Edit tour

Windows Analysis Report
gagagggagagag.exe

Overview

General Information

Sample name:	gagagggagagag.exe
Analysis ID:	1574517
MD5:	7f20b668a7680f502780742c8dc28e83
SHA1:	8e49ea3b6586893ecd62e824819da9891cda1e1b
SHA256:	9334ce1ad264ddf49a2fe9d1a52d5dd1f16705bf076e2e589a6f85b6cd848bb2
Tags:	AsyncRATexeuser-lontze7
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

.NET source code contains potential unpacker

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

gagagggagagag.exe (PID: 1448 cmdline: "C:\Users\user\Desktop\gagagggagagag.exe" MD5: 7F20B668A7680F502780742C8DC28E83)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"External_config_on_Pastebin": "null", "Server": "185.16.38.41", "Ports": "2033,2034,2035,2022,2023,2024,20000,6666", "Version": "| Edit 3LOSH RAT", "Autorun": "false", "Install_Folder": "ak1ZQjZ2bEQ3VVlxMkRzMndYM21JNzlya1lzVVREMko=", "Install_File": "SrlfNI5vbH1HHl50MHFQyV+obaGXluc/Su4FpzcCma+0EbqU24JiGETuF+BSFfitNxYZi+Bz7SWKBKl1Q35bhCToFLRQxsLGdDHFoCTPXzY=", "AES_key": "jMYB6vlD7UYq2Ds2wX3mI79rkYsUTD2J", "Mutex": "dWCvce/wIsVF4TRzZqT2z/P7B7VLJ39rwNZkuWKw7M92ZKbUgjTiNXxsQS3JtaK3//y3pfHWO7qaySa31JbD26Vng17o7cNrmY3lDECw5j5xDNAKMMoc8hHrD2c9ORmKnlLwYWxfSsrxXvnsNY9dI1P3dMjAsxB7sMUqI1bDqYSvaSktvGwlSFKaLbJO38Ym5/R9JsFAzMDBCoyf6+E+xQAE94kSJ9thM5Brt8zmR0v+qHJ4iWhiFylIsXto8j4NBOU6a+2ypbzImKiuWkmDJtk4rxQETr7xqN2V1MX6iaY/ntfwS0fk/WRO51lzqMwBYCRFoSCY3wQBJEkJbOvptTEYTHacAz0fXsal6LsUrNt7+q3aTFVCpd0iAbNH4HAzdwnbQifOKfRrXVRO1N4L5u7kwCHy4b9A5m9Du1FwWYCmgubS+GFCjeGcv/3u2SvQS8RcgGneFrQqzTFzKwC9eOXxokaz94ydT/cP327Gvq6DNk+Ranw0b3htuBz0Gt4jobzGzDsW3BoRZg0s5Gs0WEuTdH87acnrv3WfaU9iuTEKibwnC0+cX0c+OALEG78xUPyp58oYrRbsblNxVjHj0ofNecMWCNvcitZt3S3MyF6rRHV0IYbDaemJFD+/LxJqer2Vz+NX7b+W/KrZgcYKkCCsi9uOyal0dR8Zn4WdRdY=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gagagggagagag.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
gagagggagagag.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
gagagggagagag.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcf94:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xfc38:$a2: Stub.exe 0xfcc8:$a2: Stub.exe 0x9765:$a3: get_ActivatePong 0xd1ac:$a4: vmware 0xd024:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa6fc:$a6: get_SslClient
gagagggagagag.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd026:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcd94:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10238:$a2: Stub.exe 0x102c8:$a2: Stub.exe 0x9565:$a3: get_ActivatePong 0xcfac:$a4: vmware 0xce24:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa4fc:$a6: get_SslClient
00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xce26:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: gagagggagagag.exe PID: 1448	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: gagagggagagag.exe PID: 1448	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x448f7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.gagagggagagag.exe.da0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.gagagggagagag.exe.da0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.gagagggagagag.exe.da0000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcf94:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xfc38:$a2: Stub.exe 0xfcc8:$a2: Stub.exe 0x9765:$a3: get_ActivatePong 0xd1ac:$a4: vmware 0xd024:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa6fc:$a6: get_SslClient
0.0.gagagggagagag.exe.da0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd026:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T11:52:04.526309+0100	2035595	1	Domain Observed Used for C2 Detected	185.16.38.41	2024	192.168.2.7	49705	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T11:52:04.526309+0100	2035607	1	Domain Observed Used for C2 Detected	185.16.38.41	2024	192.168.2.7	49705	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T11:52:04.526309+0100	2842478	1	Malware Command and Control Activity Detected	185.16.38.41	2024	192.168.2.7	49705	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gagagggagagag.exe

Avira: detected

Found malware configuration

Source: gagagggagagag.exe

Malware Configuration Extractor: AsyncRAT {"External_config_on_Pastebin": "null", "Server": "185.16.38.41", "Ports": "2033,2034,2035,2022,2023,2024,20000,6666", "Version": "| Edit 3LOSH RAT", "Autorun": "false", "Install_Folder": "ak1ZQjZ2bEQ3VVlxMkRzMndYM21JNzlya1lzVVREMko=", "Install_File": "SrlfNI5vbH1HHl50MHFQyV+obaGXluc/Su4FpzcCma+0EbqU24JiGETuF+BSFfitNxYZi+Bz7SWKBKl1Q35bhCToFLRQxsLGdDHFoCTPXzY=", "AES_key": "jMYB6vlD7UYq2Ds2wX3mI79rkYsUTD2J", "Mutex": "dWCvce/wIsVF4TRzZqT2z/P7B7VLJ39rwNZkuWKw7M92ZKbUgjTiNXxsQS3JtaK3//y3pfHWO7qaySa31JbD26Vng17o7cNrmY3lDECw5j5xDNAKMMoc8hHrD2c9ORmKnlLwYWxfSsrxXvnsNY9dI1P3dMjAsxB7sMUqI1bDqYSvaSktvGwlSFKaLbJO38Ym5/R9JsFAzMDBCoyf6+E+xQAE94kSJ9thM5Brt8zmR0v+qHJ4iWhiFylIsXto8j4NBOU6a+2ypbzImKiuWkmDJtk4rxQETr7xqN2V1MX6iaY/ntfwS0fk/WRO51lzqMwBYCRFoSCY3wQBJEkJbOvptTEYTHacAz0fXsal6LsUrNt7+q3aTFVCpd0iAbNH4HAzdwnbQifOKfRrXVRO1N4L5u7kwCHy4b9A5m9Du1FwWYCmgubS+GFCjeGcv/3u2SvQS8RcgGneFrQqzTFzKwC9eOXxokaz94ydT/cP327Gvq6DNk+Ranw0b3htuBz0Gt4jobzGzDsW3BoRZg0s5Gs0WEuTdH87acnrv3WfaU9iuTEKibwnC0+cX0c+OALEG78xUPyp58oYrRbsblNxVjHj0ofNecMWCNvcitZt3S3MyF6rRHV0IYbDaemJFD+/LxJqer2Vz+NX7b+W/KrZgcYKkCCsi9uOyal0dR8Zn4WdRdY=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Multi AV Scanner detection for submitted file

Source: gagagggagagag.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: gagagggagagag.exe

Joe Sandbox ML: detected

Source: gagagggagagag.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: gagagggagagag.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 185.16.38.41:2024 -> 192.168.2.7:49705
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 185.16.38.41:2024 -> 192.168.2.7:49705
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 185.16.38.41:2024 -> 192.168.2.7:49705
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 185.16.38.41:2024 -> 192.168.2.7:49705

Yara detected Generic Downloader

Source: Yara match	File source: gagagggagagag.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49705 -> 185.16.38.41:2024

Source: Joe Sandbox View

ASN Name: PL-SKYTECH-ASPL PL-SKYTECH-ASPL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41
Source: unknown	TCP traffic detected without corresponding DNS query: 185.16.38.41

Source: gagagggagagag.exe, 00000000.00000002.3736258617.0000000005655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: gagagggagagag.exe, 00000000.00000002.3736258617.0000000005655000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: gagagggagagag.exe, 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: gagagggagagag.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gagagggagagag.exe PID: 1448, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: gagagggagagag.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: gagagggagagag.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: gagagggagagag.exe PID: 1448, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Users\user\Desktop\gagagggagagag.exe	Code function: 0_2_02EEE048		0_2_02EEE048
Source: C:\Users\user\Desktop\gagagggagagag.exe	Code function: 0_2_076117C0		0_2_076117C0

Source: gagagggagagag.exe, 00000000.00000002.3736945735.0000000005939000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs gagagggagagag.exe
Source: gagagggagagag.exe, 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs gagagggagagag.exe
Source: gagagggagagag.exe	Binary or memory string: OriginalFilenameStub.exe" vs gagagggagagag.exe

Source: gagagggagagag.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: gagagggagagag.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: gagagggagagag.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: gagagggagagag.exe PID: 1448, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: gagagggagagag.exe, PSUyOwdskSQDg.cs

