Edit tour

Windows Analysis Report
WN3Y9XR9c7.exe

Overview

General Information

Sample name:	WN3Y9XR9c7.exe renamed because original name is a hash value
Original sample name:	1200b4fd308637f6aa6e8de5fbb57ff1.exe
Analysis ID:	1583122
MD5:	1200b4fd308637f6aa6e8de5fbb57ff1
SHA1:	5e467c042ef8080f9608f0bf268ea2bb5dc3248c
SHA256:	6238bd8ffaadb351f9a5abd2b86e72ec96ba07c2fabe4484c1a985035353ae60
Tags:	AsyncRATexeRATuser-abuse_ch
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

WN3Y9XR9c7.exe (PID: 7340 cmdline: "C:\Users\user\Desktop\WN3Y9XR9c7.exe" MD5: 1200B4FD308637F6AA6E8DE5FBB57FF1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"External_config_on_Pastebin": "null", "Server": "hellonew2025.kozow.com", "Ports": "6606,7707,8808,6666,7777", "Version": "| Edit by Vinom Rat", "Autorun": "false", "Install_Folder": "R3huQjdQUWpPbWZ6MTlKdkZwbjFrSnlBYzhwNW1lbnE=", "Install_File": "rdJdKIBGOpuOWllNDaXHNEvkvJo22F0zDwETw/NoXgXuFRsRaD3lzECtbo86y2xCt9aVPHpdlhhO0DF/rcdkbJ1JXZpXjEGlRASzkQ8aUgY=", "AES_key": "GxnB7PQjOmfz19JvFpn1kJyAc8p5menq", "Mutex": "a8sfp0g1eS/gK3zqNYWTCsb/ruev0b4KZy9MeBWq3nf+Vz4jhyZgbhKONAZV2mYFQ0RwdKDE4VHbVF6enFY21tEJJODD3jLxKRTxAvfOrOhSlXedNpLmOH/vbVniE80NqJeAI2oZaU88zCihPnVzQwI4D5d92tbdy4IQDNU+VMSe5EmAd42IaUm8tYq30Oaa6lq994eS/Z4Te4SgM/LdnC7JHnY51EYKcmgJOg8H8/R9XL5TAKUcjnqQM+A9S1GJ6pcB9GTI8P4Q4eqyzWa/oYRfcAu6i/GAmMQlWHA2anAP88rud6EdMeE1u5meK2AyMH2eIPhOfxlXLrjy+5fU5jJiR8H6VVB2kckwTrgwTvukK2ieR73QVdgSuk/ZxP7kiIiuPzH2GaYX3q5fTwQPAuXsS7qnhDqcPmI1Re5JiyNoeQE0EO8QyWnzz3RbbOY0XE1UQyKJYnIHHu9ewnqyD5016J9dQd4/3KGC47Le8VbZSffsQ5iS2bowHMLqFEviLNwPO1DMp2L2ohBpZNOMX+Ll/IZf+AEw8erSDYnXSMXPokCYFiTRNCz8MozmjqP1jIUtTvwZ9INAKrcFPVYTk65ixt9ubnAC0GAM0Vb3UCh91GvsXRwEZuieKQXVgYFkSHWm9rsTtEXZmwltkswgyl7MzBi4N0JlSoisYwVnkxc=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
WN3Y9XR9c7.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
WN3Y9XR9c7.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
WN3Y9XR9c7.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd1c4:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x991f:$a3: get_ActivatePong 0xd3dc:$a4: vmware 0xd254:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa986:$a6: get_SslClient
WN3Y9XR9c7.exe	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x991f:$str01: get_ActivatePong 0xa986:$str02: get_SslClient 0xa9a2:$str03: get_TcpClient 0x8f14:$str04: get_SendSync 0x8fb2:$str05: get_IsConnected 0x96c9:$str06: set_UseShellExecute 0xd4ea:$str07: Pastebin 0xeb82:$str08: Select * from AntivirusProduct 0x10038:$str09: Stub.exe 0x100c8:$str09: Stub.exe 0xd2d4:$str10: timeout 3 > NUL 0xd1c4:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0xd254:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
WN3Y9XR9c7.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd256:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xcfc4:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10238:$a2: Stub.exe 0x102c8:$a2: Stub.exe 0x971f:$a3: get_ActivatePong 0xd1dc:$a4: vmware 0xd054:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa786:$a6: get_SslClient
00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd056:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: WN3Y9XR9c7.exe PID: 7340	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: WN3Y9XR9c7.exe PID: 7340	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x29f1f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.WN3Y9XR9c7.exe.540000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.WN3Y9XR9c7.exe.540000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.WN3Y9XR9c7.exe.540000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd1c4:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x10038:$a2: Stub.exe 0x100c8:$a2: Stub.exe 0x991f:$a3: get_ActivatePong 0xd3dc:$a4: vmware 0xd254:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xa986:$a6: get_SslClient
0.0.WN3Y9XR9c7.exe.540000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x991f:$str01: get_ActivatePong 0xa986:$str02: get_SslClient 0xa9a2:$str03: get_TcpClient 0x8f14:$str04: get_SendSync 0x8fb2:$str05: get_IsConnected 0x96c9:$str06: set_UseShellExecute 0xd4ea:$str07: Pastebin 0xeb82:$str08: Select * from AntivirusProduct 0x10038:$str09: Stub.exe 0x100c8:$str09: Stub.exe 0xd2d4:$str10: timeout 3 > NUL 0xd1c4:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0xd254:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.0.WN3Y9XR9c7.exe.540000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xd256:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T23:26:59.737170+0100	2035595	1	Domain Observed Used for C2 Detected	207.32.218.35	6666	192.168.2.4	49730	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T23:26:59.737170+0100	2035607	1	Domain Observed Used for C2 Detected	207.32.218.35	6666	192.168.2.4	49730	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T23:26:59.737170+0100	2842478	1	Malware Command and Control Activity Detected	207.32.218.35	6666	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: WN3Y9XR9c7.exe

