Edit tour

Windows Analysis Report
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Overview

General Information

Sample name:	1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe
Analysis ID:	1578600
MD5:	15c0e802a7c4df842a25733804d8a0ba
SHA1:	294a3e89a445bf2d27f242c14fea323c34d55585
SHA256:	a9e62ae675e9d0db930a35c24857f2e102d609a49425e7e2c97a7b1b2555e669
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Errors No process behavior to analyse as no analysis process or sample was found Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

AsyncRAT

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AsyncRAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

PE file does not import any functions

PE file overlay found

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "windows11.theworkpc.com", "Ports": "2022", "Version": "| CRACKED BY https://t.me/xworm_v2", "Autorun": "true", "Install_Folder": "%Temp%", "Install_File": "DMIDE45.tmp.exe", "AES_key": "0jqHD5VN3sjRqjZnn65GnT60RYcJixeW", "Mutex": "ERMEUDsX4nzWMHDjtnG5JA5/XTE\"o", "AntiDetection": "true", "External_config_on_Pastebin": "false", "BDOS": "null", "Startup_Delay": "3", "HWID": "Snqt7qAgsbneLLviMomu0zxihJWEPbmCht8wZWVOJAQNlnyTspAJVpkisyFdLX5JLb5jABaPfLCAYuJStI+bgQ==", "Certificate": "MIIE8jCCAtqgAwIBAgIQAJX3OBU31PdGsgdievk+0zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjExMDIwMDEwNzMwWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIxzTLr4hnFFaKeh1kJdDFO+XMX152Kh80UYTFrsZSUdoFYtEb250ZfMcFOlbfg14wjuBrn1kaoflXitSm/EtDRAIzTfctOf0QhvGJ7/g+aDHfKIuGsBlQzqtzO+0Ab7rCDwjtSJkGXSL/UvoTF1L8kXB7kI4veHXuRqCHgHKSUomkqbYkeXrfQZTvVBXV3EVEIbLCiAIOsXRjLtd6KuopfwinutWYntLXaN4HO9JSsSRJ/NIj7YV78VqZUIl3ykpxEKKBtAsy9hmDzNmSHckfA9xi7b8lnUm4uVGHja5nS1aPP4H6/WfJ8CqAe53jY89InBpXQpRjAMNBIn+KnVjDKXurV2I/REO0XjVp/IxSdccxx7a9LcaZuo1bYnVCS3PFt9BOGsUV/WVnH4jyD6vql3dRlJRubMlb031xrqbozcrnepI/qRJEAuIuvQat6aowf8RqoNnbtxOOGepC6Hc1QZp6L+/6b/EmbVES/mQpKNEji8NRDIHkecWfb5pOcuaTMC9TzQs//tVPtTjw2kfaiuiMy/b47hwXRw3b3Z/L5qm1GIMzqTnwSnIWwAvtcm/ZosCT6Gkp5UAQsn9BvVBsAdyaPuJ556ohjxD+ckqHVoz8wFmHzvuLrY/bR4RtqabhI1SG+GH+U8dk+RVZ19FUphuP+1pkmsDw9Hli/YtEg7AgMBAAGjMjAwMB0GA1UdDgQWBBTXtZPdF7dIGGVXoRT9D35BMUE1VDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCBk2+eHVC6WWkLCDRqfT/pD38to9JsD8Sb66jAf54zFl06Iu9RcBDWsUsrm0gEjY3mm8GWipkdGzSiZ83PIPeM6mClep7HxptnqyJeyZeI3y/JgHblmN1DN5lYv9jw9U/lW48SuQzmwNyfwlxYCZC6ZjcHGKWxTfd4d0Dsb2VLdrlPNy7E+mUQRBV+hwuBoOfYKMWkSWedLk8kIx93TWMVlyN9ifd81jdLwsmpVMiCjmq6xyGVGp8FiMfUpQ4N5Ul2/LK4Bli3eRuKh1jeb+quabsRcqvoadTDTshjCZs7iWhn3xPfLDeekh/8DYbbUhd2ezYlC8f0t5BwDnB+hi2WHzeKnzqYFTwW5L9FOcnNnwJMSxYcmMr5t5IB3xTIe/zbg7C7ZHcPKvaSEhrAtQme0Do6bAGEvh5NmpABvu4HHhxV9qCZKU+yc8KJVoHK/+Y+ejgC6hGE9c87f35wl/1w0Un7p6/kA5k1ZUuvPAFmKagcvCD6OG3QRSHb8c0+Cn8OkUCGUdPKFEVhLUrYAk8uFyHQeXdXn6fYPXxjhzk37Uf+VujPbAsDJCPkkAPQtnZHXwlJrdsPqqv+cu9rdgBXNEL0GWLahtuWmQTBuUtlYQZUOUMRVz8h4v2q3psLxLXHT5i9AvvS6rgRHAEazA6k1qRjBwzyJqG2F0ir34wXlg==", "ServerSignature": "GllkWVfYDosX3UjXL8lo6lEgsmnc4OPUb3b1Xg0SUTkDkC34oEHJyBVfJtXGMfQY6cfGQM50r9SZeGgcdwFzQwFmIJfLFjSp+5FS888txCqpGSdjsSmQc2/4gGd198ccF03NAYPCMEzjejLcM5W1jLFxGMfnNmJM4F5FGVa3RARJlGI8SuzxGxBTYBdEMf1WhMOxEntoG7spd/QJ8a0pTGbsaTGA+wpupS2JmnBQ09Fu8EnEXyDAfJPhJ8f1z5mL+FulBrKOt0074icNbS71t7QcbkFWwijpNd2dhhZR3Y/ygmN4tUPasmWmS/lmkeZmXlkpurAQxUWT9BZSb/Lp5x3EIV4XRCQBMkG6TaiidkONikGLhrYEB5pEXqwCfBzs8COgzSMa6k7ME6RRw/4sGNMD0x+tziMFFLM3apNihu1l66bdM7dkJh1oV/P1e37Lgqb10F98g9YD6MxGXGFHVU40BIOHyQlSRMPGVcN2xZqt5GIrNNcZ5UkfXlYg2tCzXtQzZjgodxdEytbWJGX2AhIqpwVVrynT2Y6pUGk6hABojpzVQaaPJ80QaBZCv7RWZ55yROOK8GSrLuGKu8mUY/1bEqv5yzeONXhGroEGXCfNORyxkHFqx4SK1+WkCdGiaQ8myOOdyB6qLPmDAqxLyBcxhcjYCQFicwjcBsF2BkY=", "Group": "17+1_Fuck"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xc92e:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xf7cb:$a2: Stub.exe 0xf85b:$a2: Stub.exe 0x9376:$a3: get_ActivatePong 0xcb49:$a4: vmware 0xc9be:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa271:$a6: get_SslClient
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc9c0:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Malware Configuration Extractor: AsyncRAT {"Server": "windows11.theworkpc.com", "Ports": "2022", "Version": "| CRACKED BY https://t.me/xworm_v2", "Autorun": "true", "Install_Folder": "%Temp%", "Install_File": "DMIDE45.tmp.exe", "AES_key": "0jqHD5VN3sjRqjZnn65GnT60RYcJixeW", "Mutex": "ERMEUDsX4nzWMHDjtnG5JA5/XTE\"o", "AntiDetection": "true", "External_config_on_Pastebin": "false", "BDOS": "null", "Startup_Delay": "3", "HWID": "Snqt7qAgsbneLLviMomu0zxihJWEPbmCht8wZWVOJAQNlnyTspAJVpkisyFdLX5JLb5jABaPfLCAYuJStI+bgQ==", "Certificate": "MIIE8jCCAtqgAwIBAgIQAJX3OBU31PdGsgdievk+0zANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjExMDIwMDEwNzMwWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIxzTLr4hnFFaKeh1kJdDFO+XMX152Kh80UYTFrsZSUdoFYtEb250ZfMcFOlbfg14wjuBrn1kaoflXitSm/EtDRAIzTfctOf0QhvGJ7/g+aDHfKIuGsBlQzqtzO+0Ab7rCDwjtSJkGXSL/UvoTF1L8kXB7kI4veHXuRqCHgHKSUomkqbYkeXrfQZTvVBXV3EVEIbLCiAIOsXRjLtd6KuopfwinutWYntLXaN4HO9JSsSRJ/NIj7YV78VqZUIl3ykpxEKKBtAsy9hmDzNmSHckfA9xi7b8lnUm4uVGHja5nS1aPP4H6/WfJ8CqAe53jY89InBpXQpRjAMNBIn+KnVjDKXurV2I/REO0XjVp/IxSdccxx7a9LcaZuo1bYnVCS3PFt9BOGsUV/WVnH4jyD6vql3dRlJRubMlb031xrqbozcrnepI/qRJEAuIuvQat6aowf8RqoNnbtxOOGepC6Hc1QZp6L+/6b/EmbVES/mQpKNEji8NRDIHkecWfb5pOcuaTMC9TzQs//tVPtTjw2kfaiuiMy/b47hwXRw3b3Z/L5qm1GIMzqTnwSnIWwAvtcm/ZosCT6Gkp5UAQsn9BvVBsAdyaPuJ556ohjxD+ckqHVoz8wFmHzvuLrY/bR4RtqabhI1SG+GH+U8dk+RVZ19FUphuP+1pkmsDw9Hli/YtEg7AgMBAAGjMjAwMB0GA1UdDgQWBBTXtZPdF7dIGGVXoRT9D35BMUE1VDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCBk2+eHVC6WWkLCDRqfT/pD38to9JsD8Sb66jAf54zFl06Iu9RcBDWsUsrm0gEjY3mm8GWipkdGzSiZ83PIPeM6mClep7HxptnqyJeyZeI3y/JgHblmN1DN5lYv9jw9U/lW48SuQzmwNyfwlxYCZC6ZjcHGKWxTfd4d0Dsb2VLdrlPNy7E+mUQRBV+hwuBoOfYKMWkSWedLk8kIx93TWMVlyN9ifd81jdLwsmpVMiCjmq6xyGVGp8FiMfUpQ4N5Ul2/LK4Bli3eRuKh1jeb+quabsRcqvoadTDTshjCZs7iWhn3xPfLDeekh/8DYbbUhd2ezYlC8f0t5BwDnB+hi2WHzeKnzqYFTwW5L9FOcnNnwJMSxYcmMr5t5IB3xTIe/zbg7C7ZHcPKvaSEhrAtQme0Do6bAGEvh5NmpABvu4HHhxV9qCZKU+yc8KJVoHK/+Y+ejgC6hGE9c87f35wl/1w0Un7p6/kA5k1ZUuvPAFmKagcvCD6OG3QRSHb8c0+Cn8OkUCGUdPKFEVhLUrYAk8uFyHQeXdXn6fYPXxjhzk37Uf+VujPbAsDJCPkkAPQtnZHXwlJrdsPqqv+cu9rdgBXNEL0GWLahtuWmQTBuUtlYQZUOUMRVz8h4v2q3psLxLXHT5i9AvvS6rgRHAEazA6k1qRjBwzyJqG2F0ir34wXlg==", "ServerSignature": "GllkWVfYDosX3UjXL8lo6lEgsmnc4OPUb3b1Xg0SUTkDkC34oEHJyBVfJtXGMfQY6cfGQM50r9SZeGgcdwFzQwFmIJfLFjSp+5FS888txCqpGSdjsSmQc2/4gGd198ccF03NAYPCMEzjejLcM5W1jLFxGMfnNmJM4F5FGVa3RARJlGI8SuzxGxBTYBdEMf1WhMOxEntoG7spd/QJ8a0pTGbsaTGA+wpupS2JmnBQ09Fu8EnEXyDAfJPhJ8f1z5mL+FulBrKOt0074icNbS71t7QcbkFWwijpNd2dhhZR3Y/ygmN4tUPasmWmS/lmkeZmXlkpurAQxUWT9BZSb/Lp5x3EIV4XRCQBMkG6TaiidkONikGLhrYEB5pEXqwCfBzs8COgzSMa6k7ME6RRw/4sGNMD0x+tziMFFLM3apNihu1l66bdM7dkJh1oV/P1e37Lgqb10F98g9YD6MxGXGFHVU40BIOHyQlSRMPGVcN2xZqt5GIrNNcZ5UkfXlYg2tCzXtQzZjgodxdEytbWJGX2AhIqpwVVrynT2Y6pUGk6hABojpzVQaaPJ80QaBZCv7RWZ55yROOK8GSrLuGKu8mUY/1bEqv5yzeONXhGroEGXCfNORyxkHFqx4SK1+WkCdGiaQ8myOOdyB6qLPmDAqxLyBcxhcjYCQFicwjcBsF2BkY=", "Group": "17+1_Fuck"}

Multi AV Scanner detection for submitted file

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for sample

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Joe Sandbox ML: detected

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: windows11.theworkpc.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match

File source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE

System Summary

Malicious sample detected (through community Yara rule)

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: No import functions for PE file found

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: Data appended to the last section found

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Binary or memory string: OriginalFilenameStub.exe" vs 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: classification engine

Classification label: mal88.troj.evad.winEXE@0/0@0/0

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

ReversingLabs: Detection: 47%

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Boot Survival

Yara detected AsyncRAT

Source: Yara match

File source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match

File source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Binary or memory string: SBIEDLL.DLL

Source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Binary or memory string: vmware

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match

File source: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Obfuscated Files or Information	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe	47%	ReversingLabs
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
windows11.theworkpc.com	true		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578600
Start date and time:	2024-12-19 23:28:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@0/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe Unable to launch sample, stop analysis

Errors

No process behavior to analyse as no analysis process or sample was found
Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
VT rate limit hit for: 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	17346471071327285ef086de4665e082957c3e792cf4eed0d7926676db9f12a7d8cce93192399.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	1734647108deb38ffd55bf4ee0e1256f32366f93320efa5c08106fb229cd97f7a3c54ee7b3565.dat-decoded.exe	Get hash	malicious	Quasar	Browse	13.107.246.63
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	13.107.246.63
	Gioia Faggioli-End Of Year-Bonus.docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	dz6dQWx0DD.dll	Get hash	malicious	Nitol	Browse	13.107.246.63
	Eallentoff_401k_1484013830.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	13.107.246.63
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	13.107.246.63

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.444320067160353
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe
File size:	65'457 bytes
MD5:	15c0e802a7c4df842a25733804d8a0ba
SHA1:	294a3e89a445bf2d27f242c14fea323c34d55585
SHA256:	a9e62ae675e9d0db930a35c24857f2e102d609a49425e7e2c97a7b1b2555e669
SHA512:	f7c2a7a6f90b39e383b5cce78a5cbdbdd5bd3dae641bd4d566c4f9a0e288892e55afdf3a236601aecbe3c05e8f1d108cb01a38456e50ddd4eb8228c1f2288b30
SSDEEP:	1536:mMNhAoa1YtmkscJsMKUeRauCY0b9APLlahEszOrITGpn:mM7ArYYkDsMKUeRX0b91EszOOyn
TLSH:	97530A053BE8911AF3BE8F749DF6654106F9F4AB2D12C55D0C8C05CE0663B86AA41BFB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u.4d................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x410ece
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64348F75 [Mon Apr 10 22:36:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
adc byte ptr [eax], dl
add dword ptr [ecx], eax
adc eax, 1E015112h
add byte ptr [01FD8112h], dl
push ds
add byte ptr [edx+ecx], al
add dword ptr [edx], edx
je 00007FBE4D99766Bh
and byte ptr [eax], al
adc eax, 01F58111h
adc eax, dword ptr [eax]
pop es
adc eax, 01F58111h
adc dh, byte ptr [esp+eax+20h]
add byte ptr [ebx], dl
add byte ptr [13020120h], al
add byte ptr [esi], al
and byte ptr [ecx], al
add dword ptr [ecx], edx
add byte ptr [ecx], 00000002h
sbb eax, 0100071Ch
adc al, byte ptr [edx+06051D05h]
and byte ptr [ecx], al
adc al, byte ptr [edx+200D0E09h]
add eax, 82110E1Ch
or eax, 1C118212h
sbb eax, 0100061Ch
adc al, byte ptr [ecx+00050E4Dh]
add al, byte ptr [ecx]
push cs
push cs
push es
add byte ptr [ebx], al
add dword ptr [esi], ecx
push cs
add al, byte ptr [ebx]
pop es
add dword ptr [82120000h+eax], ebx
adc eax, 12012007h
add byte ptr [0006051Dh], 00000001h
sbb al, 12h
or byte ptr [ecx], 00000008h
add byte ptr [ecx], al
adc al, byte ptr [edx+1D821109h]
or dword ptr [eax], eax
add dl, byte ptr [edx]
and byte ptr [ecx], 00000011h
and byte ptr [05001C0Eh], 00000012h
sub byte ptr [0E318211h], 00000015h
adc al, byte ptr [ecx-7DEDFE03h]
or dword ptr [edx], edx
or byte ptr [ecx], 00000015h
adc al, byte ptr [ecx-7DEDFE03h]
and dword ptr [edi], edx
adc eax, 15015912h
adc bl, byte ptr [ebp+0Ah]
adc ah, byte ptr [ecx+1Ch]
adc cl, byte ptr [000E0912h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10e78	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x7ff	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xeed4	0xf000	34a61d754976345448b0264f0a5ba7ec	False	0.45525716145833334	data	5.488562831396003	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x7ff	0x800	994e2111ace8e648c69c023b58e0232c	False	0.43994140625	data	4.168730765045266	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 23:29:41.981734037 CET	1.1.1.1	192.168.2.10	0xd012	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 23:29:41.981734037 CET	1.1.1.1	192.168.2.10	0xd012	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Boot Survival

Malware Analysis System Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

DNS Answers

Statistics

System Behavior

Disassembly

Windows Analysis Report
1734647107844cefc30e20a3cfa75326746e701b95e6b08e7c9f9df9ee9dffdfb305989914130.dat-decoded.exe