Base64 encoded string: 'w70q7iVCZUBLrH36j5S+u4zs3rMxS3z+dxF1Nb66k6pQIfe6u4zLj0oOwqpw3Yy7wwst9UMmnJYhEJZSwdN6PBNMOnBzjQaR5S0J3VrRc9ZdxW/fTJ9Q0OZ947SQc9j5', 'imJ/H4r5QuFnaeCZiwMO/avsvvxJ+sKZTo97OWlHWoWSs0umkbF4NfJa7gaaS8rMuhquU4sSpsuWLw6PUi6FMAEAD21OaSCoX8NgcSbdeEU=', 'jCVMI+7PFiW/9n76x+shPVhOzUqUXky1KZBSX2TXQKS3QhZ4z0FocqBcaJ+bdUAF9tzpIjT/lN10cH40GvKQFA==', 'SrlfNI5vbH1HHl50MHFQyV+obaGXluc/Su4FpzcCma+0EbqU24JiGETuF+BSFfitNxYZi+Bz7SWKBKl1Q35bhCToFLRQxsLGdDHFoCTPXzY=', '/BXfjseeO9v+CmqflGZkTTef5500WnrrKuVHGMxCM5zmjyYmDvWYope2CujgGMxHxXBF9nXr1R9PB+gGKAo0ujKFDPLh2SaQUbPeFEhfa07ZilCMkkJMWaJlPCsVeTCO87aIvMh0Rk+vF5AVEWECFQOTJeEDzbPdk6T5zFZPfY8fflYmrT2urDH/+1aWujyWq824tNBnH5yMH11CNbts/p7xt5gb/Bv6jW93OSdN8CHfPAq7Q44Mwh5QW86wekuVQw61EQM8Kp4sr7aLPNHr2fQx7VF+/66HQB3BCbFNRCyt6i9KZ5sWNEFlM4diolYLUOHyM94oAuOfyd95oP+qmrrlmb54+LziaOoC6w104GNN/58Ul21h0H83XElWNc6bdmZxTZouhZt2RKJ1jUIOzA+wrweF2dBQZXCMLpVmA7WXbkktnb17RR7XzKc3+EusFu3kbcKjAI2KIHxK0E6nu+UEH/e4mOSHAR7PzagzYtT48XRgmEBSCYlQSU00CBj01WdcwdpiGYArbAuWw5v10UvM3HfTCShqIACVAlcWhsucGQ9oFYSbbDlsn2Znvt9TOtIE3/bNAJQFoZ5iPNvdqlMAE9ei+RXO8IXiatJlNaLyA8F+mGv0v5kPK9KrIrWhS2hg8LDJj/4/rZKrNzBJeMy6AIlOtKGhJK4hx+nDs0yRTZKDJMjzMQ6rXpAEzHZRUYghaWTryU595YwR19KTdXkB2+MRMnBuuysoGh6S1ZuXvPNg9pWvDKpv/bIb+hZUncDsyC/l/7jdluUdsCtplVZJVDXjsJhmvPORFi1lCCleWXVyFzF1CxwHlnn05ZayLAe0y7yR1fvJkKfehZhQrPM+Xkw3PJQa+cXgRS07KMOofk5MznquGNQQBzfIfsSIuvpUgbJpfGaxu7P+u3boIhmipfrcsg6AKW3dTuVyvUxgVXVh6bpWSJwzo68bSsALvYszXkBcEyvGXYDgdcaJZ1c3+ugra5iZQzVxv9/GE3/7VhKXMAWLuxgEa3r2mgE6cL43gq0Rl8DmPMM0hNTxeVbxCUckIaHbRIKU59XBPG6bjacLWBXV0yxUo6GPHI5qj+JWSjsRp1uWpMMAupSznGMt4WTAxta8KH6KGabuK7tH24gW9E84775pi4goVHd6JAlfZUfVjYzpBbnK+mXyjQl9aoRHHCCc3dIsrLgs6PPWfO8xeGde18Z93ATCgJK3rZQfWslXPsx/c7pFn7WjtwGKBqeMDyKjS7qv5aUgX/xUJa9m5KN9TLPCfyoQ3zk/WIf5XtvzFMvvPFTIsKroy3xsUIH2fh+4nkorwoggnVq3CB+Y0sfSvLFV/6fFRWVZLCMpd6UqTH3v8GaKN4B9wJI4JGeZ19Qxgv4O6VkgjpCu4E7JF2Cm+PYFIS0gQzv0Sfu/lMe2v75Vq4Okz2GGSqDH0zwp6wdUd8CzAm77coDt1XnBEwRpLLllaOT/W0cP4SfWnnaAXAqMFeETDe92Xaw4/dKM4qHJs/2S4EJ49vT2N6mLN6Seryvu13ucEmZ0/FYIPaZPJHS3enUJVIZ0CKmEIR0q2rpTH1tmtgTeL+wlxR3iSw+ITcw3vkQJnzS1aZNVRqWjMIEn6GeEX+MsiAs82iCCD8pJ28Ktf0VdVxwAy/fuSMXcLE8I8qqTfoL3Yzkasu75RjUqCjZbv6HdpVBqvECEGiR9Xy9642XkOObOiM4A78mZFNkqPFZ9lNJPLB9T9pLeAfbmmftPbyRC+VklrLwh5bovWmG29g6pTJBe1JzSBYKAXOIRYUDe3r1M0jDdd3ZhCETsbekN/xL0SXmZ00JHavb2Ko8Ht19S30b1yR5+3rekSAZKyajZJxZAszcHokcFk4afK0SYZFmSAuJ7U9J3kX2cXLkd2uFh5FPnmNzYDdPErqrFL60jfShjh/0atZf2xah3Rup2B/gUWvoHifZ6vBZ7J5CqO2ioLrnP3R4DnnlVP5cTRJqUFo4snVUEfTVtgyYoQhy7n95sjmSffKErVYKQ6E+1hYbHod3SRk/Vw6oG3zEBdxZpab0XlI/d79l2Zfs17+UMEqpo/kDvnNox/RzPlIz5g9EVQMKRLCRzyhjwroeX1+29477/6ZYwg3QVcUETcoM2kRhk7b8S5BDP7nWtn1EITLeq8YhZvTLqs4bvhnPoxpfCYBTOJL3lxx0lmnRdgzOgYxyw8zQ2syvpy3mf31WfNSygzYNRX7UUl+q+E35b45CrmKwmNsBcm55ucFlUO2dKXudOWPThWR7fM2CMjz+mrWSDXNwIll6jNPTGPlkI9ovnpPifOeIc9F6gyITbPp+LslrYm2e7nJio6xINz8gZE3ryHFA=', 'RoFI0m7pZEZDEi2ZefsVMl+A02PJeRlnFz6zvSoEfuPyPB4ExiHgyOUE0CFIU1LqoELe24KvGG+VFwRmsi31Tw==', 'xClbevw3WGaAq/kjPh8Z44fD++nPaWqf5EGGf697qWSoQow3pL/aufTMNnYGK1tQNsRuPNF475UWFsP906jrWw==', 'XWOazeJ8OZXg6Ep

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@0/1

Source: C:\Users\user\Desktop\gagagggagagag.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\gagagggagagag.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_XXXX765643

Source: gagagggagagag.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gagagggagagag.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\gagagggagagag.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gagagggagagag.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: gagagggagagag.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gagagggagagag.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: gagagggagagag.exe, TJMBCmpMBZPK.cs

.Net Code: OuxstKXXnpsGI System.AppDomain.Load(byte[])

Source: gagagggagagag.exe, xYtYlQiGWhdnNwo.cs	High entropy of concatenated method names: 'CaSREvqJAtSrGfWw', 'hKKDUCkiRlmVreW', 'LWzUKtKKraIK', 'gfolTTuBWus', 'uScvpCpwnPTL', 'anwBvilwiBkasj', 'lVnFTDVsHnAPl', 'qdqMUYMYNfNTdCq', 'QseaFdoPrHW', 'IKSERXgyAWC'
Source: gagagggagagag.exe, soRrFYcvykZVC.cs	High entropy of concatenated method names: 'cTHlZAzWeJpJzTB', 'yjAworAxTsb', 'yMMDHibdFkXHC', 'PrfSuKihtfPs', 'rQqEZrzoTBc', 'uDbpRQZmkoGP', 'NCeRszSJdQBU', 'xxOvuLxUDuP', 'xkIOeawnzIFqIF', 'CvbIRZRPTkgv'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: gagagggagagag.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gagagggagagag.exe PID: 1448, type: MEMORYSTR

Source: C:\Users\user\Desktop\gagagggagagag.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: gagagggagagag.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gagagggagagag.exe PID: 1448, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: gagagggagagag.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\gagagggagagag.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Memory allocated: 5020000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Window / User API: threadDelayed 9766

Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe TID: 4100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe TID: 3452	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe TID: 3452	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe TID: 6912	Thread sleep count: 9766 > 30	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe TID: 6912	Thread sleep count: 80 > 30	Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: gagagggagagag.exe	Binary or memory string: vmware
Source: gagagggagagag.exe, 00000000.00000002.3733309526.0000000001447000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: gagagggagagag.exe, 00000000.00000002.3738399840.00000000067E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: gagagggagagag.exe, 00000000.00000002.3736258617.0000000005655000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Users\user\Desktop\gagagggagagag.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe	Queries volume information: C:\Users\user\Desktop\gagagggagagag.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gagagggagagag.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gagagggagagag.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: gagagggagagag.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gagagggagagag.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gagagggagagag.exe PID: 1448, type: MEMORYSTR

Source: gagagggagagag.exe, 00000000.00000002.3733309526.0000000001447000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\gagagggagagag.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
gagagggagagag.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
gagagggagagag.exe	100%	Avira	TR/Dropper.Gen
gagagggagagag.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	gagagggagagag.exe, 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.16.38.41	unknown	Poland		201814	PL-SKYTECH-ASPL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574517
Start date and time:	2024-12-13 11:51:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gagagggagagag.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, time.windows.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: gagagggagagag.exe

Simulations

Behavior and APIs

Time	Type	Description
05:52:05	API Interceptor	8172413x Sleep call for process: gagagggagagag.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.16.38.41	Nz5Uxxtwx2.ps1	Get hash	malicious	AsyncRAT	Browse
185.16.38.41	Stub.exe	Get hash	malicious	AsyncRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Loader.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	1434orz.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	3.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	199.232.210.172
	3.exe	Get hash	malicious	CobaltStrike	Browse	199.232.210.172
	Bilbao.dll.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	3181425fa7464801a03868a1adf86bc1.ps1	Get hash	malicious	Unknown	Browse	199.232.214.172
	job.ps1	Get hash	malicious	DcRat, StormKitty, VenomRAT	Browse	199.232.210.172
	job.ps1	Get hash	malicious	DcRat, StormKitty, VenomRAT	Browse	199.232.210.172
	Ni2ghr9eUJ.exe	Get hash	malicious	Socks5Systemz	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PL-SKYTECH-ASPL	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	149.86.226.5
	Bestellung - 021224 - 901003637.exe	Get hash	malicious	Quasar	Browse	193.34.212.17
	Zam.exe	Get hash	malicious	Discord Token Stealer, PureLog Stealer	Browse	193.34.212.17
	KRcLFIz5PCQunB7.exe	Get hash	malicious	Quasar	Browse	193.34.212.17
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	91.223.3.164
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	95.214.53.96
	4b7b5bc7b0d1f70adf6b80390f1273723c409b837c957.dll	Get hash	malicious	Unknown	Browse	193.34.212.14
	4b7b5bc7b0d1f70adf6b80390f1273723c409b837c957.dll	Get hash	malicious	Unknown	Browse	193.34.212.14
	SH20240622902.scr.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	193.34.212.15
	arm7.elf	Get hash	malicious	Unknown	Browse	95.214.52.167

Process:	C:\Users\user\Desktop\gagagggagagag.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\gagagggagagag.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2418003062782916
Encrypted:	false
SSDEEP:	6:kKQL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:4iDImsLNkPlE99SNxAhUe/3
MD5:	3FB91772CC2A1AABE091ED14915DBEC0
SHA1:	424F6B4396A56186DCA55581F34DF8FAF59C1803
SHA-256:	346466E139E4524363B57C165AD2B32B5D73BCAE226CE0A12D241B13AAB4362A
SHA-512:	D6B36D13591E2E1F14DAE3154A5B20A18B6B87BA6A7E64596A8FED12B45632D8F8AB9311A6B7B5F17F9282DD0EAFC4F94D1E9E9F3A23D212F85F2B9BA3BB1AB8
Malicious:	false
Reputation:	low
Preview:	p...... .........v..MM..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.529468152180746
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	gagagggagagag.exe
File size:	66'560 bytes
MD5:	7f20b668a7680f502780742c8dc28e83
SHA1:	8e49ea3b6586893ecd62e824819da9891cda1e1b
SHA256:	9334ce1ad264ddf49a2fe9d1a52d5dd1f16705bf076e2e589a6f85b6cd848bb2
SHA512:	80a8b05f05523b1b69b6276eb105d3741ae94c844a481dce6bb66ee3256900fc25f466aa6bf55fe0242eb63613e8bd62848ba49cd362dbdd8ae0e165e9d5f01c
SSDEEP:	1536:DWqxSnrykLcFlmeA6Zdt/HCiCPEsfnhOjyXbZQG17uMJYfvISLWcx:DWYSrykLBEsfnheyXbZZNuxtXx
TLSH:	445308053BE9802AF3BF8F7469F2628506F5F5AF2D12D55D1C8410CE0532BC29A52BBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41179e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6419E213 [Tue Mar 21 16:57:55 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11744	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x7ff	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf7a4	0xf800	02b07962d4380f06512aeebeb057833f	False	0.5002047631048387	data	5.569652990477762	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x7ff	0x800	33cdbc5c50f34a35b4f0e61582ac7f11	False	0.41650390625	data	4.884866150337139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	d6bfc2947a4e809d7fef143f35a58776	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x2cc	data			0.43575418994413406
RT_MANIFEST	0x1236c	0x493	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.43381725021349277

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T11:52:04.526309+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.16.38.41	2024	192.168.2.7	49705	TCP
2024-12-13T11:52:04.526309+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	185.16.38.41	2024	192.168.2.7	49705	TCP
2024-12-13T11:52:04.526309+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	185.16.38.41	2024	192.168.2.7	49705	TCP
2024-12-13T11:52:04.526309+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	185.16.38.41	2024	192.168.2.7	49705	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:52:02.951854944 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:03.071796894 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:03.075972080 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:03.086978912 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:03.206928968 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:04.363774061 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:04.363812923 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:04.363877058 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:04.406512022 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:04.526309013 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:04.824539900 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:04.877438068 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:06.903177977 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:07.024821043 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:07.024893045 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:07.144573927 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:15.409986973 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:15.529926062 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:15.530097008 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:15.649998903 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:18.104298115 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:18.158761978 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:18.298177004 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:18.308212996 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:18.427942991 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:18.428011894 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:18.548166990 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:19.540826082 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:19.580610991 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:19.733108044 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:19.783775091 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:23.925200939 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:24.045217991 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:24.045286894 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:24.165095091 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:27.306358099 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:27.346312046 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:27.498621941 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:27.500564098 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:27.620354891 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:27.620488882 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:27.741383076 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:32.440624952 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:32.560437918 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:32.560672998 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:32.680500984 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:40.956579924 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:41.076498032 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:41.076644897 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:41.196496010 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:49.471999884 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:49.591705084 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:49.591804981 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:49.711539030 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.264118910 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.315169096 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:56.456135035 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.458422899 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:56.578236103 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.578336000 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:56.648407936 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.690215111 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:56.698154926 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.770567894 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.815159082 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:56.890527010 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:56.892656088 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:57.013951063 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:57.014038086 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:57.133935928 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:57.987720966 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:58.107577085 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:58.107947111 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:58.227871895 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:58.548481941 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:58.596395016 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:58.740919113 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:58.742700100 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:58.862895966 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:52:58.863004923 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:52:58.983064890 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:06.584830046 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:06.704649925 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:06.704704046 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:06.824651957 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:15.098074913 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:15.167114973 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:15.170231104 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:15.217859030 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:15.290842056 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:15.359020948 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:15.365287066 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:15.485193968 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:15.486148119 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:15.606034040 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:19.960376024 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:20.002738953 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:20.151762009 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:20.154155016 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:20.273894072 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:20.273962021 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:20.393867016 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:20.555973053 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:20.675812960 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:20.682001114 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:20.802975893 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:21.050535917 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:21.171849966 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:21.171982050 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:21.292239904 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:29.565675020 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:29.685360909 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:29.685415983 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:29.805257082 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:38.082027912 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:38.210851908 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:38.210908890 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:38.330776930 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:39.224004984 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:39.343868971 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:39.344183922 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:39.463862896 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:47.737904072 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:47.857753992 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:47.857819080 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:47.978213072 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:56.253251076 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:56.373986006 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:56.374058008 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:56.494113922 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:59.476016998 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:59.518512964 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:53:59.668204069 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:53:59.722677946 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:00.330996990 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:00.377888918 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:00.523245096 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:00.582163095 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:02.262130022 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.315455914 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:02.459355116 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.461014032 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:02.581568956 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.581787109 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:02.660567999 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.701685905 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.706017971 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:02.789901972 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.791821003 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:02.911775112 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:02.911851883 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:03.031929970 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:03.534729958 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:03.654700041 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:03.654800892 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:03.774676085 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.064047098 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.112318993 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:05.268587112 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.315407038 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:05.447011948 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:05.568077087 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.568155050 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:05.688036919 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.793742895 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.880575895 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:05.880637884 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:05.884517908 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:06.004163980 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:06.004223108 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:06.083800077 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:06.125565052 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:06.237289906 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:06.287457943 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:06.289170980 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:06.409153938 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:06.409270048 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:06.529366970 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:09.008251905 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:09.204819918 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:09.204977036 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:09.206960917 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:09.326709032 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:09.326786995 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:09.446598053 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:12.050484896 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:12.170377016 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:12.170444012 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:12.290251017 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:20.565888882 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:20.685925961 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:20.686002970 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:20.805903912 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:29.140587091 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:29.261324883 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:29.262552023 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:29.382637978 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:37.612803936 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:37.732666016 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:37.732770920 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:37.852607012 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:46.172281027 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:46.293467045 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:46.293540001 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:46.413691044 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:54.644273043 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:55.035353899 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:55.074212074 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:55.076025963 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:54:55.155219078 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:54:55.195749998 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:03.161207914 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:03.281151056 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:03.281251907 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:03.401068926 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:06.290354967 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:06.425013065 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:06.481823921 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:06.483643055 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:06.603544950 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:06.603658915 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:06.673913002 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:06.674002886 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:06.724148035 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:07.848963976 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:07.925395966 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:08.041647911 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:08.112765074 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:11.676105022 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:11.876279116 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:11.884273052 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:12.117763042 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:20.223242998 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:20.342947006 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:20.343169928 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:20.463814020 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:21.933593035 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:22.112579107 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:22.125437975 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:22.127221107 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:22.247095108 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:22.248318911 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:22.368192911 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:23.173639059 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:23.221983910 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:23.365865946 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:23.391761065 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:23.511562109 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:23.512191057 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:23.633507013 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:24.550626040 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:24.670504093 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:24.670598984 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:24.790647030 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.217417002 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.344153881 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:25.409562111 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.411458969 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:25.531333923 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.531403065 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:25.651411057 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.707974911 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.843792915 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.843857050 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:25.845798016 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:25.965636015 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:25.965679884 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:26.085758924 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.296802998 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.425108910 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:27.488874912 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.494995117 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:27.614702940 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.614859104 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:27.734643936 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.819288015 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.932971001 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:27.933183908 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:27.940179110 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:28.060080051 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:28.060198069 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:28.180408001 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:28.664911985 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:28.815717936 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:28.857126951 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:28.925196886 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:29.005137920 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:29.048991919 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:29.049637079 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:29.125039101 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:29.126182079 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:29.169733047 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:29.246073008 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:33.066200972 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:33.186033010 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:33.186096907 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:33.305881977 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:33.649864912 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:33.722011089 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:33.841826916 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:33.843847036 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:33.963623047 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:33.963745117 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:34.083596945 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:38.019337893 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:38.139554024 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:38.139617920 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:38.259290934 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:38.591732979 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:38.722054958 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:38.783644915 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:38.785526991 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:38.905383110 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:38.905438900 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:39.025340080 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:46.519331932 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:46.639337063 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:46.639516115 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:46.759438992 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:47.080064058 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:47.222115993 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:47.272129059 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:47.274151087 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:47.394300938 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:47.394418955 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:47.514230967 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:49.533431053 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:49.650156021 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:49.726003885 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:49.769804955 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:52.597537041 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:52.717716932 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:52.717797041 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:52.838222027 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:53.158521891 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:53.222104073 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:53.350452900 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:53.352497101 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:53.472331047 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:55:53.472389936 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:55:53.592235088 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:01.113116980 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:01.233398914 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:01.233449936 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:01.353291988 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:01.688539028 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:01.880337000 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:01.880393982 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:01.881993055 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:02.001730919 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:02.001805067 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:02.181077957 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:04.441118956 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:04.560883999 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:04.562614918 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:04.682935953 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:05.004354954 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:05.196415901 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:05.196536064 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:05.197222948 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:05.317074060 CET	2024	49705	185.16.38.41	192.168.2.7
Dec 13, 2024 11:56:05.317241907 CET	49705	2024	192.168.2.7	185.16.38.41
Dec 13, 2024 11:56:05.437113047 CET	2024	49705	185.16.38.41	192.168.2.7

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 11:52:05.059849977 CET	1.1.1.1	192.168.2.7	0x1906	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:52:05.059849977 CET	1.1.1.1	192.168.2.7	0x1906	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:51:57
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\gagagggagagag.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gagagggagagag.exe"
Imagebase:	0xda0000
File size:	66'560 bytes
MD5 hash:	7F20B668A7680F502780742C8DC28E83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.1282985227.0000000000DA2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.3734026490.0000000003021000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	5

Executed Functions

Function 02EE7C7A Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02EE7CFE
GetCurrentThread.KERNEL32 ref: 02EE7D3B
GetCurrentProcess.KERNEL32 ref: 02EE7D78
GetCurrentThreadId.KERNEL32 ref: 02EE7DD1

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 371af6f330fdf9ebe77476d312d483ca0672897ca9c6454b96a4f1102c47cd61
Instruction ID: d7d5f2df832d3041442cf9d9963750fb896453bb1663029537f41b5b8223cfa1
Opcode Fuzzy Hash: 371af6f330fdf9ebe77476d312d483ca0672897ca9c6454b96a4f1102c47cd61
Instruction Fuzzy Hash: D55187B09003498FDB18CFAAD549BAEBBF1EF49314F20D459E409A7390CB356944CF65

Function 02EE7C80 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02EE7CFE
GetCurrentThread.KERNEL32 ref: 02EE7D3B
GetCurrentProcess.KERNEL32 ref: 02EE7D78
GetCurrentThreadId.KERNEL32 ref: 02EE7DD1

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d935e97e95dfc6e741aea43ccae1de8decd96a5f8ac045defef8394769ea7a30
Instruction ID: a851cdb839aaec936eace96ee99003eb4a58832ad32ad08a47f1612efcb82f0d
Opcode Fuzzy Hash: d935e97e95dfc6e741aea43ccae1de8decd96a5f8ac045defef8394769ea7a30
Instruction Fuzzy Hash: ED5175B09003098FDB18DFAAD549BAEBBF2EF49314F20D459E409A73A0DB356944CF65

Function 02EE29C0 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02EE2A43

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 9b0ad8e5191c327bd03b35574e7c81114e47f680662e5a04b6333c390d36a36e
Instruction ID: 69f7c42fcd2d9141aaf659a310b59aec9f6c2107ff771d163b418d87dcc395b3
Opcode Fuzzy Hash: 9b0ad8e5191c327bd03b35574e7c81114e47f680662e5a04b6333c390d36a36e
Instruction Fuzzy Hash: F83136B5D002098FDB24DF9AD844BDEFBF4FB48324F14841AE919A7250C779A945CFA1

Function 02EE7EC0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EE7F4F

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 248a2f99bf21569618158210c56c70bd07bd2e82cffaafeece9e4a426468a095
Instruction ID: 858ece56ff9c3cbd03a67d9d5d442151b06a6be344ebe42da17c5b46e9b06ff0
Opcode Fuzzy Hash: 248a2f99bf21569618158210c56c70bd07bd2e82cffaafeece9e4a426468a095
Instruction Fuzzy Hash: 6021E2B5D002499FDB10CFAAD985AEEFBF5FB48314F14801AE918A3350D378A955CFA1

Function 02EE7EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EE7F4F

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d6845e5daab4c4400c9588dec4b9acb720009ac8ed37f45e5c6f9fc5472dbb9
Instruction ID: fb51c80e6bb8fa791dd07bb4f39c451aaf70ad822ed25fbd53425e1cdb58109f
Opcode Fuzzy Hash: 1d6845e5daab4c4400c9588dec4b9acb720009ac8ed37f45e5c6f9fc5472dbb9
Instruction Fuzzy Hash: 6E21E4B5D002499FDB10CFAAD985ADEFBF9FB48310F14801AE918A3350D378A944CFA1

Function 02EE29C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 02EE2A43

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: af23f9dbad9c069df74fda5c046332f9aea9a75d10c09250359746ffbcccec38
Instruction ID: e8fd0d0c9af0aeaff2ed7f3305aebe4e6ce771c72a1b3d22651598674e7270d3
Opcode Fuzzy Hash: af23f9dbad9c069df74fda5c046332f9aea9a75d10c09250359746ffbcccec38
Instruction Fuzzy Hash: 632127B5D002098FDB24DFAAC844BDEFBF5FB88314F10842AD919A7250CB74A945CFA0

Function 02EED368 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 02EED3DD

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 84cc3db5a293c1eb4e56fdd6ce8012deac081c793635171995d2c3f99fe93a2e
Instruction ID: 821364a6c685ea4a799a2aa162047e3386d7a7b8c8b78960c6695973a87e2ffd
Opcode Fuzzy Hash: 84cc3db5a293c1eb4e56fdd6ce8012deac081c793635171995d2c3f99fe93a2e
Instruction Fuzzy Hash: 1B11AFB18043498FDB10DF96D9467EEBFF8EB14314F18806AE595A3B81C7399604CFA5

Function 07610040 Relevance: 1.4, Instructions: 1375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3740586298.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab14ee8bb56c65ba6a863d9845eb0cb087a8e9a2135ce9891427e2636b29abd
Instruction ID: 8e841a3a53a170717592539f6b1c070b2356c0b4091a219d8b5868d2ad698aaa
Opcode Fuzzy Hash: 6ab14ee8bb56c65ba6a863d9845eb0cb087a8e9a2135ce9891427e2636b29abd
Instruction Fuzzy Hash: A2C219B47103058FDB59BB34D6A897D3BE3ABC9201B54496DD40BAB394EF399C428B41

Function 076115E8 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

Teq, xrefs: 07611615

Memory Dump Source

Source File: 00000000.00000002.3740586298.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_gagagggagagag.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: a17a791c4474b4ef4305aef865d16efaad28a8339f3e50d8f0f8bd8678088d27
Instruction ID: e94700e97b5def5d3a74f68e76a9af23c3a9174b7add47347603d4b452d8f6fa
Opcode Fuzzy Hash: a17a791c4474b4ef4305aef865d16efaad28a8339f3e50d8f0f8bd8678088d27
Instruction Fuzzy Hash: BC11E175B101159FCB049B28CA5AB6E7AF6AF8C710F280059F102E73A0CF718C028FD0

Function 076115F8 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

Teq, xrefs: 07611615

Memory Dump Source

Source File: 00000000.00000002.3740586298.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_gagagggagagag.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 53c00c1b4eeb5799dc49f74704b6caac54ddf149c61e5694b7f00c0fec20ff0b
Instruction ID: 337bcff806269be4878581bb72544c0610c8ea5e164b7b6ca213ddd5acaa9839
Opcode Fuzzy Hash: 53c00c1b4eeb5799dc49f74704b6caac54ddf149c61e5694b7f00c0fec20ff0b
Instruction Fuzzy Hash: B9016D717102199FDB189B28C969B6EBAE6AB8D710F250069F502E73A0CFB59D018BD1

Function 07610006 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3740586298.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1979590a01b6e24049b2cc686b7f52b315dcaac74fb9137b37636d8a2d1838
Instruction ID: d06c62862c89203c1d528ab3b40961bf28c7e5de69c9cc80374e0ed01b481e2b
Opcode Fuzzy Hash: 6e1979590a01b6e24049b2cc686b7f52b315dcaac74fb9137b37636d8a2d1838
Instruction Fuzzy Hash: F32177726043414FCB226BB8984519D7FB2EF87230B7900EAD547DB352DA399D8BC762

Function 0181D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3733681255.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_181d000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abea8de19d9c4638ef6bfbb272626c2fdeb4e93fa0b289a3a6438ea46f521ee
Instruction ID: 107135163d78560e08d4ddac5ede827995f35786e7790b366218a4f21d8d928d
Opcode Fuzzy Hash: 5abea8de19d9c4638ef6bfbb272626c2fdeb4e93fa0b289a3a6438ea46f521ee
Instruction Fuzzy Hash: 61214872544304DFDB05DF54D8C8B56BF69FB84324F20C269E8098B24BC336E556CBA2

Function 0182D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3733716511.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_182d000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ce683b76f04df69c5c6f975a9e3ed5e94787e0989078a312a1c34b38f8f2c2
Instruction ID: 2ca8499a5f2d63540da9c1c5a366af80e2733e9721ba98baec1e4d9a93c6fb6d
Opcode Fuzzy Hash: a0ce683b76f04df69c5c6f975a9e3ed5e94787e0989078a312a1c34b38f8f2c2
Instruction Fuzzy Hash: F7212571604604DFEB06DF54D9C4B26FF65EB84314F30C66DD8098B686C336D586CA61

Function 0181D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3733681255.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_181d000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: a02060ef77b46cf629ee7137e942c7adc3245591291e706598b026e5c99cca76
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: CE1133B6500280CFCB06CF44D5C4B56BF72FB84324F24C2A9D8094B25BC336E556CBA1

Function 0182D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3733716511.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_182d000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: fa17f387720c975e52232eb9ee138560dfe1676682616a5bab8ed221ef35f305
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 9211BB75504680CFDB06CF54D9C4B15FFA2FB84324F24C6A9DC498B696C33AD58ACB62

Non-executed Functions

Function 076117C0 Relevance: 1.0, Instructions: 1022COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3740586298.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7610000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e672c56b86ddd4fc82768e73663a93cbf4f64fb6ce664eb68f5482a3cf5881
Instruction ID: ed71e9f122218fa13601af978e0019d00b1fbcac995a0f2fcc9ebb5c95a5b83e
Opcode Fuzzy Hash: e4e672c56b86ddd4fc82768e73663a93cbf4f64fb6ce664eb68f5482a3cf5881
Instruction Fuzzy Hash: C3826E70B002058FEB14EF69C898B2EBBE2BF85301F54857CD5069F3A5CB75AD4A8B51

Function 02EEE048 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3733949164.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ee0000_gagagggagagag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db526b3508ecaffdf5e954a431509ad4d697e805f29747d1391d28b73f2087c
Instruction ID: e02893f2559527b19906cf6fd8c54f018aa43ee0b1b72a81ab2e322e58626dfa
Opcode Fuzzy Hash: 5db526b3508ecaffdf5e954a431509ad4d697e805f29747d1391d28b73f2087c
Instruction Fuzzy Hash: AB526A31A0061A8FDF14CF64C880BAEB7B6FF44314F5998A9E90AAB251D771FD85CB50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gagagggagagag.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Answers

Statistics

Windows Analysis Report
gagagggagagag.exe

Function 02EE7C7A Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Function 02EE7C80 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 02EE29C0 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Function 02EE7EC0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 02EE7EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 02EE29C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 02EED368 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 07610040 Relevance: 1.4, Instructions: 1375
COMMON