Avira: detected

Found malware configuration

Source: WN3Y9XR9c7.exe

Malware Configuration Extractor: AsyncRAT {"External_config_on_Pastebin": "null", "Server": "hellonew2025.kozow.com", "Ports": "6606,7707,8808,6666,7777", "Version": "| Edit by Vinom Rat", "Autorun": "false", "Install_Folder": "R3huQjdQUWpPbWZ6MTlKdkZwbjFrSnlBYzhwNW1lbnE=", "Install_File": "rdJdKIBGOpuOWllNDaXHNEvkvJo22F0zDwETw/NoXgXuFRsRaD3lzECtbo86y2xCt9aVPHpdlhhO0DF/rcdkbJ1JXZpXjEGlRASzkQ8aUgY=", "AES_key": "GxnB7PQjOmfz19JvFpn1kJyAc8p5menq", "Mutex": "a8sfp0g1eS/gK3zqNYWTCsb/ruev0b4KZy9MeBWq3nf+Vz4jhyZgbhKONAZV2mYFQ0RwdKDE4VHbVF6enFY21tEJJODD3jLxKRTxAvfOrOhSlXedNpLmOH/vbVniE80NqJeAI2oZaU88zCihPnVzQwI4D5d92tbdy4IQDNU+VMSe5EmAd42IaUm8tYq30Oaa6lq994eS/Z4Te4SgM/LdnC7JHnY51EYKcmgJOg8H8/R9XL5TAKUcjnqQM+A9S1GJ6pcB9GTI8P4Q4eqyzWa/oYRfcAu6i/GAmMQlWHA2anAP88rud6EdMeE1u5meK2AyMH2eIPhOfxlXLrjy+5fU5jJiR8H6VVB2kckwTrgwTvukK2ieR73QVdgSuk/ZxP7kiIiuPzH2GaYX3q5fTwQPAuXsS7qnhDqcPmI1Re5JiyNoeQE0EO8QyWnzz3RbbOY0XE1UQyKJYnIHHu9ewnqyD5016J9dQd4/3KGC47Le8VbZSffsQ5iS2bowHMLqFEviLNwPO1DMp2L2ohBpZNOMX+Ll/IZf+AEw8erSDYnXSMXPokCYFiTRNCz8MozmjqP1jIUtTvwZ9INAKrcFPVYTk65ixt9ubnAC0GAM0Vb3UCh91GvsXRwEZuieKQXVgYFkSHWm9rsTtEXZmwltkswgyl7MzBi4N0JlSoisYwVnkxc=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}

Multi AV Scanner detection for submitted file

Source: WN3Y9XR9c7.exe	ReversingLabs: Detection: 78%
Source: WN3Y9XR9c7.exe	Virustotal: Detection: 66%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: WN3Y9XR9c7.exe

Joe Sandbox ML: detected

Source: WN3Y9XR9c7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WN3Y9XR9c7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 207.32.218.35:6666 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 207.32.218.35:6666 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 207.32.218.35:6666 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 207.32.218.35:6666 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: hellonew2025.kozow.com

Yara detected Generic Downloader

Source: Yara match	File source: WN3Y9XR9c7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 207.32.218.35:6666

Source: global traffic

TCP traffic: 192.168.2.4:58445 -> 1.1.1.1:53

Source: Joe Sandbox View

ASN Name: 1GSERVERSUS 1GSERVERSUS

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: hellonew2025.kozow.com

Source: WN3Y9XR9c7.exe, 00000000.00000002.4109516170.0000000000A51000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: WN3Y9XR9c7.exe, 00000000.00000002.4109516170.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/ents
Source: WN3Y9XR9c7.exe, 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: WN3Y9XR9c7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WN3Y9XR9c7.exe PID: 7340, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: WN3Y9XR9c7.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: WN3Y9XR9c7.exe, type: SAMPLE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: WN3Y9XR9c7.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: WN3Y9XR9c7.exe PID: 7340, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_00C8E048		0_2_00C8E048
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_06DD1B10		0_2_06DD1B10

Source: WN3Y9XR9c7.exe, 00000000.00000002.4112573796.00000000053C9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs WN3Y9XR9c7.exe
Source: WN3Y9XR9c7.exe, 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs WN3Y9XR9c7.exe
Source: WN3Y9XR9c7.exe	Binary or memory string: OriginalFilenameStub.exe" vs WN3Y9XR9c7.exe

Source: WN3Y9XR9c7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WN3Y9XR9c7.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: WN3Y9XR9c7.exe, type: SAMPLE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: WN3Y9XR9c7.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: WN3Y9XR9c7.exe PID: 7340, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: WN3Y9XR9c7.exe, PUfZINxuvqDfKifX.cs

Base64 encoded string: 'qHLM+lEU9IN/FwEGYD81WFgSsboLobhjuYtq4+WQwFq6J1KtoebeXpb5QEzpw6XE7YrhrCuZnKRTkgmMDGfK/rp2pZGRGG5y/YvLIYpjHlA=', 'NwmeDKFXx4fBmRrJ/JPZYxdzjs+jKbXwodzTfuJtQdbb4niwPRkgTIDMrFOJJjx3zVaV/+D4nI2gUrjQ922SoggIL1mNH97KcEhNbEz1ESg=', 'rdJdKIBGOpuOWllNDaXHNEvkvJo22F0zDwETw/NoXgXuFRsRaD3lzECtbo86y2xCt9aVPHpdlhhO0DF/rcdkbJ1JXZpXjEGlRASzkQ8aUgY=', 'RnsH4d7tJmoMXyhvefqEP5qFIYMOuqIG0FBGBdCdDRC+TjtyETxBYCHP7iCXp7jzNqfTdBh+qfLqWUPdlsPDx/tMkXoJUa9d9EkJlzQs0qgmdtFUrpMS+3OwjEkpWzMJY7hOoP2pnZ76tNQI1RkeNbY4QYMtt65XCyHGn/EKRKg4/s/drIwRS2NZbVKoazZkV+GrIAnV1zJjObeatC5rRklvvEFbQC1Y4QCSBGCUN4j3/QCFnhdkaHMoZtfOyeAhEh7u/mdmdO1bINU2bAiu/NZlp90pTkTZyyjNtCqG78FqHAcR/BMb1XIgwAtLsskoy2RZtB8TnSgjOImasd5sMmUgLR1/ynLuL5RgHXKVMUEe27KUySxwtU7bn/4qCPG3/FODZNhC8Ouf0S4jbhTxKE/X4me3zTUFx2S+UX+VuprfREv61GKcoZwyD+yZUnJmg1JdBftQpUl2c9N7JeMVonwgqA+iGQDmMF6jwc/Emu4bMjD3r1tw6gN6Kv+tHEs/HmQDUCZ2z9w4/fBLxYbT7QfzZJvKu0Ok3QQDIssWH3uks623wjSLHXTnFyzkb3LBafHT0PH3uHCsDjIbamKn4OqiaBvKE/xyeWCmreFGW7hnkI4lIh6qxUzUIkQAjAiILnkuBR5IV4pfcnf+ZC6Lfz4kfizyH+VAZdzIciGhl7Z11hzJnuKr7rDt/OYrGOMijfARKzMhOSqVS/xDW4ERAExjHvfy7ZUJFaEAA3PhYvL9o8sNBphB7xNLnniy827G6e8y37BFdulGbqXiFX4Tz8PyDnc0mNUbPqRc6CyyYS7igstfqT5lAjcuG+A5/5qaKnDNmfnnkd70BY9F2tV/PTsmuvLBqQP/kLvxLAf4ACV92fSqgybRmA7y5FsnqpGQ9X+wKA/Pze6bCp6w5iDP/jCznRiCKfewCywCpWWcNEAp1SBeTggFXt+EL48xDCVKxJykqiBHTRT9bRea8KXT9BDAHibnqci48A2Lh/h4eJoeJxCBpesuvuhKSA2KFeVDiQe70R0gMM+xsz+L4XPvSbI9OGjzHlNTq0bgzU7CyI9JUGBROUzftJgXtOE6GXsffpMQGjtwrlSMgcqjcDKoQgQEl3bUMguZECI/UXrTo1nMlJcB85DdnHTbuknhZUHenrOOwgEL3Rle5+QEqCbP3CRBa5H3gRXnxIBwQgriaWFabLd7qRD8QYyO8S5sd9AHnfB/8V68wT3YYvdGvQZiHFYeVscWEYHR78gGwpoLNoDtZXRRKOZYBmEUdkRs1ftScayGCoUWkx9WDDOUBqksAEv1S6XnsT8JQxzMbMX8JFfGMCBAzXxnFuvje8l5Ni2zFaUznjoN0mSRdE/eVCKdFo81xNXUFTmqHDkS61AGVnchRwppOxIwtRortPDVwqWzCvHt4kLA3jlvGo5knZTsUakISdakS3XZae0jgulMUuXZaFCe1+udEtOe2QnkG/wc4FOzR6kZSEmz8APDVfVfvBNkNzaj5pp7NijhMZf1xD11vvY95hi0eSG7RGxPpSuvl7bJ/gsVo7ioZx2rOgWL5WSGafZ669o1CkG8fWjZEcCaDufZ2hUPx/oEgxnMQ4eaRY9WYBsfdIDZY41+ESkmgJmA2ECRaMDaW18hsm2NOBGSEfU2XL/2DUyrW5lIbz39p+/vkK9zXqN2JxvkPwlF9yOMu/lOyASabVMpJdAppoa8zWCdiTPzmd/arTzO0psdwo0xGncObXOc4d9qQzQX924cWsi39pqIZbd1AtzQT7WRwKtsyHGK72I4I3FSoNQZz5hifqwQ+CPUnl0Tk4mGF3OaEiCSbpiaKCiKrqRdOupIhCYgoiHLtI78YJ9TuavcQ6Y00PoftvIVpMpLMlT46NQVbx5GjzdXZNi/d6vqZknQzST0nBkfgnDLccL93MB2HFsjLOdhQiVg5NpkSt9Mj/OFS78rW7igHU93YWMTxY+baxzboOsH10YsYbqGfHhUxb2tt9h26gzuE68f6KaF12WSddL6on3RpqD7yTCQz3SRCnEMfZXSZcnG3fZ34fVm3ZNVv5tPm6GB2dCDdkQqp0vVq3PeV4CEQ4U0XzGh9VG0SkEXSYYgh7DgNIFnZTrxb5A7pE2JcE70kO+KnUMohZF8TbJjKl1uiuwh9WMlVP01hR+EF1KKPVAsEM/5dXl3xydI1w+kxBa7ME53CNzNipC2bd3l45GKS5p+vl1/jxgZySd974aEGIB+B3NwwsjPhAKuy/JZVBHbT5xZZOwc5y2K1bb7wHREYezYZVp1f+SBaHMACkk0rD8NO8FFAP4k1G0MJ0ypHPCku0rwX2ToDjw2PVKJe1DGxsyoESnRlJ8=', 'LBZH7gfOSgp3PKzFG9mHcVSsb3Jn+vgS5+tF4gh9Qj0OTz4awAvORKamTB2lERoxTCql2YzmCV+XHwAv27w6SpDTo3W19s2lTjVHV4n/l66uOQAox0x1fEF3RKFM8C4goEilYgQuzZrWOw9YLxR8Xdx2WBkwqU3om/LkrxCOvFyguZRc7JMffM/6LSVfPFK7zcCvzwBqy3NfpZzlkS9muEY1HIrtH7og7zdHlNJB+zKRNkUGQODcvLaGqlm6ZsFwQDmaEurd3741qZIC5t2l18EM+wqoRyuW1IIsDPN2jYc+D5kT9vXfayh

