Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583461
MD5:	76969acc42256771162be6f285de947c
SHA1:	071c5791d9ca1c2382450c6ef09432e12e8b3ca2
SHA256:	155854758b79cdee58f7df5c1a4a07d3b19b3d64a0a58b2e8faf6d8b67042f3c
Tags:	NETexeMSILnjratuser-jstrosch
Infos:

Detection

DcRat, JasonRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DcRat

Yara detected JasonRAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an autostart registry key pointing to binary in C:\Windows

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4696 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 76969ACC42256771162BE6F285DE947C)

Mxscspd_BelphegorShell.exe (PID: 4084 cmdline: "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe" MD5: 412A8BBC3366FEC40120821A598EA26F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: JasonRAT

{"Server": "127.0.0.1,winner2025me.duckdns.org", "Ports": "7777", "Version": "JASON 2.1.1.0", "Autorun": "false", "Install_Folder": "AppData", "Install_File": "ScJlsrsfsks", "AES_key": "Jason\u2620LetThereBeCarnage", "Mutex": "Jason_CnzagnrahJcsdJcnzns", "AntiDetection": "null", "External_config_on_Pastebin": "false", "Startup_Delay": 1, "Certificate": "MIICRzCCAbCgAwIBAgIVANvS14Czjez/SMBBbB3uWUcyWLrFMA0GCSqGSIb3DQEBDQUAMHsxFTATBgNVBAMMDEphc29uIFNlcnZlcjEiMCAGA1UECwwZSmFzb27imKBMZXRUaGVyZUJlQ2FybmFnZTEkMCIGA1UECgwbSmFzb24g4pigIExldFRoZXJlQmVDYXJuYWdlMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwMTExMjMxNjM2WhcNMzQxMDIwMjMxNjM2WjAQMQ4wDAYDVQQDDAVKYXNvbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjynhKPrWMiHM2a9rMcQru2BGPNnbfYw5w+W/mUM/lDUQ5E5yx5wWth03JiB+yflQvUkZ/3sDm/4JQfZxiqclLIAzkXrlBxhKbaLxcxa5slQJUaypWXxwdTTu2U2bgqrOINQFGqA4qGXWVqVelz75q5QEn3PVsM9ItRcx49FsqgsCAwEAAaMyMDAwHQYDVR0OBBYEFEhI7v6kRtjV16ycOMQ1r14L2GjJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAFnxCg0+lHwa/Nkl7yer/lKO2aejOkcEGbtTxKgLGEpVClTuTTw4wQX8lc7gd0Ik5pL5VtO37O+Aj/Ysl71zgh3dd9gDKb9Uil7SP3WK2fbC/kETm++Pxi4vl4W3C6j1l9jtMOHmaNZem3Z+o+8bfkBbWtFDqp7Sul3yagpHaQzU=", "ServerSignature": "PjTTtyMY2go0IqkgPP0auxgXaWgJgSfBrFldD2kTofVnrfY4Q95vIUygNkOfDvXg9exvugXRXULtJ8VIYdVAUyOCtJjL5nFEhxkiFTV+c2RYqmHMIDydwtPnsh4BRMNcgibqvLlT2WK6OP/jVV1EV8GVrduZ74e6ok24M2khfR0=", "Group": "HOME"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Process Memory Space: file.exe PID: 4696	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39c3d90.1.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.3995570.2.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39c3d90.1.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39957c0.0.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39957c0.0.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.3995570.2.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 87.120.113.91, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, Initiated: true, ProcessId: 4084, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, ProcessId: 4084, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScJlsrsfsks

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:14:02.195868+0100	2842478	1	Malware Command and Control Activity Detected	87.120.113.91	7777	192.168.2.5	49704	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack

Malware Configuration Extractor: JasonRAT {"Server": "127.0.0.1,winner2025me.duckdns.org", "Ports": "7777", "Version": "JASON 2.1.1.0", "Autorun": "false", "Install_Folder": "AppData", "Install_File": "ScJlsrsfsks", "AES_key": "Jason\u2620LetThereBeCarnage", "Mutex": "Jason_CnzagnrahJcsdJcnzns", "AntiDetection": "null", "External_config_on_Pastebin": "false", "Startup_Delay": 1, "Certificate": "MIICRzCCAbCgAwIBAgIVANvS14Czjez/SMBBbB3uWUcyWLrFMA0GCSqGSIb3DQEBDQUAMHsxFTATBgNVBAMMDEphc29uIFNlcnZlcjEiMCAGA1UECwwZSmFzb27imKBMZXRUaGVyZUJlQ2FybmFnZTEkMCIGA1UECgwbSmFzb24g4pigIExldFRoZXJlQmVDYXJuYWdlMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwMTExMjMxNjM2WhcNMzQxMDIwMjMxNjM2WjAQMQ4wDAYDVQQDDAVKYXNvbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjynhKPrWMiHM2a9rMcQru2BGPNnbfYw5w+W/mUM/lDUQ5E5yx5wWth03JiB+yflQvUkZ/3sDm/4JQfZxiqclLIAzkXrlBxhKbaLxcxa5slQJUaypWXxwdTTu2U2bgqrOINQFGqA4qGXWVqVelz75q5QEn3PVsM9ItRcx49FsqgsCAwEAAaMyMDAwHQYDVR0OBBYEFEhI7v6kRtjV16ycOMQ1r14L2GjJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAFnxCg0+lHwa/Nkl7yer/lKO2aejOkcEGbtTxKgLGEpVClTuTTw4wQX8lc7gd0Ik5pL5VtO37O+Aj/Ysl71zgh3dd9gDKb9Uil7SP3WK2fbC/kETm++Pxi4vl4W3C6j1l9jtMOHmaNZem3Z+o+8bfkBbWtFDqp7Sul3yagpHaQzU=", "ServerSignature": "PjTTtyMY2go0IqkgPP0auxgXaWgJgSfBrFldD2kTofVnrfY4Q95vIUygNkOfDvXg9exvugXRXULtJ8VIYdVAUyOCtJjL5nFEhxkiFTV+c2RYqmHMIDydwtPnsh4BRMNcgibqvLlT2WK6OP/jVV1EV8GVrduZ74e6ok24M2khfR0=", "Group": "HOME"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: 7777
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: 127.0.0.1,winner2025me.duckdns.org
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: JASON 2.1.1.0
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: Jason_CnzagnrahJcsdJcnzns
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: MIICRzCCAbCgAwIBAgIVANvS14Czjez/SMBBbB3uWUcyWLrFMA0GCSqGSIb3DQEBDQUAMHsxFTATBgNVBAMMDEphc29uIFNlcnZlcjEiMCAGA1UECwwZSmFzb27imKBMZXRUaGVyZUJlQ2FybmFnZTEkMCIGA1UECgwbSmFzb24g4pigIExldFRoZXJlQmVDYXJuYWdlMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwMTExMjMxNjM2WhcNMzQxMDIwMjMxNjM2WjAQMQ4wDAYDVQQDDAVKYXNvbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjynhKPrWMiHM2a9rMcQru2BGPNnbfYw5w+W/mUM/lDUQ5E5yx5wWth03JiB+yflQvUkZ/3sDm/4JQfZxiqclLIAzkXrlBxhKbaLxcxa5slQJUaypWXxwdTTu2U2bgqrOINQFGqA4qGXWVqVelz75q5QEn3PVsM9ItRcx49FsqgsCAwEAAaMyMDAwHQYDVR0OBBYEFEhI7v6kRtjV16ycOMQ1r14L2GjJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAFnxCg0+lHwa/Nkl7yer/lKO2aejOkcEGbtTxKgLGEpVClTuTTw4wQX8lc7gd0Ik5pL5VtO37O+Aj/Ysl71zgh3dd9gDKb9Uil7SP3WK2fbC/kETm++Pxi4vl4W3C6j1l9jtMOHmaNZem3Z+o+8bfkBbWtFDqp7Sul3yagpHaQzU=
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: PjTTtyMY2go0IqkgPP0auxgXaWgJgSfBrFldD2kTofVnrfY4Q95vIUygNkOfDvXg9exvugXRXULtJ8VIYdVAUyOCtJjL5nFEhxkiFTV+c2RYqmHMIDydwtPnsh4BRMNcgibqvLlT2WK6OP/jVV1EV8GVrduZ74e6ok24M2khfR0=
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: null
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: HOME
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 87.120.113.91:7777 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: winner2025me.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: winner2025me.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 87.120.113.91:7777

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: winner2025me.duckdns.org

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291327110.000000001D935000.00000004.00000020.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3291032924.000000001D830000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3288869079.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en89k
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003D71000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

System Summary

.NET source code contains very large array initializations

Source: Mxscspd_BelphegorShell.exe.0.dr, Program.cs

Large array initialization: Main: array initializer size 180224

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F561C6	1_2_00007FF848F561C6
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F59368	1_2_00007FF848F59368
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F4FBF0	1_2_00007FF848F4FBF0
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F40D05	1_2_00007FF848F40D05
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F415D1	1_2_00007FF848F415D1
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F510A5	1_2_00007FF848F510A5
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F56F72	1_2_00007FF848F56F72
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F41A5E	1_2_00007FF848F41A5E

Source: Mxscspd_BelphegorShell.exe.0.dr

Static PE information: No import functions for PE file found

Source: file.exe, 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAbezethibou64.exe" vs file.exe
Source: file.exe, 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMxscspd_BelphegorShell.exe4 vs file.exe
Source: file.exe, 00000000.00000002.2044783649.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2039897335.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewrapper_jre_offline.exeP vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamewrapper_jre_offline.exeP vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/4@4/2

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Jason_CnzagnrahJcsdJcnzns

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: msdmo.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Mxscspd_BelphegorShell.exe.0.dr, Program.cs

.Net Code: LoadAndExecuteAssemblyInMemory System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E9004B push edx; retf	0_2_04E90072
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E9002C push ebx; retf	0_2_04E9004A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E901A4 push ebx; retf	0_2_04E901BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E9026B push 3C00CB50h; retf	0_2_04E90292
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F4755E push ds; iretd	1_2_00007FF848F4755F

Source: file.exe

Static PE information: section name: .text entropy: 7.7525499842123144

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Jump to dropped file

Boot Survival

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ScJlsrsfsks

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ScJlsrsfsks			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ScJlsrsfsks			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Memory allocated: 1290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Memory allocated: 1BD70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Window / User API: threadDelayed 1606			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Window / User API: threadDelayed 8229			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6640	Thread sleep count: 1606 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6568	Thread sleep count: 8229 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6752	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291579026.000000001DA02000.00000004.00000020.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3288869079.0000000001353000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"

Jump to behavior

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF7000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DEA000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291381905.000000001D953000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managern
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF7000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DEA000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291327110.000000001D935000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpeng.exe
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291579026.000000001DA02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Exploit.Generic
file.exe	100%	Avira	HEUR/AGEN.1307423
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label	Link
winner2025me.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
winner2025me.duckdns.org	87.120.113.91	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
winner2025me.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003D71000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
87.120.113.91	winner2025me.duckdns.org	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583461
Start date and time:	2025-01-02 20:13:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/4@4/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 94% Number of executed functions: 45 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 4696 because it is empty
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:14:01	API Interceptor	1x Sleep call for process: Mxscspd_BelphegorShell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.113.91	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91/image.exe
87.120.113.91	LPO-0048532025.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91/image.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172
	Hornswoggle.exe	Get hash	malicious	GuLoader	Browse	199.232.214.172
	8n26gvrXUM.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	199.232.210.172
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse	199.232.214.172
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	87.120.115.216
	rebirth.arm4t.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.spc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.sh4.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.x86.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.ppc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm6.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.m68.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63

Process:	C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.253995428229512
Encrypted:	false
SSDEEP:	6:kKz9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:iDImsLNkPlE99SNxAhUe/3
MD5:	1AA3272D53B554F8EB4E3186C994B69D
SHA1:	B361BB9EAC9B65949B50F176E97FF1461EB480A9
SHA-256:	9008EA54347D7A5DB2E0E113F9F33A34035A0CF7D954D50E03C5BA4496E0CE22
SHA-512:	964D5E2222E2DA9734D61F0BEB31DABB9E40D84AAAF5F86A8D25191068E446741539408F18D5F9763A012F28A1F30A0EF607663AB2E3B01A0595C12A42976B18
Malicious:	false
Reputation:	low
Preview:	p...... ..........y{J]..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	5.655415027243687
Encrypted:	false
SSDEEP:	3072:vXpgDh/4L28y4UBQ9bwD9wb651a0UlDRvznBf+gk:Vry4UBQ9bX651aXxR+
MD5:	412A8BBC3366FEC40120821A598EA26F
SHA1:	171CC5CF93880517BA70B59C3A26FC9B249BC02D
SHA-256:	D918B089C7CCE51352C6BCB6C3851FBF420884221BB30254179C55C42929F466
SHA-512:	2890B21770E6C8FD432AEC2193462C19229AD9AE9E2E873784720FB40A46FFD927B58258D76D4FA38B3825A76CD2DD24F2179730783AC3FE6DA24BCBEAAF8047
Malicious:	true
Yara Hits:	Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...hdng.........."...................... .....@..... ....................... ............@...@......@............... ............................................................................................................................... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..BH...............................................................................MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...v.o..........."...0.................. .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text...4.... ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.638702692097853
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	286'720 bytes
MD5:	76969acc42256771162be6f285de947c
SHA1:	071c5791d9ca1c2382450c6ef09432e12e8b3ca2
SHA256:	155854758b79cdee58f7df5c1a4a07d3b19b3d64a0a58b2e8faf6d8b67042f3c
SHA512:	c6a687236323e2ea70c89f3ad38a80d8be179ebf281ff2b5b39db9f9a3ecab67eb9ec8237df82464566d0c7fa952e5d9dfa171b61a7f1b3abeb4897f54769f52
SSDEEP:	6144:U5nFOwQLKFIkwMs+OZBH/5kA5wJEGrNTxhd:UJFOZKFIk2ZBf5kA+JE6h
TLSH:	7154E07EF245AE91C65D8A7384D7E83613B5DCAE8593E34E30E8353105B33EA0046E9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g.vg................................. ........@.. ....................................@................................

File Icon


Icon Hash:	d08c8e8ea2868a54

Static PE Info

General

Entrypoint:	0x43fc8b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67760267 [Thu Jan 2 03:05:11 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fc41	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x7d18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3dc91	0x3de00	be00ba236e84578e223b1173c30b8f09	False	0.7859296085858586	data	7.7525499842123144	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0x7d18	0x7e00	918509519b072686227a93f0492951a9	False	0.34759424603174605	data	5.884923281729306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	7fbb61b20dd594194e8c38485aabe777	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x400c4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.21890243902439024
RT_ICON	0x40750	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.3400537634408602
RT_ICON	0x40a5c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	English	United States	0.35450819672131145
RT_ICON	0x40c68	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.46283783783783783
RT_ICON	0x40db4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.5026652452025586
RT_ICON	0x41c80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.5798736462093863
RT_ICON	0x4254c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	English	United States	0.40264976958525345
RT_ICON	0x42c38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.3273121387283237
RT_ICON	0x431c4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.27344398340248965
RT_ICON	0x45790	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.37875234521575984
RT_ICON	0x4685c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.37868852459016394
RT_ICON	0x47208	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4796099290780142
RT_GROUP_ICON	0x476ac	0xae	data	English	United States	0.5977011494252874
RT_VERSION	0x47796	0x35c	data	English	United States	0.4755813953488372
RT_MANIFEST	0x47b2e	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:14:02.195868+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	87.120.113.91	7777	192.168.2.5	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:14:01.379029036 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:01.383846045 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:01.383945942 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:01.400010109 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:01.404804945 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.185301065 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.191057920 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:02.195868015 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.367734909 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.419197083 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:03.551254034 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:03.556164980 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:03.556217909 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:03.560991049 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:14.959703922 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:14.964713097 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:14.964814901 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:14.969571114 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:15.263408899 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:15.309828043 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:15.394859076 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:15.434983969 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.358086109 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.362925053 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.363883972 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.368664980 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.675950050 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.716252089 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.799747944 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.841099024 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:37.763591051 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:37.768320084 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:37.768379927 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:37.773216963 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:38.096590042 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:38.153585911 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:38.221914053 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:38.262952089 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.169670105 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.174635887 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.174743891 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.179577112 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.479302883 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.528523922 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.612181902 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.669166088 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:00.575818062 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:00.580912113 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:00.581012011 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:00.585863113 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:00.900336027 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:00.950438023 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:01.034948111 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:01.075571060 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:11.997792959 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:12.002756119 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.002859116 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:12.007597923 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.309508085 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.356694937 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:12.441042900 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.497256041 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.388670921 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.393526077 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.393623114 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.398469925 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.708152056 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.762868881 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.831518888 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.872361898 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:34.794539928 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:34.799428940 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:34.799490929 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:34.804239035 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:35.106250048 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:35.153528929 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:35.238431931 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:35.294157982 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.241620064 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.246479988 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.246546984 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.251359940 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.540797949 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.590958118 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.661737919 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.716011047 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:57.653762102 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:57.658647060 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:57.658714056 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:57.663446903 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:57.967681885 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:58.012890100 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:58.098320961 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:58.153625011 CET	49704	7777	192.168.2.5	87.120.113.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:13:57.254897118 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:13:58.247528076 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:13:59.263191938 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:14:01.263308048 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:14:01.373661041 CET	53	56738	1.1.1.1	192.168.2.5
Jan 2, 2025 20:14:01.373677969 CET	53	56738	1.1.1.1	192.168.2.5
Jan 2, 2025 20:14:01.373686075 CET	53	56738	1.1.1.1	192.168.2.5
Jan 2, 2025 20:14:01.373693943 CET	53	56738	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 2, 2025 20:13:55.197978020 CET	192.168.2.5	8.8.8.8	4d5a		Echo
Jan 2, 2025 20:13:55.204114914 CET	8.8.8.8	192.168.2.5	555a		Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:13:57.254897118 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:13:58.247528076 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:13:59.263191938 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.263308048 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:14:01.373661041 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.373677969 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.373686075 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.373693943 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:02.459532022 CET	1.1.1.1	192.168.2.5	0x9af0	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:02.459532022 CET	1.1.1.1	192.168.2.5	0x9af0	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:13:51
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6a0000
File size:	286'720 bytes
MD5 hash:	76969ACC42256771162BE6F285DE947C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:13:51
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"
Imagebase:	0xa10000
File size:	190'464 bytes
MD5 hash:	412A8BBC3366FEC40120821A598EA26F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Function 029408FC Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

paq, xrefs: 02940943
$]q, xrefs: 029409EE

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: paq$$]q
API String ID: 0-2770606447
Opcode ID: f2ae4421a6d7798b4c4bd8ab0bf80c883d48389ec70e524a9a0bc178fcbf15b9
Instruction ID: 92b0db09738e8aa2f9ecc5ef79a9f1c7254c19dd575e6997068aa4deeda69ea9
Opcode Fuzzy Hash: f2ae4421a6d7798b4c4bd8ab0bf80c883d48389ec70e524a9a0bc178fcbf15b9
Instruction Fuzzy Hash: D271F43A640104EFCB09DFA8C948D59BBB2FF4D314B168198E6059F276CB32EC65EB40

Function 0294140D Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

}, xrefs: 029413DC
bq, xrefs: 0294145F

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: }$bq
API String ID: 0-2386963243
Opcode ID: 2a10687c26c1b4a24f14e45a2b1cb77d3fe816cc24cd66ac1cc84ee292d1ad42
Instruction ID: 00a13ed6c3ef1c936e1c10029da21fde5f48e65778a6715d6c5a22aa850ae661
Opcode Fuzzy Hash: 2a10687c26c1b4a24f14e45a2b1cb77d3fe816cc24cd66ac1cc84ee292d1ad42
Instruction Fuzzy Hash: 9B512A74E1420AEFCB05DFA8D980EEDBBB5AF48340F50496AD41BAB254EB309985CF51

Function 02941B43 Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

3, xrefs: 02941B4C
_, xrefs: 02941B50

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: 3$_
API String ID: 0-3545247512
Opcode ID: 0630eb6480f6035f16c224413fbf8edb67751f83b4010d0703f37c44fee7552f
Instruction ID: 5241a875baba8822d20eb713cd43e314834d6ec123f3758af16e6682f90dfdab
Opcode Fuzzy Hash: 0630eb6480f6035f16c224413fbf8edb67751f83b4010d0703f37c44fee7552f
Instruction Fuzzy Hash: EF4181347005188FC708DFA9D9A9E6D7BE6FFC8B15B2444A9E40AC7361DF349D429B40

Function 02942D22 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

, xrefs: 02942EAA

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6eb49ab9d7e489c5f1aed43c4e0711ec300b24c2ab37511ff3628d1fb54c195e
Instruction ID: ba2d3573eb926050120e2ebc018f6a70af160fbad81d4ff5e664932ca849310d
Opcode Fuzzy Hash: 6eb49ab9d7e489c5f1aed43c4e0711ec300b24c2ab37511ff3628d1fb54c195e
Instruction Fuzzy Hash: 33416E34E042099FCB04DFA9D9849DEBBB1FF84314F208AA6E811EB355DB34AA45CB51

Function 029444DF Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

8aq, xrefs: 02944597

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: ea5b7a3a537e50dd839064d5d1fe2c7cb8a6e8fa19fcb8cdc15a1349c2297672
Instruction ID: cc72a4881b3a10c76099700289f18d08f3c0e4e1ae29271df9d70cde57ff67d9
Opcode Fuzzy Hash: ea5b7a3a537e50dd839064d5d1fe2c7cb8a6e8fa19fcb8cdc15a1349c2297672
Instruction Fuzzy Hash: 1821C124B0C145DFCF04EB68DD51F7A7BA6EBC921471098AAD4079B386CE219D06CBA2

Function 029444F8 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

8aq, xrefs: 02944597

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 591f02bb9aad53ea3b65c38752946312fe46f682b04343ec8cc7d8230a257a19
Instruction ID: 048a7dab96d0f01ac09f877cb593c90272b6bc23f395ea675d649865155e987b
Opcode Fuzzy Hash: 591f02bb9aad53ea3b65c38752946312fe46f682b04343ec8cc7d8230a257a19
Instruction Fuzzy Hash: B1216034B0C015DB8F44EA59D951F7AB7A6EBC8254B10986AD4079B385CE32AD06CBE2

Function 029413B6 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

}, xrefs: 029413DC

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: e193a2dfe4da2662c0c3566f35e0e8a856ba7f0938e7ba911ac1cefe8b6f256f
Instruction ID: 62d6137efa458f4662bf2e6832815dbd46ff18f7d2e702f9563cf1377fd2e76c
Opcode Fuzzy Hash: e193a2dfe4da2662c0c3566f35e0e8a856ba7f0938e7ba911ac1cefe8b6f256f
Instruction Fuzzy Hash: 7EE0862080E388DFC70387609C626557F389A03214B2500C3E449CB4A3C9251D0ECB62

Function 02941A09 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

V, xrefs: 02941A1C

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 094e0f1f835c9781664af5d6456457db357005b12e093d16a93ec202005a3968
Instruction ID: c020b64932a2aa6837b706a9b35379026472f4161582218f61eac1361939cde9
Opcode Fuzzy Hash: 094e0f1f835c9781664af5d6456457db357005b12e093d16a93ec202005a3968
Instruction Fuzzy Hash: 09D0A7B1C4E1449FC700CAA4E982AED7B759B55240B1542CBC44F47643DD250D4B9F61

Function 02941A18 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

V, xrefs: 02941A1C

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 64e70103f1be6647c28f6623d03347c2a8d6835967b2da7c26f5fac46c0318cd
Instruction ID: f661d9fe8941aaa192699ae846000f3f18285a74238f2a270b3503e8a7b9281c
Opcode Fuzzy Hash: 64e70103f1be6647c28f6623d03347c2a8d6835967b2da7c26f5fac46c0318cd
Instruction Fuzzy Hash: E3C08C2040820CE7C700DAC6EA01EAEB3AC9740200F004587880E03300CE321E849AA2

Function 029413D8 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

}, xrefs: 029413DC

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: d30a6919b082e526c8854762fc34f8d65e97a8c48aa5b7e3d5c645c0ef21600b
Instruction ID: fe15a2c4c1d9a228eb65fbd3139e43c9820b978397ac7622919612325c7b1c06
Opcode Fuzzy Hash: d30a6919b082e526c8854762fc34f8d65e97a8c48aa5b7e3d5c645c0ef21600b
Instruction Fuzzy Hash: 7DC0123080830CEBCA40DBD1E94AA6CB7BCAB40208F000186A80E83A40CA312E00EB81

Function 02941B30 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91cc01f5341597efb7faa474ef3634d12b8c32102b1da41f73da26422eff2110
Instruction ID: 768376743ee91155c56802d8689a40eb3b857584d858a5779df84408b8f7a899
Opcode Fuzzy Hash: 91cc01f5341597efb7faa474ef3634d12b8c32102b1da41f73da26422eff2110
Instruction Fuzzy Hash: F2C16130B006098FCB049FA9C955A9DBBF2FF88714F248569E40ADB3A5DF749D86DB40

Function 02942A2B Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2a9c57832a8eb6f49797298099ace970f60601b0167d1fcb116e42cb7cc53c
Instruction ID: 861f02acd391d1a7e6349ea060afc15efdd529bc1701ada94d3689109bb6d704
Opcode Fuzzy Hash: 6b2a9c57832a8eb6f49797298099ace970f60601b0167d1fcb116e42cb7cc53c
Instruction Fuzzy Hash: 6C717570E04B018FD725DF25C490A1ABBF2BF98310B14CA6DD89A87755DB74E986CF90

Function 029421E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a11bf4b53c664cdc0d8a4acc81c2297c60e3cdc53c0896b4b2f4b6a9b85b0b
Instruction ID: e8aaf4b63346fe4bc9110538c374ea8488ed7ce01c2cb5daf05403c7853bd2bf
Opcode Fuzzy Hash: 83a11bf4b53c664cdc0d8a4acc81c2297c60e3cdc53c0896b4b2f4b6a9b85b0b
Instruction Fuzzy Hash: 8151BE31E0C615DFCB288F55D884D6EBBB5FB846587048D2AFC5B97610CF30A845CBA6

Function 02943D08 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f24467618d4da0f0f4146500004b4fd392b293c083169230a27f9d8be664760
Instruction ID: b6a30677f27f0919f59c096a2db5be49ba35c9095ed55d313ce2d759d1a16abb
Opcode Fuzzy Hash: 3f24467618d4da0f0f4146500004b4fd392b293c083169230a27f9d8be664760
Instruction Fuzzy Hash: 5E515435609506EFC714DF35D484E1AF7B2BF9431073586AAD40A8BA41DB31F892CF84

Function 02940757 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cabbd14244e3bf4cd17964dddff89a789d2828f5f02926e9ade7a27dcf3995
Instruction ID: f25e8f9d5aaf4d01714b8a9d1872976390b0538221888058ef679de1ec809862
Opcode Fuzzy Hash: f9cabbd14244e3bf4cd17964dddff89a789d2828f5f02926e9ade7a27dcf3995
Instruction Fuzzy Hash: 31314A6280E3E55EC706AB7C9A728D87FB09D47254B0604E7C184CF177D828894EC7AA

Function 029411A1 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61aadaebe95839676c9e9bbbb63ab521a69ec2ad4fadf4f0e263ee06f029125d
Instruction ID: 7921d511eba95e951a10b1fd48fe8200b86f84fd60b98d7fc211bc9bcc728b52
Opcode Fuzzy Hash: 61aadaebe95839676c9e9bbbb63ab521a69ec2ad4fadf4f0e263ee06f029125d
Instruction Fuzzy Hash: A2413A34A041098FDB54DFA8C991BADBBB1EF89304F20819AD819DB396DB319942CF40

Function 02944381 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de22a01a151f3bc8d6147dc562953c7add926b7d23860da070e435f95308eecb
Instruction ID: 86de39dcb8111b2cf4cd5d19a617bf5d9786b35c5fafa4f1ad1a6cfdd866ce0a
Opcode Fuzzy Hash: de22a01a151f3bc8d6147dc562953c7add926b7d23860da070e435f95308eecb
Instruction Fuzzy Hash: 7731CD787041009FD748DB5DD9A1A66B3E6EBC9314B24C46E9819CB396CE76ED03DB80

Function 02942098 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08cc99ee004bfdc5b6959c121d25eceda0280db933f960bea77663e6fb28de6
Instruction ID: 73a59824bff2866ab1cc727293712b26b14b267d7a4d4fb3e0e9d3fae4e2cd6a
Opcode Fuzzy Hash: b08cc99ee004bfdc5b6959c121d25eceda0280db933f960bea77663e6fb28de6
Instruction Fuzzy Hash: D1116D70E48104DBD7188B5AC424E7EBBEABB4C244F154856FE03E7299CEB1AD00CB62

Function 02942088 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff49305f0d289b6afa22d929a9dccb049dfe8e9ca1b6bf8858931dd87b11736a
Instruction ID: eefebd205b4e2a82f001b578f9f3fe31f98f71c6334370392461e9440a52bae0
Opcode Fuzzy Hash: ff49305f0d289b6afa22d929a9dccb049dfe8e9ca1b6bf8858931dd87b11736a
Instruction Fuzzy Hash: FF110A30E5C108DBD7188B658864EBE7BE6BB4C340F10085AFD03E7645CF616906CB65

Function 029410E7 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d557031d52ae66bfeb2087aff31ce7fc502cc14610b9c41706d61b5bfef505e5
Instruction ID: ae89ec4c77b39d651df19a1026831599b2863acf3bf2e2eb019a7f6ec1461bbe
Opcode Fuzzy Hash: d557031d52ae66bfeb2087aff31ce7fc502cc14610b9c41706d61b5bfef505e5
Instruction Fuzzy Hash: 12213B74A04209EFCB14DF6DEA91A99B7F2FB8C304F10846AD4099B358DB31AD85DF40

Function 02941083 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03b1d96c4df6b079e9dc6286d5191ee1e3604133bddd1b6d538483f1979ebbf
Instruction ID: 8f522e86e7a26517e5f21f4bae61bddb2473dd3d698079c01c53373b14e77e78
Opcode Fuzzy Hash: e03b1d96c4df6b079e9dc6286d5191ee1e3604133bddd1b6d538483f1979ebbf
Instruction Fuzzy Hash: F8014F78905208EFCB44DF5DFA92A99BBF1EB8D304B10846AE40DD7324DB31A841DF40

Function 0294215F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd813e2f4d5cfebeb9fa2b1790079e82de7c0a6102f36f441213ab63b82af2c
Instruction ID: 05fc61fd1902b4aea1d7f671651249a9df80bafc724c513d887059d598c59a06
Opcode Fuzzy Hash: cbd813e2f4d5cfebeb9fa2b1790079e82de7c0a6102f36f441213ab63b82af2c
Instruction Fuzzy Hash: 83F02B311087005FC308AF65EDD1BCABB95FF84304B40897CD1498B66BCB74A90E8F90

Function 02942DB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca6e1816d14c43a46675deb2b626dc695d31a6569c54d2c53051f82af808771
Instruction ID: bba910c96c449d7844ddeea49ddd6f67e82d2697ff24a50aa3f378e51bbdab3b
Opcode Fuzzy Hash: eca6e1816d14c43a46675deb2b626dc695d31a6569c54d2c53051f82af808771
Instruction Fuzzy Hash: D1F0F631A0D3C58FC3079778945058CFF71AF92320B1982E7E064CB2E3DA249C8AC366

Function 02942D65 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f146fff094c904930401f3c017059194d514d2d987b20e2c1f18b625f7f576
Instruction ID: 90c4f7f7475eee5f380434e791a92f48ffd269726c865ef1f6993922f2a46e72
Opcode Fuzzy Hash: 96f146fff094c904930401f3c017059194d514d2d987b20e2c1f18b625f7f576
Instruction Fuzzy Hash: 03F0B421A0D3858FC7029778E85498DFFB1AF96320B1986E3E4558B2D6CB249C86C766

Function 02942614 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8dd7c5e7bc416a7af8adaab331384b14a63342dab361913271c4bfdee1d1d0
Instruction ID: b08d30e64af4b9a1e6fa26fe85e7cd70c9c8b6b4254a02bba6cbe7fe63bfadab
Opcode Fuzzy Hash: df8dd7c5e7bc416a7af8adaab331384b14a63342dab361913271c4bfdee1d1d0
Instruction Fuzzy Hash: B0F0BE31608A4B8FC7259B24ED55E5A7BA0AF40219B000B79D45ACF4A2EF28B989C780

Function 02940FE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e19dd70d2ea26cc82d3d39e59e4063e4d50d122543398445fed062df92e9ca
Instruction ID: 13cffbe492a9d6bf2854e7f08c89e62b2548990fc218ef80b0c53fb9c98f8522
Opcode Fuzzy Hash: 72e19dd70d2ea26cc82d3d39e59e4063e4d50d122543398445fed062df92e9ca
Instruction Fuzzy Hash: 24E0CD2018D0D09B461D63707526D7DBF615E8238930905FFE44FB7562CE1529C1DF97

Function 02940848 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a32173e0b0d6102e405d46d43dc825ba9d1e6af98a515cb65043ce3f472d04
Instruction ID: 916513d20eb85cb7c716d8691a7ef4fa6fe225e459e4640de631ac8a89d9e629
Opcode Fuzzy Hash: 36a32173e0b0d6102e405d46d43dc825ba9d1e6af98a515cb65043ce3f472d04
Instruction Fuzzy Hash: 16E0E5B0D0420CEFCB44DFA8860199CBFF4AB48340F1089AA8509E7310EA359A40DB91

Function 02940FF3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8c1bdf0842a0edb6796abadf9f7d67c157a99a830550cc7d64c99b32c768c6
Instruction ID: b0f527767ad8a45116ab6b019c8265a6510f8c555386821ce1a43e2639ddfb9a
Opcode Fuzzy Hash: db8c1bdf0842a0edb6796abadf9f7d67c157a99a830550cc7d64c99b32c768c6
Instruction Fuzzy Hash: 4ED05B2024D094DB861963607916DBD7F648D81299305097AF00FF7952CE563DC6EB97

Function 02942FC7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6428d72aee56065d657f39116576180e19c51ccb2abb6a5795366aa4edd4993c
Instruction ID: 6c03872e4084016ce695eaaa8fa49ebaea48a2600caa9668a2f28c644aeeb40b
Opcode Fuzzy Hash: 6428d72aee56065d657f39116576180e19c51ccb2abb6a5795366aa4edd4993c
Instruction Fuzzy Hash: 6EE0CD10A0D1944BCB07677878129EEBF32DB9632074406F6F012AA187CE281846C7D6

Function 02941027 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ac1f77a6432426d3167e766aa402d0504a9865b14c7bd4497d60f3530da4db
Instruction ID: 7f45499a27d09bbb7bad3d09bb74d55207e343fa2d134ecc21957d6e1d6430a1
Opcode Fuzzy Hash: c7ac1f77a6432426d3167e766aa402d0504a9865b14c7bd4497d60f3530da4db
Instruction Fuzzy Hash: 7BE0C2380081000FD3028B14E8A2AC1B7B4DF41220714828AC8D98BAD7CA29990B8F40

Function 02940FF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099a90a33f45f002126f4d52771d7e7b96f547c4363f1b7ba90c9cb183f7b7b6
Instruction ID: 757421148f68e5fcb8fcf184a484280c6182b8cb3184bff3b80e5682b8ed976b
Opcode Fuzzy Hash: 099a90a33f45f002126f4d52771d7e7b96f547c4363f1b7ba90c9cb183f7b7b6
Instruction Fuzzy Hash: 15D0A72024C094D7010C23503916D7D7B648E8269A3040876E10FF7511CE1A3DC0E7DB

Function 029410FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9d5ccd41012365e2f611d55c8799a37567fa704f6d51b6b66116257a7ee038
Instruction ID: 7a10ccb3f9a597219027520861dd1395b6bcec7a4bd95ea6dddb5e526f38bbca
Opcode Fuzzy Hash: 4e9d5ccd41012365e2f611d55c8799a37567fa704f6d51b6b66116257a7ee038
Instruction Fuzzy Hash: 4DE01A78A04109DFCB15DFA8DA80E9DB7B1FB4C304F10846AD4099B349DB31AD42CF90

Function 02942F83 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5276fe425e2642c66ed5e1faa806fb10c2a69891d959dfc7c2aa376ed230ec4a
Instruction ID: 258ae8103aadae2bdf39cb5cb03576960588a070b7bc303809a1836a9e17e7d8
Opcode Fuzzy Hash: 5276fe425e2642c66ed5e1faa806fb10c2a69891d959dfc7c2aa376ed230ec4a
Instruction Fuzzy Hash: 53C02222B0C49103C309525D78211CAE702CBD122070440BAE008872DACE645C0383C9

Function 029444CD Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046640611.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89fe23ee10a1cdec20f52a9c703bc6f492835c70b806ca7fd8912eb88621a1e4
Instruction ID: ea8a65bd3ba5631dad5a0610088dad23dbd27f96bbbec4463bba62ada2614da2
Opcode Fuzzy Hash: 89fe23ee10a1cdec20f52a9c703bc6f492835c70b806ca7fd8912eb88621a1e4
Instruction Fuzzy Hash: 01A011223008008F0A0802202308A3820C302C888832A08208003C3200EE308802AB00

Analysis Process: Mxscspd_BelphegorShell.exePID: 4084, Parent PID: 4696COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F415D1 Relevance: 4.7, Strings: 2, Instructions: 2171COMMON

Download Yara Rule

Strings

KAL_^, xrefs: 00007FF848F42198, 00007FF848F421DC, 00007FF848F426B4, 00007FF848F42781, 00007FF848F427C5, 00007FF848F42C9F
0jH, xrefs: 00007FF848F4160D

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID: 0jH$KAL_^
API String ID: 0-3791694833
Opcode ID: 70d949f8ef139fade9cab59bc399c35b15965f25c1c34a0817c30e28d734724a
Instruction ID: 6d2efcacad62b39b0b175be87d47a8d44d5a056ed2679b6c325820b1d98d405b
Opcode Fuzzy Hash: 70d949f8ef139fade9cab59bc399c35b15965f25c1c34a0817c30e28d734724a
Instruction Fuzzy Hash: 3AE2F131E1D95B5FEB98F76880552B922D2FFA8B84FA4417AD40DD32C7DF3CA8428245

Function 00007FF848F41A5E Relevance: 2.4, Strings: 1, Instructions: 1176COMMON

Download Yara Rule

Strings

KAL_^, xrefs: 00007FF848F42198, 00007FF848F421DC

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID: KAL_^
API String ID: 0-2336278666
Opcode ID: 8a47c3c962263ec6153d032040baf47a215781f73cc568d0552f3656797f9f7f
Instruction ID: fb969472f7b68221dfa4fbab784c0a60261385373f314e5e697b187d0df8196b
Opcode Fuzzy Hash: 8a47c3c962263ec6153d032040baf47a215781f73cc568d0552f3656797f9f7f
Instruction Fuzzy Hash: D872D131F1D95B4FEB99F72880552B922D2EFA8B84FA4417AD40DD32C7DF3DA8428245

Function 00007FF848F4FBF0 Relevance: 2.2, Strings: 1, Instructions: 911
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[VK_^, xrefs: 00007FF848F50488

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID: [VK_^
API String ID: 0-589375147
Opcode ID: f808292642bb382f9b9ef0d267bbecf4e876066f62071ea10c9ba9d8e8cc88d6
Instruction ID: c517b5d1231d5db752dbce876fdb946bfe64cdc1d2a3575a2a8377eb5ad8dcde
Opcode Fuzzy Hash: f808292642bb382f9b9ef0d267bbecf4e876066f62071ea10c9ba9d8e8cc88d6
Instruction Fuzzy Hash: BA522431E1D94A8FE759FB3884652B9B7E1FFA5794F1401BAC40EC72C3DE28A8468345

Function 00007FF848F40D05 Relevance: 2.0, Instructions: 2028COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de79a6ec4e66cabdefd428b606a31d32987e8698e9028f5b1c86066969df4502
Instruction ID: a370142694831a35b86f3d5f5d936fadb382d252a67a1759438015c9e67b3193
Opcode Fuzzy Hash: de79a6ec4e66cabdefd428b606a31d32987e8698e9028f5b1c86066969df4502
Instruction Fuzzy Hash: F4D28131F2D91A4FEB89FB28805567972E2FFA8784F5441B9D00ED32D7DF29A8428744

Function 00007FF848F510A5 Relevance: 1.8, Instructions: 1815
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7025654fdb7980d0bf6032a0159b777a6e38ef8064c7fc92062c757b84dcc4
Instruction ID: 81b9c307978ee2ca0af52a529e5f8f1a60389b8792aec305b161c2bda40e9c3f
Opcode Fuzzy Hash: 3f7025654fdb7980d0bf6032a0159b777a6e38ef8064c7fc92062c757b84dcc4
Instruction Fuzzy Hash: AEC29231F1D94A4FEB89FB28909567966E2FFA8688F944179D40DC32CBDE3CE8424345

Function 00007FF848F59368 Relevance: .8, Instructions: 755COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a8b6a7c90ceb2a886cd6a8fd5d84c886fef1a9fc19c6f37a927d653d779cb0
Instruction ID: 3daae0b98e3c787d21323c20a745a5c8749fa59831afa2943c8cff77aa96b5b0
Opcode Fuzzy Hash: d4a8b6a7c90ceb2a886cd6a8fd5d84c886fef1a9fc19c6f37a927d653d779cb0
Instruction Fuzzy Hash: 86421231E1D9198FEB99FB2894956B8B7F1EF58785F5000BAD00DD32D2DF39A8818B04

Function 00007FF848F561C6 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc2eaf973eef0c282ceabc5ccb72e7991c292f26223bed70616e98878dfa3fc
Instruction ID: 3ce1cf2e2694174df88ba200ee26744578b3a5aef9894b908bc2ef33ec1c8f47
Opcode Fuzzy Hash: fdc2eaf973eef0c282ceabc5ccb72e7991c292f26223bed70616e98878dfa3fc
Instruction Fuzzy Hash: CFF1A33091CA8D8FEBA8EF28C8557E977E1FF54350F04426EE85DC7296DB3899418B81

Function 00007FF848F56F72 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8852e9d42ad1072521a3f79f27bce24989eef2973e3b8863321bfd3048b69ece
Instruction ID: 91d29934b98b4c79d5fd9c70006dc7fe8b188179d82862045c6220d228bb977c
Opcode Fuzzy Hash: 8852e9d42ad1072521a3f79f27bce24989eef2973e3b8863321bfd3048b69ece
Instruction Fuzzy Hash: 9BE1B23090CA4E8FEBA8EF28C8557E977D1FB54350F04426EE84DC7292DF78A9458B85

Function 00007FF848F4EC38 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e99049d2fe4564c375762c5a46bb4b5dfb7169b5b13685c27a6dbd02b86fda4
Instruction ID: c24a59d47de548c7f81f09d1a3f35af27052f3d4f95de4be55ecc7d14a77a4c9
Opcode Fuzzy Hash: 1e99049d2fe4564c375762c5a46bb4b5dfb7169b5b13685c27a6dbd02b86fda4
Instruction Fuzzy Hash: A0513532D0DE594FE708EB6CA8092F97BE0EF65761F04027BD049D31D2DA28A846C785

Function 00007FF848F4A9A6 Relevance: 1.6, APIs: 1, Instructions: 145
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FF848F4AA82

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8461260ff8ea3f9f374aa7bb967e8645cfdf93a85ae6ecda51eb7ade29474d9e
Instruction ID: cb81713ef22fd2240e9b09479f93d7cf8b3b00a5d42a6b2d85b4c81bb5794eee
Opcode Fuzzy Hash: 8461260ff8ea3f9f374aa7bb967e8645cfdf93a85ae6ecda51eb7ade29474d9e
Instruction Fuzzy Hash: BE412931D0CB888FD719DBA898466F97BE1EF66721F04026FD049D32D2CF686846C795

Function 00007FF848F4F698 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF848F4F761

Memory Dump Source

Source File: 00000001.00000002.3292346373.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848f40000_Mxscspd_BelphegorShell.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 490ca7a1cd9744275c5e402ace5279e3d2617ea3b1c7e6653903f7cd5c0a6739
Instruction ID: 99e11f28a9766dc98d08ee82f3d594af86df9f52bcbcf7ccbf625393325e708e
Opcode Fuzzy Hash: 490ca7a1cd9744275c5e402ace5279e3d2617ea3b1c7e6653903f7cd5c0a6739
Instruction Fuzzy Hash: 0631F73191CA485FDB18EB6C980A6F97BE1EB69321F00027FD049D3192CB64A856C795

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: JasonRAT

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe

Function 00007FF848F4FBF0 Relevance: 2.2, Strings: 1, Instructions: 911
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre