNtz0OmLwmdBN/k5YOR4z5lCK/+naHLlQnybqBFKPG2l2QNZqZibsW2tr5Jr443ZDhN7KuQoFqxeFXTNOJ/ikmi68OvRSILCRgSopAhuwPaqgDaFEjcKqxraCyxo2y5uU4+Zd/4uA2DHl0Gjk5P2c6CFjH4UKs9JmcjLjbeBDn1Wv+oXDngFP1sfkyLQ/HMVXdOq8leZNgKPJ4eeMfV5lPd7eduUUxFTRmRQr6MRw2COdiIQqEYAIj0+HSPLOedhhub+6RM7Aozqh/CzuR96SWFoMl0fJILuyml8ke0UKEmt3C01W6Ks4PbVsAkUxxoY9AgYC6tT1Jz2bN7JqdbwwzRFXw40nSPGBup3lr/H80kecdvWHgC28mpsrgFAmvCbTgwvgxAEwZwy+PpjGoMCNy5rb3N4ZbBT/OZ7CJk1kNofw4eD04ubCsXQcmFKHMx7u4EAitq8DwDr44vYU7UFD7NOGvVpFMOeKqEcKcjmWGTjyzgpd3/fyIN3iCnHDxerWoyLDvWWNU0ajzOCdFJ+6x4c+BLR4xjXpGSnhwf/MWo3DkF1DUjpU9yaITXHiizbF1+ch+JozKp6b3CnO4gL+5YUdSPEPJ7kyTUJJRE02bLTUWc4WzPrsDhNyyWER9icC9vYBSjZBpAZlBd6FjwE3iEX/5lqcQEF5BbRl0gio37zvmisl7kYO9DAfFiJd5Ii+9lfXYXSNn+ie8RNSUIt2ICkMBHvPa+HJcJRiaVOurcuGMxOsBoRPM7efVzkX8ASN/JfpoDULA/rbG4b2Y37h1+Vyh+OOZgLApfE8FsxfE1gJx9K4GkzHQeEBroxL+CfuL/7oFmFzjC59dx6Wt819oJMNwQiJRXZ5xesowhsJgTtRvutG/7QrQ1w8SDpu+jdNebxtXTgD4EN+iqvwcyG6quVTEJDdap4raHOmwk8qIezxRxFuBuGXngSLaWVvosxJ3PZCsx7kJdy4cxuEG3/p6XMlwNv9BFqfTFEEd3pjcoGACym+83Zs4sEY7obcjFQEDtyEYq6FLFNtbly0xabQ4Yr6UM0OqbmyXQQ6uo+TiCNmeQWgn7oG+ErTOh7U6FEzkc0MHQoJ9qlqbCdqYBopvPDk8qXq7sKkEaiKj0hB3LX5d0HtDsODPnHkFGqupo5dSxbvIg4DsQTErob602m1+oZmUlpN41QBZaUqk5hOYPwI0W8hTBkXajp9Mf6/0lehotbnRdciMvmfi5WBcy/XVFtMx4VRFlQl8qJKizPvAvISakXp2RDSG6+F8Y2PzTQQ7LRQc7mIO9AHTErHboUq8SfHgiKYIIAS3e7/0OJBtODWri46Se4H0BljmHpfuK2QP+hm5qjHsKjL66ZDeDWnpcPEliTAtTIQPd7W4GeLlwdDu/inf/r0P5VOwqHMEVMXaPDq+qtyD0XMUuxj0iMfeB17tfa6ustH7AT98=', 'RticzVCFQ4Hcu1Xo8XH2F1fJRxtCNfzpwM7NxLsmQvmeMjbxoMmmQnK4fiyWbWs4cOK5nU4MjMn768HX/dpAoZQZAsi4tXOPUEErsWFDvRU/U5od2n5IBw5GdsVuoNMTGl+vqdGHOXFSVIb4UfPkVQjqmBSQl9h4s8NCPYdLoPKtvrk/v7di4obZWgvJWBa5ShPP41e

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@4/1

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk

Source: zvXPSu3dK5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: zvXPSu3dK5.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zvXPSu3dK5.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Section loaded: schannel.dll	Jump to behavior

Source: zvXPSu3dK5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: zvXPSu3dK5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: zvXPSu3dK5.exe, Packet.cs

.Net Code: Plugins System.AppDomain.Load(byte[])

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: zvXPSu3dK5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zvXPSu3dK5.exe PID: 3524, type: MEMORYSTR

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: zvXPSu3dK5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zvXPSu3dK5.exe PID: 3524, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: zvXPSu3dK5.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

Window / User API: threadDelayed 9718

Jump to behavior

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe TID: 1964	Thread sleep count: 261 > 30	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe TID: 1964	Thread sleep time: -261000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe TID: 1964	Thread sleep count: 9718 > 30	Jump to behavior
Source: C:\Users\user\Desktop\zvXPSu3dK5.exe TID: 1964	Thread sleep time: -9718000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: zvXPSu3dK5.exe	Binary or memory string: vmware
Source: zvXPSu3dK5.exe, 00000000.00000002.4633145670.0000000004D86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^T

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

Queries volume information: C:\Users\user\Desktop\zvXPSu3dK5.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\zvXPSu3dK5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: zvXPSu3dK5.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zvXPSu3dK5.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zvXPSu3dK5.exe PID: 3524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	1 Input Capture	11 Security Software Discovery	Remote Services	1 Input Capture	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	21 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
zvXPSu3dK5.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.AsyncRATMarte
zvXPSu3dK5.exe	100%	Avira	TR/Dropper.Gen
zvXPSu3dK5.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
envnuev1124.duckdns.org	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
envnuev1124.duckdns.org	192.169.69.26	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
envnuev1124.duckdns.org	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/xworm_v2	zvXPSu3dK5.exe, 00000000.00000002.4632419326.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.169.69.26	envnuev1124.duckdns.org	United States		23033	WOWUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573862
Start date and time:	2024-12-12 17:05:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zvXPSu3dK5.exe renamed because original name is a hash value
Original Sample Name:	ce9371e8ef7c084640e3fcf59bfb4bd5439bea0a4649cd971a3517205574c7f0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@4/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 22 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.231.128.65, 40.126.53.19, 40.126.53.18, 40.126.53.7, 20.190.181.1, 20.190.181.3, 20.231.128.67, 40.126.53.9, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target zvXPSu3dK5.exe, PID 3524 because it is empty
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: zvXPSu3dK5.exe

Simulations

Behavior and APIs

Time	Type	Description
11:07:05	API Interceptor	7895397x Sleep call for process: zvXPSu3dK5.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.169.69.26	f5ATZ1i5CU.exe	Get hash	malicious	RedLine, XWorm	Browse	duclog23.duckdns.org:37552/
	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	yuya0415.duckdns.org:1928/Vre
	confirmaci#U00f3n y correcci#U00f3n de la direcci#U00f3n de entrega.vbs	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	oKtkBYZMWl.exe	Get hash	malicious	Unknown	Browse	csacsadhe.duckdns.org/byfronbypass.html/css/mss/Arzgohi.mp3
	oKtkBYZMWl.exe	Get hash	malicious	Unknown	Browse	csacsadhe.duckdns.org/byfronbypass.html/css/mss/Arzgohi.mp3
	http://yvtplhuqem.duckdns.org/ja/	Get hash	malicious	Unknown	Browse	yvtplhuqem.duckdns.org/ja/
	http://fqqqffcydg.duckdns.org/en/	Get hash	malicious	Unknown	Browse	fqqqffcydg.duckdns.org/en/
	http://yugdzvsqnf.duckdns.org/en/	Get hash	malicious	Unknown	Browse	yugdzvsqnf.duckdns.org/en/
	&nuevo_pedido#..vbs	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	transferencia_Hsbc.xlsx	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WOWUS	173398584769f9c5bcf28a71f77fba1335e77fe6b4cc4f05afc05fdd9f5830429be0bc9fb5758.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.169.69.26
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	192.169.69.26
	1733858044e64c59622ab494dda2ff98fce76991f7e15e513d6a3620e7f58ad7cc67d3889c571.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	192.169.69.26
	f5ATZ1i5CU.exe	Get hash	malicious	RedLine, XWorm	Browse	192.169.69.26
	P0J8k3LhVV.exe	Get hash	malicious	Nanocore	Browse	192.169.69.26
	173349055645d097cf36f6a7cc8cd8874001209539b453cb16f6acd61c0d845ab62e19e89d339.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	192.169.69.26
	173349048648c854fdb460c6c7c5fd91e325ea882961d8aa5918c705b053bb8e9350ae27c8877.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	192.169.69.26
	17334905521d597933f8aaddb97573b46d117b288a865f8a218fac0e15588edac3edcab35b588.dat-decoded.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	192.169.69.26
	17334905555b1bb5616b6229d3e91468cd944baaeea0d1c904cc91a0fe89b683d653c3710f732.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	192.169.69.26
	17334792691d3587abc182d697c2a82dd4ad88afaea9fc5290ea9e42c7eec649b5ab319fda603.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	192.169.69.26

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.393189675410835
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	zvXPSu3dK5.exe
File size:	64'512 bytes
MD5:	b2e52a44834f06fba71aa8848714bf97
SHA1:	524d5653ebd1fb343f7cd8190536b25cec4082ff
SHA256:	ce9371e8ef7c084640e3fcf59bfb4bd5439bea0a4649cd971a3517205574c7f0
SHA512:	ff535bcbeee84f06a00b1d1636d80e4cd02d05b107fbbfe4ad6be855454d713553c5b985f4b99d87ef0d7f56d598affe1f4550ecd1a74f97aa4c5a3e2255cdc1
SSDEEP:	1536:KmImx6tX2kNff4sKu+UYFDGXw5bfAPAHPrPlTGZx:Km9x6tmkN7Ku+UYFDGXw5bffdix
TLSH:	DE53E7013BF98029F3BE8F7469F6658506FAF5AB2D11C55D1CC544CE0A22B829E41BFB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.]V................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x410ebe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x565DF738 [Tue Dec 1 19:38:32 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10e68	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x7ff	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xeec4	0xf000	49ebc4c95611dc04214116977e5804b8	False	0.4557291666666667	data	5.43003976071433	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x7ff	0x800	33cdbc5c50f34a35b4f0e61582ac7f11	False	0.41650390625	data	4.884866150337139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	4e8998a682eb7ba8de67035194ed11c9	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x2cc	data			0.43575418994413406
RT_MANIFEST	0x1236c	0x493	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.43381725021349277

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 17:06:33.461023092 CET	49721	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:33.580878019 CET	3013	49721	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:33.580964088 CET	49721	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:33.592609882 CET	49721	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:33.712318897 CET	3013	49721	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:43.902324915 CET	3013	49721	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:43.902412891 CET	49721	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:49.089649916 CET	49721	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:49.090538979 CET	49759	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:49.209480047 CET	3013	49721	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:49.210262060 CET	3013	49759	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:49.210383892 CET	49759	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:49.210768938 CET	49759	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:06:49.330570936 CET	3013	49759	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:59.556165934 CET	3013	49759	192.169.69.26	192.168.2.5
Dec 12, 2024 17:06:59.556701899 CET	49759	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:04.572427034 CET	49759	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:04.573566914 CET	49794	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:04.692882061 CET	3013	49759	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:04.693386078 CET	3013	49794	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:04.693486929 CET	49794	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:04.693840027 CET	49794	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:04.814544916 CET	3013	49794	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:15.011074066 CET	3013	49794	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:15.011149883 CET	49794	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:20.026906967 CET	49794	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:20.027594090 CET	49832	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:20.146723032 CET	3013	49794	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:20.147397041 CET	3013	49832	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:20.147511005 CET	49832	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:20.147907019 CET	49832	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:20.268129110 CET	3013	49832	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:30.494868994 CET	3013	49832	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:30.494968891 CET	49832	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:35.510045052 CET	49832	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:35.759157896 CET	3013	49832	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:35.867681980 CET	49871	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:35.987494946 CET	3013	49871	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:35.987741947 CET	49871	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:35.988254070 CET	49871	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:36.108194113 CET	3013	49871	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:46.312889099 CET	3013	49871	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:46.313075066 CET	49871	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:51.601905107 CET	49871	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:51.602814913 CET	49908	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:51.722105980 CET	3013	49871	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:51.722940922 CET	3013	49908	192.169.69.26	192.168.2.5
Dec 12, 2024 17:07:51.723041058 CET	49908	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:51.731596947 CET	49908	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:07:51.852888107 CET	3013	49908	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:02.085725069 CET	3013	49908	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:02.085787058 CET	49908	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:07.434802055 CET	49908	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:07.435751915 CET	49942	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:07.555120945 CET	3013	49908	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:07.555566072 CET	3013	49942	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:07.555671930 CET	49942	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:07.577013016 CET	49942	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:07.696947098 CET	3013	49942	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:17.831150055 CET	3013	49942	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:17.834358931 CET	49942	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:22.838210106 CET	49942	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:22.839018106 CET	49977	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:22.959570885 CET	3013	49942	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:22.959589005 CET	3013	49977	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:22.959696054 CET	49977	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:22.960043907 CET	49977	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:23.080761909 CET	3013	49977	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:33.233784914 CET	3013	49977	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:33.233942986 CET	49977	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:38.244354963 CET	49977	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:38.364197969 CET	3013	49977	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:38.558929920 CET	50008	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:38.679619074 CET	3013	50008	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:38.679707050 CET	50008	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:38.680064917 CET	50008	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:38.800030947 CET	3013	50008	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:49.046509027 CET	3013	50008	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:49.049918890 CET	50008	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:54.072566032 CET	50008	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:54.073594093 CET	50009	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:54.192723989 CET	3013	50008	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:54.195164919 CET	3013	50009	192.169.69.26	192.168.2.5
Dec 12, 2024 17:08:54.195255995 CET	50009	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:54.195621967 CET	50009	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:08:54.317715883 CET	3013	50009	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:04.516196966 CET	3013	50009	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:04.516325951 CET	50009	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:09.525799990 CET	50009	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:09.526679993 CET	50010	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:09.645684004 CET	3013	50009	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:09.646507978 CET	3013	50010	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:09.646567106 CET	50010	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:09.647036076 CET	50010	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:09.766701937 CET	3013	50010	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:19.946086884 CET	3013	50010	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:19.946142912 CET	50010	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:24.947344065 CET	50010	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:24.948165894 CET	50012	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:25.067090988 CET	3013	50010	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:25.067965031 CET	3013	50012	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:25.068078041 CET	50012	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:25.068754911 CET	50012	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:25.188785076 CET	3013	50012	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:35.402837038 CET	3013	50012	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:35.404768944 CET	50012	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:40.416140079 CET	50012	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:40.536032915 CET	3013	50012	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:40.754005909 CET	50013	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:40.875909090 CET	3013	50013	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:40.875996113 CET	50013	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:40.876436949 CET	50013	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:40.996189117 CET	3013	50013	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:51.244710922 CET	3013	50013	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:51.246356964 CET	50013	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:56.260489941 CET	50013	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:56.261811018 CET	50014	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:56.383454084 CET	3013	50013	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:56.383474112 CET	3013	50014	192.169.69.26	192.168.2.5
Dec 12, 2024 17:09:56.383570910 CET	50014	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:56.384140015 CET	50014	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:09:56.506118059 CET	3013	50014	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:06.716358900 CET	3013	50014	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:06.721414089 CET	50014	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:11.728753090 CET	50014	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:11.729891062 CET	50017	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:11.963479996 CET	3013	50014	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:11.963499069 CET	3013	50017	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:11.963587999 CET	50017	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:11.963974953 CET	50017	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:12.223294020 CET	3013	50017	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:22.290518999 CET	3013	50017	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:22.290581942 CET	50017	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:27.322416067 CET	50017	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:27.323280096 CET	50018	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:27.445158005 CET	3013	50017	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:27.446154118 CET	3013	50018	192.169.69.26	192.168.2.5
Dec 12, 2024 17:10:27.446274042 CET	50018	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:27.446594000 CET	50018	3013	192.168.2.5	192.169.69.26
Dec 12, 2024 17:10:27.566528082 CET	3013	50018	192.169.69.26	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 17:06:33.140758991 CET	51737	53	192.168.2.5	1.1.1.1
Dec 12, 2024 17:06:33.458113909 CET	53	51737	1.1.1.1	192.168.2.5
Dec 12, 2024 17:07:35.510627985 CET	64918	53	192.168.2.5	1.1.1.1
Dec 12, 2024 17:07:35.866729021 CET	53	64918	1.1.1.1	192.168.2.5
Dec 12, 2024 17:08:38.245151043 CET	51296	53	192.168.2.5	1.1.1.1
Dec 12, 2024 17:08:38.557914019 CET	53	51296	1.1.1.1	192.168.2.5
Dec 12, 2024 17:09:40.416907072 CET	56733	53	192.168.2.5	1.1.1.1
Dec 12, 2024 17:09:40.752660990 CET	53	56733	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 17:06:33.140758991 CET	192.168.2.5	1.1.1.1	0x18e1	Standard query (0)	envnuev1124.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:07:35.510627985 CET	192.168.2.5	1.1.1.1	0x48f0	Standard query (0)	envnuev1124.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:08:38.245151043 CET	192.168.2.5	1.1.1.1	0xbc65	Standard query (0)	envnuev1124.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:09:40.416907072 CET	192.168.2.5	1.1.1.1	0x1eae	Standard query (0)	envnuev1124.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 17:06:33.458113909 CET	1.1.1.1	192.168.2.5	0x18e1	No error (0)	envnuev1124.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:07:35.866729021 CET	1.1.1.1	192.168.2.5	0x48f0	No error (0)	envnuev1124.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:08:38.557914019 CET	1.1.1.1	192.168.2.5	0xbc65	No error (0)	envnuev1124.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:09:40.752660990 CET	1.1.1.1	192.168.2.5	0x1eae	No error (0)	envnuev1124.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:06:27
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\zvXPSu3dK5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zvXPSu3dK5.exe"
Imagebase:	0x550000
File size:	64'512 bytes
MD5 hash:	B2E52A44834F06FBA71AA8848714BF97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.2187461490.0000000000552000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Function 026C2075 Relevance: 9.3, Strings: 7, Instructions: 509COMMON

Download Yara Rule

Strings

a]q, xrefs: 026C2704
xaq, xrefs: 026C273E
a]q, xrefs: 026C26A7
3Dp^, xrefs: 026C251F
,, xrefs: 026C2238
\q, xrefs: 026C2078
#Dp^, xrefs: 026C2654

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: a]q$ a]q$,$xaq$#Dp^$3Dp^$\q
API String ID: 0-1751023379
Opcode ID: 5053ce56777234509e3928a2a0d2032f7755d49d7d98a2418e426fb4911a45fc
Instruction ID: edc4b3e4a6f824c0f80760a2f1143fd707b7609623bc39da8dbe427dca3b5140
Opcode Fuzzy Hash: 5053ce56777234509e3928a2a0d2032f7755d49d7d98a2418e426fb4911a45fc
Instruction Fuzzy Hash: 4E02AE747006019FDB15EF28D494B6E77E2FF85314F208A6CE8069B3A5DBB49C86CB91

Function 026C232A Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

a]q, xrefs: 026C2704
xaq, xrefs: 026C273E
a]q, xrefs: 026C26A7
3Dp^, xrefs: 026C251F
#Dp^, xrefs: 026C2654

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: a]q$ a]q$xaq$#Dp^$3Dp^
API String ID: 0-347205195
Opcode ID: 66a56a1e54b11a3d9cb27b35f69b5870d9270ab4799d7f77ae7169e8a49e3829
Instruction ID: b39b71716f936c568f3c2422c94ada841d6354336df45c4ca77b2c0a6422b56e
Opcode Fuzzy Hash: 66a56a1e54b11a3d9cb27b35f69b5870d9270ab4799d7f77ae7169e8a49e3829
Instruction Fuzzy Hash: 83619C747007008FD715EF28D894B6A77E2FB85714F20896CE9069F3A5DBB5EC468B90

Function 026C0F80 Relevance: 3.9, Strings: 3, Instructions: 162COMMON

Download Yara Rule

Strings

d6p, xrefs: 026C0FCD
Te]q, xrefs: 026C0FB5
(aq, xrefs: 026C125A

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: (aq$Te]q$d6p
API String ID: 0-967301506
Opcode ID: db0b1b8583ca4405cc8c24b457005f706747019ec1579299042793a48c87034f
Instruction ID: e8e1653c6ee3e1deedb2dca40cfd399576257f4b44c31f20300cc1ac2bb0ec3c
Opcode Fuzzy Hash: db0b1b8583ca4405cc8c24b457005f706747019ec1579299042793a48c87034f
Instruction Fuzzy Hash: 7C51A035B005148FD744EF69C454A6EBBF6EF89700F2181A9E806EB3A6CB35DD028B94

Function 026C0DE8 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

dLcq, xrefs: 026C0E23
Haq, xrefs: 026C0F08

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: dd6f54ec26ba5e57722b59c24be9a687ece9d717fb6e68578f47de2db5922e3e
Instruction ID: e5a11982037041c5df1adc48d98f47694667699481668485eee9adef544c58cf
Opcode Fuzzy Hash: dd6f54ec26ba5e57722b59c24be9a687ece9d717fb6e68578f47de2db5922e3e
Instruction Fuzzy Hash: C641C1717002048FDB14EF69D454AAEBBF6EF89304F2445AAE405EB3A2CB759D45CB90

Function 026C1401 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

LR]q, xrefs: 026C1453

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 1566415c0280ba44baf3a9ae456455e5f40519c87e0acc0bab73ebf6ab0b1b3b
Instruction ID: 62268f1bcd4dbb9d6c4604f62aeafbc3cefe165822d92cee322d903b16b0f14d
Opcode Fuzzy Hash: 1566415c0280ba44baf3a9ae456455e5f40519c87e0acc0bab73ebf6ab0b1b3b
Instruction Fuzzy Hash: 6531DF70F002168FCB54AB788451A7E7BF2EFC9200B2480ADE50ADB361EE349D028791

Function 026C0DD9 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

dLcq, xrefs: 026C0E23

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: 1b22c00f0568184c1eeaf2588913fda16ad0ac9e3cc09819f12910f4f8bfebb0
Instruction ID: d1efc0b662dff58395613d28fb2d20a138e6238117c4751e7f85ed227ecd8c17
Opcode Fuzzy Hash: 1b22c00f0568184c1eeaf2588913fda16ad0ac9e3cc09819f12910f4f8bfebb0
Instruction Fuzzy Hash: 6C315C75A00205CFDB15EF69C458BAEBBF6EF48304F2485AAE401AB3A1CB759D45CB90

Function 026C0F07 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

Haq, xrefs: 026C0F08

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 6a620689c0685b0378b87c89f6c199830df87bfe01f4f48d65c1f032b144813f
Instruction ID: edbb329df90262298f4285077f544d315865d030cd15474d7cf6e417e08353b2
Opcode Fuzzy Hash: 6a620689c0685b0378b87c89f6c199830df87bfe01f4f48d65c1f032b144813f
Instruction Fuzzy Hash: 54F04C313492400FD345AF3D681046E7FE79FDA22031608FAD109CB393DD298C0683E5

Function 026C2818 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ede2b6c744cf37dc3c09e16a62908dc7872ef86f87020ce9d21dbd2dd7f2b29
Instruction ID: 41f226e0b353d638816c3188c70bffba89a52be1093ca1841c7f2f9d5560d091
Opcode Fuzzy Hash: 5ede2b6c744cf37dc3c09e16a62908dc7872ef86f87020ce9d21dbd2dd7f2b29
Instruction Fuzzy Hash: C311E4B05097814FE306EF29D861615FFB2EF86214719C2EAC448CB367D674A800C765

Function 026C2D07 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ba6df172bf47b778af655e124875a244b56e62596b3ec148b818edc1d60369
Instruction ID: 9431da7c4b0f7bd64f21e07dc157a8a8f0290cb0dbf60c9f5ecf71ebe8746afc
Opcode Fuzzy Hash: b7ba6df172bf47b778af655e124875a244b56e62596b3ec148b818edc1d60369
Instruction Fuzzy Hash: 844180B5A202289BDF04ABA8D81079D7BBBFBCD710F158069EC09B3784CB356C518B94

Function 026C0B49 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a209f26250a95e94c47a4435ab64b9b0361a6c5519abf86e96e7f943487425f4
Instruction ID: d8d578a901b4c2e975f04baa9a23228c2b3f3d977bdc398be4d72d7a510c5ddb
Opcode Fuzzy Hash: a209f26250a95e94c47a4435ab64b9b0361a6c5519abf86e96e7f943487425f4
Instruction Fuzzy Hash: A651D778501E42DFE706FF28F8499597763FB853053208AA8E4018B36DEBB5AD46CF91

Function 026C1298 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ea7d04e8aa8a36b473278c49337d57d17b2bcb9f665b7154a18543bf8c69d2
Instruction ID: b2e84447b1f81a987d00e86271d2ac72d56caecc44f5b10941cd397288f4e852
Opcode Fuzzy Hash: d9ea7d04e8aa8a36b473278c49337d57d17b2bcb9f665b7154a18543bf8c69d2
Instruction Fuzzy Hash: 9B41C3B5F002099FCB04EFBD85946AEBBF6EF89300F218569D44AD7345DB349D428B90

Function 026C09A8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793370dc3490fbb9d8d6ac491df786a57f1bc74c60cee22ed52623295e4d1fd5
Instruction ID: 1c037e10955ae05713e8be295b971cbee330bdf15b83d2a331d0b7261acbbced
Opcode Fuzzy Hash: 793370dc3490fbb9d8d6ac491df786a57f1bc74c60cee22ed52623295e4d1fd5
Instruction Fuzzy Hash: E8417E35700B06DFDB69BFBAD81833A3AA5FB44608724492DD447C7395EF24D942CBA2

Function 026C09B8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadee163341cbbd6d8e4263f23b37e70bae4765f3c08fa41d759a35ab0b610ac
Instruction ID: 87af6cdf69c80ec79e14612f27c155b9dd355d78250a31c5a6f7e94e3a0547af
Opcode Fuzzy Hash: dadee163341cbbd6d8e4263f23b37e70bae4765f3c08fa41d759a35ab0b610ac
Instruction Fuzzy Hash: 8A318F34700702DFDB69BFB9A81823E76A5FF84608720482CD40BC7395EF20D846CBA2

Function 00A6D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632023950.0000000000A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a6d000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d9f8e68154add5e64f12ad838f14be5c10a14473b7171368c9c2b8bd844854
Instruction ID: 8eedde2f6c65207a77eb3e47608a30991dd5945417bb3bf287df0fcaff7df597
Opcode Fuzzy Hash: 05d9f8e68154add5e64f12ad838f14be5c10a14473b7171368c9c2b8bd844854
Instruction Fuzzy Hash: 812145B1A04200DFDB01DF04D9C0B26BF75FB98358F34C569E90A0B656C336D816CBA2

Function 026C14F9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9623bd7783d288070c2d219bda448d62162a227d5097950046555701a5b4069b
Instruction ID: e1eec252613ccdb7d58eeeb07d36efedb34417eb8cc9de85e554def548371bb2
Opcode Fuzzy Hash: 9623bd7783d288070c2d219bda448d62162a227d5097950046555701a5b4069b
Instruction Fuzzy Hash: C311ADB4B006059FDB14EFB9D8056AE7BF6EF8920476048B9D40ADB356EA35D902CB90

Function 00A6D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632023950.0000000000A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a6d000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: e8a1600f55d17d68f206ab3b2c88213b89feea19088c58de95afac9dc741ea2c
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 7711E676904240CFDF16CF14D5C4B16BF71FB94324F24C5A9D90A4B656C336D85ACBA2

Function 026C1508 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8d6006863fcfc3e72b21a591d064f49828b492cb0a4efef21aa237bfed671f
Instruction ID: cea663dbba568d2af30748a1e271b4761d3682b669d4c81e1a60762cc3d61d30
Opcode Fuzzy Hash: 2e8d6006863fcfc3e72b21a591d064f49828b492cb0a4efef21aa237bfed671f
Instruction Fuzzy Hash: BC118BB4B002059FCB54EBBDD80462A7BE6FF8920072048B9D40ACB355EA31DC02CB91

Function 026C1C61 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba937cc0b8c1f8e307a20beab9e4e7737a94e4077678b6994b7149cd9a808d5f
Instruction ID: 1ca04926ae201dcb822ebb0573a369dbe304e1d3022995b346ee8e0592cc8b0e
Opcode Fuzzy Hash: ba937cc0b8c1f8e307a20beab9e4e7737a94e4077678b6994b7149cd9a808d5f
Instruction Fuzzy Hash: 37017C38B01615CFDB18FB69D4507BE7BA5EF86704F2480ADE40AD7302DB78D9019B91

Function 026C1BC9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9b440365ec2628ad0c5b2162179358bb345972459e8c84321a0feefc335042
Instruction ID: 4ce8a8cd1febaebac4d507ef60487f5896ec6c5d034f1017257decf032df8614
Opcode Fuzzy Hash: 0b9b440365ec2628ad0c5b2162179358bb345972459e8c84321a0feefc335042
Instruction Fuzzy Hash: A80121348047488FD704FBACD8412BC7B30EB83308B0402A8D04A9738AEAB0590ACBA6

Function 026C1BD8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5853cab504f8b1a2ec5339e08dd5ae851c2b56d2ff5b71073dec549a3098c2c
Instruction ID: 4e49b4e3573323bec4a80cf39a8d09036cf2a29fc8830f0483380ce65fcdf7f6
Opcode Fuzzy Hash: a5853cab504f8b1a2ec5339e08dd5ae851c2b56d2ff5b71073dec549a3098c2c
Instruction Fuzzy Hash: 1701F434800B0ACFDB04FFBCE84526D7B71FF82304B444668D40A97359EB705546CBA6

Function 026C0B35 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb56be8cae8444242176d18a0fd70cfcd9f89db2963ffe564c021f7ba6e0e7cd
Instruction ID: 57229795149e90e3587a6c48f099748f98b77938682514c66e3fdfd5805eebe0
Opcode Fuzzy Hash: cb56be8cae8444242176d18a0fd70cfcd9f89db2963ffe564c021f7ba6e0e7cd
Instruction Fuzzy Hash: 7CC08C34114348CFD308BBA4E80C3383A10EB8330EF700108A04B8A2B6AE354486C232

Function 026C0B19 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4632336438.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_zvXPSu3dK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e0e2e92e3f192db65405ab093a9614091248f2a25356386620dafc5309e8b6
Instruction ID: 70b928097e071f81e999a37c82d1c374a43e43de127bbff04730a7dcd4a75e32
Opcode Fuzzy Hash: 07e0e2e92e3f192db65405ab093a9614091248f2a25356386620dafc5309e8b6
Instruction Fuzzy Hash: 8BC01234114648CBD708AB64E8083383A10EB8230EFB00209A00B892A69E254486C622

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zvXPSu3dK5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

Windows Analysis Report
zvXPSu3dK5.exe