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@1/1

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk

Source: WN3Y9XR9c7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: WN3Y9XR9c7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WN3Y9XR9c7.exe	ReversingLabs: Detection: 78%
Source: WN3Y9XR9c7.exe	Virustotal: Detection: 66%

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: WN3Y9XR9c7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: WN3Y9XR9c7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: WN3Y9XR9c7.exe, ZArsPcVEXRronFD.cs

.Net Code: GlFCyXrBWuB System.AppDomain.Load(byte[])

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_00C806AF push esp; retn 0000h	0_2_00C806BA
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_00C806A0 push ecx; retn 0000h	0_2_00C806AA
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_00C8063D push edi; retn 0000h	0_2_00C80652
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_00C81967 push esp; retn 0000h	0_2_00C81972
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_00C8197B push esp; retn 0000h	0_2_00C81982
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Code function: 0_2_06DD19E5 push 6C05966Ch; iretd	0_2_06DD19F5

Source: WN3Y9XR9c7.exe, jlbRrkqBmmGQJGcT.cs

High entropy of concatenated method names: 'OLtOAjOXldYUQ', 'kPheFRumbhVXK', 'pxfPcTtcZLDl', 'oRAVjruHCIWkr', 'JSGlNUqWip', 'qTAavxrQLvqgO', 'whkWrztNSCns', 'YPtohsblDmss', 'RDxQpPgwrVOyhpS', 'azvabGXewXgdzz'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: WN3Y9XR9c7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WN3Y9XR9c7.exe PID: 7340, type: MEMORYSTR

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: WN3Y9XR9c7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WN3Y9XR9c7.exe PID: 7340, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: WN3Y9XR9c7.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Memory allocated: C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Memory allocated: 27D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Window / User API: threadDelayed 6242			Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Window / User API: threadDelayed 3604			Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe TID: 7436	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe TID: 7452	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe TID: 7460	Thread sleep count: 6242 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe TID: 7460	Thread sleep count: 3604 > 30	Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: WN3Y9XR9c7.exe	Binary or memory string: vmware
Source: WN3Y9XR9c7.exe, 00000000.00000002.4111593815.0000000004E4B000.00000004.00000020.00020000.00000000.sdmp, WN3Y9XR9c7.exe, 00000000.00000002.4109730582.0000000000ACA000.00000004.00000020.00020000.00000000.sdmp, WN3Y9XR9c7.exe, 00000000.00000002.4109516170.0000000000A51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Queries volume information: C:\Users\user\Desktop\WN3Y9XR9c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: WN3Y9XR9c7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WN3Y9XR9c7.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WN3Y9XR9c7.exe PID: 7340, type: MEMORYSTR

Source: WN3Y9XR9c7.exe, 00000000.00000002.4109516170.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, WN3Y9XR9c7.exe, 00000000.00000002.4109516170.0000000000A07000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\WN3Y9XR9c7.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WN3Y9XR9c7.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
WN3Y9XR9c7.exe	67%	Virustotal		Browse
WN3Y9XR9c7.exe	100%	Avira	TR/Dropper.Gen
WN3Y9XR9c7.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
hellonew2025.kozow.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
hellonew2025.kozow.com	207.32.218.35	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
hellonew2025.kozow.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WN3Y9XR9c7.exe, 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.32.218.35	hellonew2025.kozow.com	United States		14315	1GSERVERSUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583122
Start date and time:	2025-01-01 23:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WN3Y9XR9c7.exe renamed because original name is a hash value
Original Sample Name:	1200b4fd308637f6aa6e8de5fbb57ff1.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 18 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:27:00	API Interceptor	8265906x Sleep call for process: WN3Y9XR9c7.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	ROtw3Hvdow.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	vj0Vxt8xM4.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Dd5DwDCHJD.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	199.232.210.172
	2VsJzzWTpA.exe	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	2VsJzzWTpA.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1GSERVERSUS	Money.exe	Get hash	malicious	Quasar	Browse	104.251.123.245
	Client-built.exe	Get hash	malicious	Quasar	Browse	104.251.123.245
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	207.32.216.19
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	EICAR	Browse	104.251.123.67
	loader.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	sora.arm.elf	Get hash	malicious	Mirai	Browse	207.32.216.26
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	142.202.242.43
	System.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse	142.202.242.43
	2BuZaUic3i.exe	Get hash	malicious	RedLine	Browse	207.32.219.79
	EpCrfIUgyF.exe	Get hash	malicious	RedLine	Browse	207.32.219.79

Process:	C:\Users\user\Desktop\WN3Y9XR9c7.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\WN3Y9XR9c7.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.245596380966818
Encrypted:	false
SSDEEP:	6:kKLn9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:z2DImsLNkPlE99SNxAhUe/3
MD5:	727EAC207CD07E7C6D7A56735D9CA0C3
SHA1:	918DE649ECF6FB1A985D6F8E01E15E509605400B
SHA-256:	F6FFA7EA19E46849FD7FB52F2D8FD34B1B3154097C727AD05DE4D3C233ABFD6C
SHA-512:	BB49759BB372F6639A6B21923F8148AC45A024B57C85CC1C3EB59ED276381B53B5FBF70327319D7C4AA49A67D9D1537C721C63FFA26E75ED32990A8A83D3B34A
Malicious:	false
Reputation:	low
Preview:	p...... .........0>F.\..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.516606587411499
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	WN3Y9XR9c7.exe
File size:	67'584 bytes
MD5:	1200b4fd308637f6aa6e8de5fbb57ff1
SHA1:	5e467c042ef8080f9608f0bf268ea2bb5dc3248c
SHA256:	6238bd8ffaadb351f9a5abd2b86e72ec96ba07c2fabe4484c1a985035353ae60
SHA512:	8011014730c7a0e5f5e91ce227bacf95b2a79965b732d97ecf6f4d5708a228f954dce732f3d8f9f4d0cce450d4e0a9702c10ff874d014cdb651e3d251b965ac1
SSDEEP:	1536:PmImx6tX2kNff4sKu+UYFVsL7DlbT2KXpfmzG8RLh2LlLrmTGtx:Pm9x6tmkN7Ku+UYFVG7JbTafR0lLEmx
TLSH:	7A6308053BE98029F3BE8F7469F6268446FAF4AF2D11D95D1CC810DE0532BC29951BBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x411aee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A6F687 [Thu Jul 6 17:14:47 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11aa0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x7ff	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfaf4	0xfc00	0ba9a0aeb19946ca4ababd91ccdb4f9b	False	0.4977213541666667	data	5.555802128203955	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x7ff	0x800	33cdbc5c50f34a35b4f0e61582ac7f11	False	0.41650390625	data	4.884866150337139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	d21db3a879c5fc17277313d0e05685d8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x2cc	data			0.43575418994413406
RT_MANIFEST	0x1236c	0x493	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.43381725021349277

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T23:26:59.737170+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	207.32.218.35	6666	192.168.2.4	49730	TCP
2025-01-01T23:26:59.737170+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	207.32.218.35	6666	192.168.2.4	49730	TCP
2025-01-01T23:26:59.737170+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	207.32.218.35	6666	192.168.2.4	49730	TCP
2025-01-01T23:26:59.737170+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	207.32.218.35	6666	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 23:26:59.074845076 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:26:59.079637051 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:26:59.079722881 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:26:59.091852903 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:26:59.096818924 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:26:59.672673941 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:26:59.672693968 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:26:59.672776937 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:26:59.732290983 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:26:59.737169981 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:26:59.891808987 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:26:59.945643902 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:01.200197935 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:01.204994917 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:01.205058098 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:01.209901094 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:01.706053972 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:01.758107901 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:01.809245110 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:01.851855993 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:10.513391018 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:10.518352985 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:10.520612001 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:10.529833078 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:10.781393051 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:10.836360931 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:10.886948109 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:10.890523911 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:10.895282030 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:10.895335913 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:10.900176048 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:16.111836910 CET	58445	53	192.168.2.4	1.1.1.1
Jan 1, 2025 23:27:16.118859053 CET	53	58445	1.1.1.1	192.168.2.4
Jan 1, 2025 23:27:16.118932009 CET	58445	53	192.168.2.4	1.1.1.1
Jan 1, 2025 23:27:16.125991106 CET	53	58445	1.1.1.1	192.168.2.4
Jan 1, 2025 23:27:16.584582090 CET	58445	53	192.168.2.4	1.1.1.1
Jan 1, 2025 23:27:16.589576960 CET	53	58445	1.1.1.1	192.168.2.4
Jan 1, 2025 23:27:16.589663982 CET	58445	53	192.168.2.4	1.1.1.1
Jan 1, 2025 23:27:19.831177950 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:19.836088896 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:19.836630106 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:19.841527939 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:20.093524933 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:20.148802996 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:20.229365110 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:20.267573118 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:20.272375107 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:20.276099920 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:20.280999899 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:29.139451027 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:29.144311905 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:29.144382000 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:29.149174929 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:29.406173944 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:29.461420059 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:29.514786005 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:29.526225090 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:29.531003952 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:29.531053066 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:29.535851002 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:31.726352930 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:31.773823977 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:31.857429981 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:31.898833036 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:38.446315050 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:38.451246023 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:38.452670097 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:38.457467079 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:38.718569040 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:38.758333921 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:38.824961901 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:38.828228951 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:38.833013058 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:38.833066940 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:38.837917089 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:47.758874893 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:47.763854980 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:47.763915062 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:47.768769026 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:48.030627012 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:48.070749998 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:48.165261030 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:48.167016029 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:48.171742916 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:48.171788931 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:48.176582098 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:57.071147919 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:57.076047897 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:57.076700926 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:57.081465960 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:57.332823038 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:57.383292913 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:57.467735052 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:57.469394922 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:57.474195957 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:27:57.474246025 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:27:57.479063988 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:01.716202974 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:01.758264065 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:01.850753069 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:01.898909092 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:06.393565893 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:06.398375988 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:06.398432970 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:06.403253078 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:06.656491995 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:06.711524963 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:06.764183998 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:06.775499105 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:06.780327082 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:06.784694910 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:06.789547920 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:15.696680069 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:15.701530933 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:15.701584101 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:15.706331968 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:15.991539001 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:16.065649033 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:16.125221968 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:16.130502939 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:16.135318041 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:16.135355949 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:16.140156031 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:25.008836985 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:25.013681889 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:25.016813993 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:25.021673918 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:25.298676014 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:25.433329105 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:25.433440924 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:25.435193062 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:25.440000057 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:25.440272093 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:25.444994926 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:31.796541929 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:31.930732965 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:31.930794001 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:34.321327925 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:34.326122046 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:34.326181889 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:34.330971956 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:34.580681086 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:34.650522947 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:34.686481953 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:34.689160109 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:34.693953991 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:34.695513964 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:34.700365067 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:36.165261984 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:36.170166016 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:36.170270920 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:36.175123930 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:36.447896957 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:36.585366011 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:36.588869095 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:36.598927975 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:36.603722095 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:36.604844093 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:36.609687090 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:42.306000948 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:42.310859919 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:42.310911894 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:42.315623999 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:42.567357063 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:42.649050951 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:42.705348969 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:42.718211889 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:42.723063946 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:42.728848934 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:42.733587027 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:51.634186983 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:51.639863014 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:51.639908075 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:51.644649982 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:51.921572924 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:52.004205942 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:52.057132959 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:52.059041977 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:52.063977957 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:28:52.064018965 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:28:52.068890095 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:00.946408987 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:00.951319933 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:00.951381922 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:00.956202030 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.108850956 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.241442919 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.241513014 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:01.244807959 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:01.249558926 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.249615908 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:01.254396915 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.713349104 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.849353075 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:01.849417925 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:05.821465969 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:05.826380968 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:05.826436043 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:05.831294060 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:06.104414940 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:06.161588907 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:06.218436956 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:06.219996929 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:06.224797964 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:06.224842072 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:06.229573011 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:11.930917978 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:11.935986996 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:11.936039925 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:11.940825939 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:12.400388956 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:12.445962906 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:12.537535906 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:12.539052963 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:12.543803930 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:12.543868065 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:12.548644066 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:21.244852066 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:21.249844074 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:21.253060102 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:21.257838964 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:21.513839960 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:21.633475065 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:21.645412922 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:21.648473024 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:21.653271914 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:21.653373003 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:21.658126116 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:23.415263891 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:23.420100927 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:23.420207024 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:23.424964905 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:23.685323954 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:23.742863894 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:23.817308903 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:23.819430113 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:23.824193954 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:23.824613094 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:23.829473019 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:31.724684000 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:31.857929945 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:31.861382961 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:31.987339973 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:32.728883028 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:33.136878967 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:33.713056087 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:33.713069916 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:33.865057945 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:33.913605928 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:33.969012976 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:33.970997095 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:33.975821972 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:33.975860119 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:33.980722904 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:42.040215969 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:42.045152903 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:42.045201063 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:42.049977064 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:42.310153008 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:42.439982891 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:42.445316076 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:42.446943998 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:42.451750040 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:42.451795101 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:42.456568956 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:44.649641037 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:44.654495955 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:44.654546022 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:44.659310102 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:44.919096947 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:45.053319931 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:45.057041883 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:45.058790922 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:45.063580036 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:45.063637018 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:45.068381071 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:53.962409019 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:53.967356920 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:53.967422009 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:53.972240925 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:54.265433073 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:54.403285027 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:54.403341055 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:54.404969931 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:54.410989046 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:29:54.411040068 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:29:54.416982889 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:01.774492979 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:01.900451899 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:01.909337997 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:02.014400959 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:03.276526928 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:03.281497002 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:03.281626940 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:03.286420107 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:03.548835039 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:03.649204016 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:03.657188892 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:03.659262896 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:03.664006948 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:03.664093018 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:03.668899059 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:10.618386984 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:10.623332024 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:10.623517990 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:10.628345013 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:10.887844086 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:10.946198940 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:11.021342993 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:11.043518066 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:11.048348904 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:11.051520109 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:11.056324959 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:19.931143999 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:19.936021090 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:19.936073065 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:19.940817118 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:20.210052967 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:20.309165001 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:20.341572046 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:20.343235016 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:20.348052025 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:20.348105907 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:20.352961063 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:21.540247917 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:21.545101881 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:21.545207024 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:21.549932957 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:21.809870958 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:21.934572935 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:21.945405960 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:21.948438883 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:21.953226089 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:21.953275919 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:21.958106041 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:30.853185892 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:30.858244896 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:30.858361006 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:30.863149881 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.129837990 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.243024111 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:31.265328884 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.268129110 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:31.272974014 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.273024082 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:31.277884960 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.745032072 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.836771965 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:31.877439976 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:31.945826054 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:37.387013912 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:37.391885042 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:37.395211935 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:37.400082111 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:37.659471035 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:37.743042946 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:37.767219067 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:37.769720078 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:37.774610043 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:37.774755955 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:37.779510021 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:46.665587902 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:46.670536041 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:46.670753002 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:46.675534010 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:47.040752888 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:47.137027025 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:47.177305937 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:47.180397987 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:47.185228109 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:47.185388088 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:47.190206051 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:55.979687929 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:55.984581947 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:55.984636068 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:55.989418983 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:56.287517071 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:56.336849928 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:56.425368071 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:56.427056074 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:56.431790113 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:56.431852102 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:56.436672926 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:56.806063890 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:56.810930967 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:56.810973883 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:56.815749884 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:57.075879097 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:57.133728027 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:57.213234901 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:57.214884996 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:57.219696045 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:30:57.219808102 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:30:57.224562883 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:00.572411060 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:31:00.577482939 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:00.577524900 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:31:00.582258940 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:00.839246988 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:00.884337902 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:31:00.973438025 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:00.974482059 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:31:00.979208946 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:00.985050917 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:31:00.989819050 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:01.709630966 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:01.758729935 CET	49730	6666	192.168.2.4	207.32.218.35
Jan 1, 2025 23:31:01.841408968 CET	6666	49730	207.32.218.35	192.168.2.4
Jan 1, 2025 23:31:01.883740902 CET	49730	6666	192.168.2.4	207.32.218.35

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 23:26:58.948257923 CET	59206	53	192.168.2.4	1.1.1.1
Jan 1, 2025 23:26:59.072762012 CET	53	59206	1.1.1.1	192.168.2.4
Jan 1, 2025 23:27:16.111238956 CET	53	52411	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 23:26:58.948257923 CET	192.168.2.4	1.1.1.1	0xe0f6	Standard query (0)	hellonew2025.kozow.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 23:26:59.072762012 CET	1.1.1.1	192.168.2.4	0xe0f6	No error (0)	hellonew2025.kozow.com	207.32.218.35	A (IP address)	IN (0x0001)	false
Jan 1, 2025 23:27:00.391798973 CET	1.1.1.1	192.168.2.4	0x986c	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 23:27:00.391798973 CET	1.1.1.1	192.168.2.4	0x986c	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	17:26:53
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\WN3Y9XR9c7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WN3Y9XR9c7.exe"
Imagebase:	0x540000
File size:	67'584 bytes
MD5 hash:	1200B4FD308637F6AA6E8DE5FBB57FF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.1653920370.0000000000542000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.4110500447.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	4

Executed Functions

Function 00C87C7A Relevance: 6.2, APIs: 4, Instructions: 155
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C87CFE
GetCurrentThread.KERNEL32 ref: 00C87D3B
GetCurrentProcess.KERNEL32 ref: 00C87D78
GetCurrentThreadId.KERNEL32 ref: 00C87DD1

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 77c1d6a2be3dc9520eafc97ee5596f651476bc8a0d4abd7a526d9a88330cb1f4
Instruction ID: 1ef5241192c5c53675674ef5052968d3f714a470aba963c8a91563d7522e400d
Opcode Fuzzy Hash: 77c1d6a2be3dc9520eafc97ee5596f651476bc8a0d4abd7a526d9a88330cb1f4
Instruction Fuzzy Hash: 8861A8B0A08348CFDB14DFA9C5487EEBFF1EF48318F24856AD419A7260D7749984CB65

Function 00C87C80 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C87CFE
GetCurrentThread.KERNEL32 ref: 00C87D3B
GetCurrentProcess.KERNEL32 ref: 00C87D78
GetCurrentThreadId.KERNEL32 ref: 00C87DD1

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2c5806895ed4a46a2ed7b03bc42628dbce2d5b7006a83e943628ca2ade9c50ec
Instruction ID: 02639230c3a655ce3f272748012210c9a9fffb4707a4447dc80e913bb9282ceb
Opcode Fuzzy Hash: 2c5806895ed4a46a2ed7b03bc42628dbce2d5b7006a83e943628ca2ade9c50ec
Instruction Fuzzy Hash: 5D5177B0A00709CFDB14DFA9C548BEEBBF1AF48318F20845AE419A7360D7749984CF65

Function 00C829C0 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00C82A43

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 71bca88ae056cfe019a38609d0ca598434347a78339940f6bf2d357de718fb12
Instruction ID: 4fa147f482628eddfe8e06256d7e16950c520a2a88b58b86b385ff8a96c97c7c
Opcode Fuzzy Hash: 71bca88ae056cfe019a38609d0ca598434347a78339940f6bf2d357de718fb12
Instruction Fuzzy Hash: 0E4144B1D002598FCB24DFA9C548BEEFBF0AF48324F14842AD469A7250C775AA45CFA4

Function 06DD0040 Relevance: 1.6, Instructions: 1574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d005d7a33802329a161dc253893e1958c2198258e945f8194b69d633e99b643e
Instruction ID: b018c93aba04e4b9c2c5c846e774cc6a3316120ccc25c993d76c89f024e3fa2f
Opcode Fuzzy Hash: d005d7a33802329a161dc253893e1958c2198258e945f8194b69d633e99b643e
Instruction Fuzzy Hash: C5D2F534B002048FDB58BB74D96466E77E3EBC9309B1049A8D44B9B394EF39ED478B91

Function 00C87EC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C87F4F

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 936fb965053dc65949441ec65f8a298b3711d757c6bf168efbb51de093ab85ca
Instruction ID: 367d3ee075f4933c1a66cb90e99f9ffde67c45976f2c1ae8b18ca23df6cee93a
Opcode Fuzzy Hash: 936fb965053dc65949441ec65f8a298b3711d757c6bf168efbb51de093ab85ca
Instruction Fuzzy Hash: 202103B59002499FDB10CFAAD884AEEFFF4FB48310F14801AE969A7310D375A945CFA4

Function 00C87EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C87F4F

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 14d637137aae255800a545d989c1bee4549bc2645a6ae98dbb6d63d057db3e54
Instruction ID: 5ab88589d9a30efec9ef54c9b5715fbcc26d65acb018cf680199275def509d76
Opcode Fuzzy Hash: 14d637137aae255800a545d989c1bee4549bc2645a6ae98dbb6d63d057db3e54
Instruction Fuzzy Hash: 5021E2B59002489FDB10CFAAD984ADEBFF8EB48320F14801AE958A7310D374A944CFA4

Function 00C829C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00C82A43

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: afedc83dc03f9370fe4cb9695c591a86a27f7e0e1dee3460868b8c072716dff9
Instruction ID: ba4b3094c5620d86ce2508890affd9dbb8da4eaf5bea74f30d0779b7aa9f1d4e
Opcode Fuzzy Hash: afedc83dc03f9370fe4cb9695c591a86a27f7e0e1dee3460868b8c072716dff9
Instruction Fuzzy Hash: 492127B1D002098FCB14DF99C948BEEFBF5EF88324F14842AD459A7250C775A945CFA5

Function 00C8D368 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 00C8D3DD

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b7de226a26a4dce00924c437e6e7aaa2dd5b83ee550d01b4314c75172cea6041
Instruction ID: ebe75cffb216928742887dd2ab767f310d7e76d2f08b3b88a08deecdf48c6582
Opcode Fuzzy Hash: b7de226a26a4dce00924c437e6e7aaa2dd5b83ee550d01b4314c75172cea6041
Instruction Fuzzy Hash: D321E1B08083898FCB11CFA9C5497EEBFF0EB05314F14846DD495A7682C3395A05CF61

Function 06DD1937 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DD1965

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 63752e408865233ed61e1e7da860585e62c3e1c6911fda0005dcc564a55c34ca
Instruction ID: 180a907f8105f34a103eb3e1c80a81f89bbe69a82a1305f10cfac1d428f94034
Opcode Fuzzy Hash: 63752e408865233ed61e1e7da860585e62c3e1c6911fda0005dcc564a55c34ca
Instruction Fuzzy Hash: 2711CE31B005049FDB08EB29C958BAEBBF6EB8C700F200069E442EB3A1CF759D05CB90

Function 06DD1948 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06DD1965

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 071ca3baa441b100aeab0e8dabf2812b31e11ed54737dc51708737c90ceb0c36
Instruction ID: a807437dd4a41722c5674cc8a6098b43ace70810954a450721767967965848e2
Opcode Fuzzy Hash: 071ca3baa441b100aeab0e8dabf2812b31e11ed54737dc51708737c90ceb0c36
Instruction Fuzzy Hash: B40180317001049FDB04AB29C958B6EBBF6EB8C701F200069E502EB3A1CF759D05CB91

Function 06DD2AC8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163666df7cb7f30c9dd736fe39ac45d9a053b34f6aba07b4b1650bf6a819e6a7
Instruction ID: 7da6ea4ca78d11fe40cff0d5944e338ec04dbb91671f9ad17a62e761b1792ce2
Opcode Fuzzy Hash: 163666df7cb7f30c9dd736fe39ac45d9a053b34f6aba07b4b1650bf6a819e6a7
Instruction Fuzzy Hash: 9E2179326442008FE798EF28DC84B597BA1EF81720F1541AAF6558F3B6C7B1DE06CB90

Function 06DD001D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cfa4e30b303e658d08372dbd0d9dca123958f20371111dab7a5e31806dddf8
Instruction ID: c139da7499f615e68f353e5e0a5287b87aaf5368cf4686cad1b457c8973affa2
Opcode Fuzzy Hash: d4cfa4e30b303e658d08372dbd0d9dca123958f20371111dab7a5e31806dddf8
Instruction Fuzzy Hash: A32137306052048FDB25AF38E89029EBBF2EFC9355F1008AED14AD7351DA39DD4ACB91

Function 06DD2920 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd74ec5b859f38a8dd24ace05a5926ff62123fb7a10674db713826775b78fb5c
Instruction ID: 6d8018ea50eb6a2a146aaa56f543ef87767fb41bfda81fd34a95ba23dbd0ae45
Opcode Fuzzy Hash: fd74ec5b859f38a8dd24ace05a5926ff62123fb7a10674db713826775b78fb5c
Instruction Fuzzy Hash: D72103717402518FDB05FB68E910B5EBBA1DF81718F148668C10A8F39ADB71EA0BCBD0

Function 00C2D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4109910326.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1a6deedcc74b6a7d32d4b7f5fabb61ae3887d15cccaa1a837db8d801e1c365
Instruction ID: 395c352cc897ef37daa4371f953c09d351702e1dce542a76aa4a71344ead599d
Opcode Fuzzy Hash: 6b1a6deedcc74b6a7d32d4b7f5fabb61ae3887d15cccaa1a837db8d801e1c365
Instruction Fuzzy Hash: 2E212675504204DFDB05DF14E9C4B2ABBA5FBA8324F20C56DD80B4BA96C33BD866CA61

Function 06DD296A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b125153151e68f3896dc73bc71063c43321fd1d0e490b6b50390222560367827
Instruction ID: 09932b1c616a9fc82f6120294b61b59b89f48f534d6d7877081964595c926320
Opcode Fuzzy Hash: b125153151e68f3896dc73bc71063c43321fd1d0e490b6b50390222560367827
Instruction Fuzzy Hash: 6B2195706402459FDB41FB78D950A9EBBE1DF81318F108768C1058B396DB71EA4BCBD1

Function 06DD2978 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2a2d0b605482f8ae43241ca0f79e4d668f46731532c8fab7f152c714e5ff6f
Instruction ID: c68b8fa41897ab23daa4ef92b183b3a8b4163854dfc2af5406cbf4d20677ae21
Opcode Fuzzy Hash: 4d2a2d0b605482f8ae43241ca0f79e4d668f46731532c8fab7f152c714e5ff6f
Instruction Fuzzy Hash: 01216F70A002459FDB45FB78E950A5EBBA1EF81318F108768C1068B35ADB71EA4BCBD1

Function 00C2D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4109910326.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c2d000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 80ba3739a69789b33a8ec99ca761d7f2f5ce815a552a2cc4b2462d907104d5aa
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9A11D075504240CFDB05CF10E9C4B19BF71FB54324F24C6A9DC4A4BA56C33AD95ACB51

Function 06DD2A80 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0b8b9ed893ae83c2626d8aa4ec203e13da1cb59bacf0338b23c110aac1f2c9
Instruction ID: acff8dbde4f8940f5153cdc62cdcd85a234a5064a36a34fb49ec73ef169de527
Opcode Fuzzy Hash: 6c0b8b9ed893ae83c2626d8aa4ec203e13da1cb59bacf0338b23c110aac1f2c9
Instruction Fuzzy Hash: 150128739442405FD351EB68E800B8AFFF0EFC1364F0486ABD1568B351D770D60A8B90

Non-executed Functions

Function 06DD1B10 Relevance: 1.0, Instructions: 1023COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113146426.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866dcb13959f68c751be261c22fe64fe04e6bff85939f40c0eea0a3b711f37c3
Instruction ID: 5447ccd7b7dadb95c926d7e4b0d20ac3e5719f85ee8c4d2695d83945f7c08b4a
Opcode Fuzzy Hash: 866dcb13959f68c751be261c22fe64fe04e6bff85939f40c0eea0a3b711f37c3
Instruction Fuzzy Hash: 20828F30B002049FDB54EF69C9C4B6EBAE2FF84304F508578D1469B3A6DB75DE4A8B91

Function 00C8E048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110078330.0000000000C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_WN3Y9XR9c7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a3a668fa32a9df0e6f272592d60de307aeb5e743bc5e59307f0d7d36c1904d
Instruction ID: f23ab1472de2856c424ae6957d412d3c1c265b24ca4cdd80b12097217e5fc0bd
Opcode Fuzzy Hash: d0a3a668fa32a9df0e6f272592d60de307aeb5e743bc5e59307f0d7d36c1904d
Instruction Fuzzy Hash: 7B528031A00619CFCB15DF64C880BAEB7B6FF45308F5584A9E919AB251D770FE85CB84

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WN3Y9XR9c7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
WN3Y9XR9c7.exe

Function 00C87C7A Relevance: 6.2, APIs: 4, Instructions: 155
threadCOMMON

Function 00C87C80 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00C829C0 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 00C87EC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 00C87EC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00C829C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 00C8D368 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON