Edit tour

Windows Analysis Report
82eqjqLrzE.exe

Overview

General Information

Sample name:	82eqjqLrzE.exe renamed because original name is a hash value
Original sample name:	a7f9f165cd238ccbe2ca5803fcd3209d.exe
Analysis ID:	1586390
MD5:	a7f9f165cd238ccbe2ca5803fcd3209d
SHA1:	1c145bc3fa28fa807d3c831de524b5806e0de334
SHA256:	f98a607f7aed8a5dd5950711a576fede3326857b4254de991abaf9a70e77be7b
Tags:	AsyncRATexeRATuser-abuse_ch
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

.NET source code contains very large strings

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

82eqjqLrzE.exe (PID: 7556 cmdline: "C:\Users\user\Desktop\82eqjqLrzE.exe" MD5: A7F9F165CD238CCBE2CA5803FCD3209D)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tempfile (PID: 7628 cmdline: "C:\Users\user\Desktop\tempfile" MD5: E00A1AB434452FD6F77C941C09F257D6)

82eqjqLrzE.exe (PID: 7808 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe" MD5: A7F9F165CD238CCBE2CA5803FCD3209D)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tempfile (PID: 7876 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile" MD5: E00A1AB434452FD6F77C941C09F257D6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"External_config_on_Pastebin": "null", "Server": "144.91.79.54", "Ports": "32769", "Version": "0.5.8", "Autorun": "false", "Install_Folder": "TestFile.exe", "Install_File": "MUNGSUVObzNmRlRHdEM2TFlxTUdENVRqYnF6T05oY2o="}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\tempfile	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\Desktop\tempfile	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\Desktop\tempfile	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
C:\Users\user\Desktop\tempfile	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL 0x9915:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
C:\Users\user\Desktop\tempfile	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL 0x9915:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x5848d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x6391d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x6f8e5:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x597b0:$a2: Stub.exe 0x59840:$a2: Stub.exe 0x64c40:$a2: Stub.exe 0x64cd0:$a2: Stub.exe 0x70c08:$a2: Stub.exe 0x70c98:$a2: Stub.exe 0x55277:$a3: get_ActivatePong 0x60707:$a3: get_ActivatePong 0x6c6cf:$a3: get_ActivatePong 0x586a5:$a4: vmware 0x63b35:$a4: vmware 0x6fafd:$a4: vmware 0x5851d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x639ad:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x6f975:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x55fd2:$a6: get_SslClient 0x61462:$a6: get_SslClient 0x6d42a:$a6: get_SslClient
00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x5851f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x639af:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x6f977:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x564d5:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x61965:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x6d92d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x577f8:$a2: Stub.exe 0x57888:$a2: Stub.exe 0x62c88:$a2: Stub.exe 0x62d18:$a2: Stub.exe 0x6ec50:$a2: Stub.exe 0x6ece0:$a2: Stub.exe 0x532bf:$a3: get_ActivatePong 0x5e74f:$a3: get_ActivatePong 0x6a717:$a3: get_ActivatePong 0x566ed:$a4: vmware 0x61b7d:$a4: vmware 0x6db45:$a4: vmware 0x56565:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x619f5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x6d9bd:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5401a:$a6: get_SslClient 0x5f4aa:$a6: get_SslClient 0x6b472:$a6: get_SslClient
00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x56567:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x619f7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x6d9bf:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: 82eqjqLrzE.exe PID: 7556	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: 82eqjqLrzE.exe PID: 7556	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2cbd6:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: tempfile PID: 7628	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: tempfile PID: 7628	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xbbbf:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: 82eqjqLrzE.exe PID: 7808	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: 82eqjqLrzE.exe PID: 7808	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x23136:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.82eqjqLrzE.exe.2c14bc0.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.82eqjqLrzE.exe.2514b78.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.82eqjqLrzE.exe.2c14bc0.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b15:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d2d:$a4: vmware 0x7ba5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
3.2.82eqjqLrzE.exe.2514b78.2.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b15:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d2d:$a4: vmware 0x7ba5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
0.2.82eqjqLrzE.exe.2c14bc0.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e4b:$str07: Pastebin 0x7ecd:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c25:$str10: timeout 3 > NUL 0x7b15:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
3.2.82eqjqLrzE.exe.2514b78.2.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e4b:$str07: Pastebin 0x7ecd:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c25:$str10: timeout 3 > NUL 0x7b15:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
3.2.82eqjqLrzE.exe.2514b78.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7ba7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.82eqjqLrzE.exe.2c14bc0.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7ba7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.82eqjqLrzE.exe.2c20050.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.82eqjqLrzE.exe.2c20050.2.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b15:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d2d:$a4: vmware 0x7ba5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
0.2.82eqjqLrzE.exe.2c20050.2.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e4b:$str07: Pastebin 0x7ecd:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c25:$str10: timeout 3 > NUL 0x7b15:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.82eqjqLrzE.exe.2c20050.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7ba7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
3.2.82eqjqLrzE.exe.252bfd0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.82eqjqLrzE.exe.252bfd0.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b15:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d2d:$a4: vmware 0x7ba5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
3.2.82eqjqLrzE.exe.252bfd0.1.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e4b:$str07: Pastebin 0x7ecd:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c25:$str10: timeout 3 > NUL 0x7b15:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
3.2.82eqjqLrzE.exe.252bfd0.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7ba7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL 0x9915:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.82eqjqLrzE.exe.2c2c018.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.82eqjqLrzE.exe.2c2c018.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b15:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d2d:$a4: vmware 0x7ba5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
0.2.82eqjqLrzE.exe.2c2c018.1.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e4b:$str07: Pastebin 0x7ecd:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c25:$str10: timeout 3 > NUL 0x7b15:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.82eqjqLrzE.exe.2c2c018.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7ba7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
3.2.82eqjqLrzE.exe.2520008.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.82eqjqLrzE.exe.2520008.3.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b15:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d2d:$a4: vmware 0x7ba5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
3.2.82eqjqLrzE.exe.2520008.3.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48ff:$str01: get_ActivatePong 0x565a:$str02: get_SslClient 0x5676:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e4b:$str07: Pastebin 0x7ecd:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c25:$str10: timeout 3 > NUL 0x7b15:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7ba5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
3.2.82eqjqLrzE.exe.2520008.3.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7ba7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL 0x9915:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
2.0.tempfile.f80000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.tempfile.f80000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.tempfile.f80000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
2.0.tempfile.f80000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL 0x9915:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99a5:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
2.0.tempfile.f80000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x158dd:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x16c00:$a2: Stub.exe 0x16c90:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x126c7:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x15af5:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1596d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient 0x13422:$a6: get_SslClient
0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x126c7:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x13422:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x1343e:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x11cd6:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x11d26:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x12455:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x15c13:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0x15c95:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x16c00:$str09: Stub.exe 0x16c90:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL
0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1596f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14da5:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x20d6d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x160c8:$a2: Stub.exe 0x16158:$a2: Stub.exe 0x22090:$a2: Stub.exe 0x22120:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x11b8f:$a3: get_ActivatePong 0x1db57:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x14fbd:$a4: vmware 0x20f85:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x14e35:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x20dfd:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient 0x128ea:$a6: get_SslClient 0x1e8b2:$a6: get_SslClient
0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x11b8f:$str01: get_ActivatePong 0x1db57:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x128ea:$str02: get_SslClient 0x1e8b2:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x12906:$str03: get_TcpClient 0x1e8ce:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x1119e:$str04: get_SendSync 0x1d166:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x111ee:$str05: get_IsConnected 0x1d1b6:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x1191d:$str06: set_UseShellExecute 0x1d8e5:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x150db:$str07: Pastebin 0x210a3:$str07: Pastebin
0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14e37:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x20dff:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.82eqjqLrzE.exe.2520008.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.82eqjqLrzE.exe.2520008.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14da5:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x20d6d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x160c8:$a2: Stub.exe 0x16158:$a2: Stub.exe 0x22090:$a2: Stub.exe 0x22120:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x11b8f:$a3: get_ActivatePong 0x1db57:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x14fbd:$a4: vmware 0x20f85:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x14e35:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x20dfd:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient 0x128ea:$a6: get_SslClient 0x1e8b2:$a6: get_SslClient
3.2.82eqjqLrzE.exe.2520008.3.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9915:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x158dd:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x16c00:$a2: Stub.exe 0x16c90:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x126c7:$a3: get_ActivatePong 0x9b2d:$a4: vmware 0x15af5:$a4: vmware 0x99a5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1596d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient 0x13422:$a6: get_SslClient
3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x11b8f:$str01: get_ActivatePong 0x1db57:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x128ea:$str02: get_SslClient 0x1e8b2:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x12906:$str03: get_TcpClient 0x1e8ce:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x1119e:$str04: get_SendSync 0x1d166:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x111ee:$str05: get_IsConnected 0x1d1b6:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x1191d:$str06: set_UseShellExecute 0x1d8e5:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x150db:$str07: Pastebin 0x210a3:$str07: Pastebin
3.2.82eqjqLrzE.exe.2520008.3.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66ff:$str01: get_ActivatePong 0x126c7:$str01: get_ActivatePong 0x745a:$str02: get_SslClient 0x13422:$str02: get_SslClient 0x7476:$str03: get_TcpClient 0x1343e:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x11cd6:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x11d26:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x12455:$str06: set_UseShellExecute 0x9c4b:$str07: Pastebin 0x15c13:$str07: Pastebin 0x9ccd:$str08: Select * from AntivirusProduct 0x15c95:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x16c00:$str09: Stub.exe 0x16c90:$str09: Stub.exe 0x9a25:$str10: timeout 3 > NUL
3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14e37:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x20dff:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
3.2.82eqjqLrzE.exe.2520008.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99a7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1596f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 54 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\Desktop\tempfile", CommandLine: "C:\Users\user\Desktop\tempfile", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\tempfile, NewProcessName: C:\Users\user\Desktop\tempfile, OriginalFileName: C:\Users\user\Desktop\tempfile, ParentCommandLine: "C:\Users\user\Desktop\82eqjqLrzE.exe", ParentImage: C:\Users\user\Desktop\82eqjqLrzE.exe, ParentProcessId: 7556, ParentProcessName: 82eqjqLrzE.exe, ProcessCommandLine: "C:\Users\user\Desktop\tempfile", ProcessId: 7628, ProcessName: tempfile

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\82eqjqLrzE.exe, ProcessId: 7556, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T01:12:07.785445+0100	2035595	1	Domain Observed Used for C2 Detected	144.91.79.54	32769	192.168.2.4	49730	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T01:12:07.785445+0100	2035607	1	Domain Observed Used for C2 Detected	144.91.79.54	32769	192.168.2.4	49730	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T01:12:07.785445+0100	2842478	1	Malware Command and Control Activity Detected	144.91.79.54	32769	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 82eqjqLrzE.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\Desktop\tempfile	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"External_config_on_Pastebin": "null", "Server": "144.91.79.54", "Ports": "32769", "Version": "0.5.8", "Autorun": "false", "Install_Folder": "TestFile.exe", "Install_File": "MUNGSUVObzNmRlRHdEM2TFlxTUdENVRqYnF6T05oY2o="}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\Desktop\tempfile	ReversingLabs: Detection: 95%
Source: C:\Users\user\Desktop\tempfile	Virustotal: Detection: 77%	Perma Link

Multi AV Scanner detection for submitted file

Source: 82eqjqLrzE.exe	Virustotal: Detection: 72%			Perma Link
Source: 82eqjqLrzE.exe	ReversingLabs: Detection: 83%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\tempfile	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 82eqjqLrzE.exe

Joe Sandbox ML: detected

Source: 82eqjqLrzE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 82eqjqLrzE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 144.91.79.54:32769 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 144.91.79.54:32769 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 144.91.79.54:32769 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 144.91.79.54:32769 -> 192.168.2.4:49730

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 144.91.79.54 ports 2,3,6,7,9,32769

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\Desktop\tempfile, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 144.91.79.54:32769

Source: Joe Sandbox View

IP Address: 144.91.79.54 144.91.79.54

Source: Joe Sandbox View

ASN Name: CONTABODE CONTABODE

Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54

Source: tempfile, 00000002.00000002.4164826482.00000000057A5000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: tempfile, 00000002.00000002.4164826482.00000000057A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabo
Source: tempfile, 00000002.00000002.4160266032.0000000001577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enE
Source: tempfile, 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tempfile PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\tempfile, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: 82eqjqLrzE.exe PID: 7556, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: tempfile PID: 7628, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: 82eqjqLrzE.exe PID: 7808, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\Desktop\tempfile, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: C:\Users\user\Desktop\tempfile, type: DROPPED	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: C:\Users\user\Desktop\tempfile, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

.NET source code contains very large strings

Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Long String: Length: 12296
Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Long String: Length: 12296
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Long String: Length: 12292
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Long String: Length: 12292

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Code function: 0_2_00007FFD9BAA0AD5	0_2_00007FFD9BAA0AD5
Source: C:\Users\user\Desktop\tempfile	Code function: 2_2_033C65C0	2_2_033C65C0
Source: C:\Users\user\Desktop\tempfile	Code function: 2_2_033C5CF0	2_2_033C5CF0
Source: C:\Users\user\Desktop\tempfile	Code function: 2_2_033C59A8	2_2_033C59A8
Source: C:\Users\user\Desktop\tempfile	Code function: 2_2_033CA878	2_2_033CA878
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Code function: 3_2_00007FFD9BAA0D13	3_2_00007FFD9BAA0D13

Source: 82eqjqLrzE.exe, 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs 82eqjqLrzE.exe
Source: 82eqjqLrzE.exe, 00000000.00000000.1714077602.0000000000842000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamecrypted.exe4 vs 82eqjqLrzE.exe
Source: 82eqjqLrzE.exe, 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs 82eqjqLrzE.exe
Source: 82eqjqLrzE.exe	Binary or memory string: OriginalFilenamecrypted.exe4 vs 82eqjqLrzE.exe
Source: 82eqjqLrzE.exe.0.dr	Binary or memory string: OriginalFilenamecrypted.exe4 vs 82eqjqLrzE.exe

Source: 82eqjqLrzE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: 82eqjqLrzE.exe PID: 7556, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: tempfile PID: 7628, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: 82eqjqLrzE.exe PID: 7808, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\Desktop\tempfile, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: C:\Users\user\Desktop\tempfile, type: DROPPED	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: C:\Users\user\Desktop\tempfile, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 82eqjqLrzE.exe, -----------------------------------------.cs	Base64 encoded string: 'p9xVpcIA39/rd7ijA8V38TU6ZO8Jn/h0q+qI5Zb4UZcPQV8ac+XQoHwciTqebZxKoOa8jmTf3S/BSFXAyOyCVSRlEh8vp5pQoEb0VSCk5VzLgW+8lO5d5oaHe/2uK0guH5jlHY4a94Fs7FS+9XCFbSY8GdaVtYZN7DkFCJSJnLn6a4/cuNsbGHUZH9dvHSm8Jw1C4nvcyWzbie7Ha/U5ypPEZqjHnKNCR36mGWBV4/ByAtLdI+pK+ut+Ca2e4QXyFQ8MIKJ8Bt7v7K5QmkbCD2QY7vpBzc9Fam6/tz0/Od73WCEs5yCVvrdgST2UbhzEPixGDVMqOBLDzIvndnwMHMBJ/51g1NFz6nVY57CXNrNG+ErlhL5B40cbpRROeotwASwt45PJmMdW2qlAmiIwd5w5Rtf/Ed7MMRHw3kP3DtbbP/2qjVtsOyM/DaxS82/iKLu8PeRMO5eNwyZRB0dG6qNLjryPR4NvqsZuS3BAEo57gH+jreT3/Zz6R3gDSJcimn8/LXvrQHVICz9t6wpwjGeiy+gjqJPKBVAxGBr+aplKGRNbba4GaLUnOu1CFPSM6MhjsEW7CJgK5PL+4kYwdY2Cbc9zIsctxraXKNkKIzdYN5NhP9YvuGSykPwUAichkvpkS9TjlPyWwLkfzxlhFGB1e2cvcM9SII+qPFkWxTUZh110PJPsXWH9qO5E/YvGXY19NCxnWbm79L+UYRiGMEjOYnnhqRViV7YdDT+g7s3aa9Bl37/42rC9LT++liLgb0xBeDjD/8Jr/r1ouRY2VZZ0YxiCXCNismk043JKKKj482iGz6xZ8HMGboEoQPtqOcYXHHdvxvYkiLAh477a5P3ujkNr++dZWif7thRhmtu3ToUcQPbUOIeVMEZ50e3Lj6o5sCg0+O4+q+n5pANHY565RHTjwaxfA4bTfqtFJeB/50mI8RS9+XyBZcT/lfDj+d5i2XYJpucnPNGNlI9W2fHbeJNe8EmGt0KlPMvvyf42qf5rt7zdtMK0ThafSHRbwZp1f9NF3h131bwqm/b7yWtAwnfZ9LdTA9HEJaWURRcg+CxJjczGDy9JtVGAc30VZIhycIZl0+HR5ZTgtFMXkXPRCP2cJQhLmzH3IdVCVZN0zthZJBWS3bxszUM7rWF4REgOkfW5se7AdxRftbthbz/ojwlpBFhhzv/9hAa/FjFueSne7S+kkW2KjJTrfCsnk8L1oMq4ZnX98EEXoER99QyD7TAJmjW3eNE3BeiO/xnKTYgw+wDDyXFUT+CqB3WDC/HHdsmUxThToYiSk+GBvlfZKL1KD3GZepCLe7JB6eAadHdI+nBDa3eWw+qBU6w9Ru+WrEh1u09mnvri/Qsex9BDqo0OTzCl1aCtNMVcegz4wzOdRIFLMDX2CqcYbqWvfO3b/sf3ouCPqtaa+2foLLTCuV9Iy9IqdzjTtiLsVm17NPwUmHISYYHijXdZKY19+VgpeNpRE6Kp7G9hPYvOU71GhUOiABtxCpo0TmlkNGfzJSNq+7x6rw8twpQU/3K9ZTAOYu5dJZpOs7FaSImJkd/qamGL2VUwLKw+OWcP37rxLxyM9Jp3uiDjTtGIRLvZlGmybtjuqk/nFH5g6o7DPmt0kD70IndD0aQucK01RdyBaMk0Rkd+/NCXYV8mOc+ErZo43pSSVIdgE/xSa0i+jzyO5p4rfPXz96s4h8n4FzXm2u1cEtz2Faeu5JOeFkmwQ+/hNYWWfhQfuk8lpSqI9UIy4XmfKLMERs38V9l40VkTf0GkmOUCv/dlnk8MQxJabW3Wm+3rudwgjQTcZ+zTXO0NyMy9AqX9DUFGkghNy1tuXzYbHcc0QBfpyjllTaEYrEQLwQffCIQHaIuxTlq31Islkr/DxG8z3feEm57gAbyLe80o9Vc19Of29GHI0mS00+YrYopJHBL1wYb1W52FO3R8acwwjfT/uW6+Z5Ak3I3rMsCIYDGLPMQFA0OmA4atptgahFf6BcFB9u3npquuR0J603W3+hDr8kwS884gt5H57CC+FXPZFL+UfffLJwJhyM075WCBdLAjvijthKG+yfKcKKxhUHuAfbLttszxvGAnB89RFiWYKNEiI2H2oeq2AcD/1oFFtJQHH2oxOhgcG1pC0ePF6OYGMfjAe5tivM+RGrTnt9cP4sJuvk96GspMh31QlLgIwtUlR4AkrLi1IUVwCsTQFWH/CT8B45nc0YidWQZ+1SHY9IxzCMZ/YnTLLCfAZNiibFrafpSMGLPMqC114QKu7IwuBLSfi/5le2hNZ2MJsggJakCFF8IrlI+mxruTYL1mWO64xmNwn2gPCYTb+mT+MobkymTDG+wrOx/Nb2g1hcBlhcmrKu7kTuHuFR19aYq72NJLDRP+hZtDdMNAY1V7ZwNjr8vLQ/7qNcAIuFlxIUhbWVobxUBtW7jXDli4rmXI9/a7e6NB281OIZPv4auoXkpKEPnuMRBjPR0hlDCehLWPDZoIBl/mVFZGnmNVvLaGG5SN1Sn4N0NlpXuHes2olGHe+NYjjRTZkMr6LK7u+D1wHvyDLxeNqM0gLTbAoALmgLEsCKc8LMquTfPqhrITuWJKRmyxwwz4lNTia727xgx3sYiDk/wFWtR1jAksZW6IGN0YvT9bGR06heXzvmLLXSN18O2R87wphTAUZh2wMJw3NTEGc5WLnAof+MDDnjUpL5J14TXesDoTYij1TPeVepUEWGQeMRlyX8L7XVz0T61zm7CCPodE3vWm7enTNnp2/v8KVa3OAZdXsV5M3NANoJC1sDoAAyNJsVOX7fE+zcZp1SDPxogd9ugpD+1XF5J8pZagh1Z4HU9d9z6H/YgpLK4yOqxniZf2FVHaXYT0o/3Oxe/2l8HBmFMiKslUyVGNfgEeq3zs+XvC0ebBQPReptNtcFZtOqQsuSraOhS9BEpMs53AMAZAj1KlHpIeFCZfzQOqfb2k0aP7P9Nwh7TwuUq12JLtJB1uIPHe+8Lkwfg/JNU
Source: 82eqjqLrzE.exe.0.dr, -----------------------------------------.cs	Base64 encoded string: 'p9xVpcIA39/rd7ijA8V38TU6ZO8Jn/h0q+qI5Zb4UZcPQV8ac+XQoHwciTqebZxKoOa8jmTf3S/BSFXAyOyCVSRlEh8vp5pQoEb0VSCk5VzLgW+8lO5d5oaHe/2uK0guH5jlHY4a94Fs7FS+9XCFbSY8GdaVtYZN7DkFCJSJnLn6a4/cuNsbGHUZH9dvHSm8Jw1C4nvcyWzbie7Ha/U5ypPEZqjHnKNCR36mGWBV4/ByAtLdI+pK+ut+Ca2e4QXyFQ8MIKJ8Bt7v7K5QmkbCD2QY7vpBzc9Fam6/tz0/Od73WCEs5yCVvrdgST2UbhzEPixGDVMqOBLDzIvndnwMHMBJ/51g1NFz6nVY57CXNrNG+ErlhL5B40cbpRROeotwASwt45PJmMdW2qlAmiIwd5w5Rtf/Ed7MMRHw3kP3DtbbP/2qjVtsOyM/DaxS82/iKLu8PeRMO5eNwyZRB0dG6qNLjryPR4NvqsZuS3BAEo57gH+jreT3/Zz6R3gDSJcimn8/LXvrQHVICz9t6wpwjGeiy+gjqJPKBVAxGBr+aplKGRNbba4GaLUnOu1CFPSM6MhjsEW7CJgK5PL+4kYwdY2Cbc9zIsctxraXKNkKIzdYN5NhP9YvuGSykPwUAichkvpkS9TjlPyWwLkfzxlhFGB1e2cvcM9SII+qPFkWxTUZh110PJPsXWH9qO5E/YvGXY19NCxnWbm79L+UYRiGMEjOYnnhqRViV7YdDT+g7s3aa9Bl37/42rC9LT++liLgb0xBeDjD/8Jr/r1ouRY2VZZ0YxiCXCNismk043JKKKj482iGz6xZ8HMGboEoQPtqOcYXHHdvxvYkiLAh477a5P3ujkNr++dZWif7thRhmtu3ToUcQPbUOIeVMEZ50e3Lj6o5sCg0+O4+q+n5pANHY565RHTjwaxfA4bTfqtFJeB/50mI8RS9+XyBZcT/lfDj+d5i2XYJpucnPNGNlI9W2fHbeJNe8EmGt0KlPMvvyf42qf5rt7zdtMK0ThafSHRbwZp1f9NF3h131bwqm/b7yWtAwnfZ9LdTA9HEJaWURRcg+CxJjczGDy9JtVGAc30VZIhycIZl0+HR5ZTgtFMXkXPRCP2cJQhLmzH3IdVCVZN0zthZJBWS3bxszUM7rWF4REgOkfW5se7AdxRftbthbz/ojwlpBFhhzv/9hAa/FjFueSne7S+kkW2KjJTrfCsnk8L1oMq4ZnX98EEXoER99QyD7TAJmjW3eNE3BeiO/xnKTYgw+wDDyXFUT+CqB3WDC/HHdsmUxThToYiSk+GBvlfZKL1KD3GZepCLe7JB6eAadHdI+nBDa3eWw+qBU6w9Ru+WrEh1u09mnvri/Qsex9BDqo0OTzCl1aCtNMVcegz4wzOdRIFLMDX2CqcYbqWvfO3b/sf3ouCPqtaa+2foLLTCuV9Iy9IqdzjTtiLsVm17NPwUmHISYYHijXdZKY19+VgpeNpRE6Kp7G9hPYvOU71GhUOiABtxCpo0TmlkNGfzJSNq+7x6rw8twpQU/3K9ZTAOYu5dJZpOs7FaSImJkd/qamGL2VUwLKw+OWcP37rxLxyM9Jp3uiDjTtGIRLvZlGmybtjuqk/nFH5g6o7DPmt0kD70IndD0aQucK01RdyBaMk0Rkd+/NCXYV8mOc+ErZo43pSSVIdgE/xSa0i+jzyO5p4rfPXz96s4h8n4FzXm2u1cEtz2Faeu5JOeFkmwQ+/hNYWWfhQfuk8lpSqI9UIy4XmfKLMERs38V9l40VkTf0GkmOUCv/dlnk8MQxJabW3Wm+3rudwgjQTcZ+zTXO0NyMy9AqX9DUFGkghNy1tuXzYbHcc0QBfpyjllTaEYrEQLwQffCIQHaIuxTlq31Islkr/DxG8z3feEm57gAbyLe80o9Vc19Of29GHI0mS00+YrYopJHBL1wYb1W52FO3R8acwwjfT/uW6+Z5Ak3I3rMsCIYDGLPMQFA0OmA4atptgahFf6BcFB9u3npquuR0J603W3+hDr8kwS884gt5H57CC+FXPZFL+UfffLJwJhyM075WCBdLAjvijthKG+yfKcKKxhUHuAfbLttszxvGAnB89RFiWYKNEiI2H2oeq2AcD/1oFFtJQHH2oxOhgcG1pC0ePF6OYGMfjAe5tivM+RGrTnt9cP4sJuvk96GspMh31QlLgIwtUlR4AkrLi1IUVwCsTQFWH/CT8B45nc0YidWQZ+1SHY9IxzCMZ/YnTLLCfAZNiibFrafpSMGLPMqC114QKu7IwuBLSfi/5le2hNZ2MJsggJakCFF8IrlI+mxruTYL1mWO64xmNwn2gPCYTb+mT+MobkymTDG+wrOx/Nb2g1hcBlhcmrKu7kTuHuFR19aYq72NJLDRP+hZtDdMNAY1V7ZwNjr8vLQ/7qNcAIuFlxIUhbWVobxUBtW7jXDli4rmXI9/a7e6NB281OIZPv4auoXkpKEPnuMRBjPR0hlDCehLWPDZoIBl/mVFZGnmNVvLaGG5SN1Sn4N0NlpXuHes2olGHe+NYjjRTZkMr6LK7u+D1wHvyDLxeNqM0gLTbAoALmgLEsCKc8LMquTfPqhrITuWJKRmyxwwz4lNTia727xgx3sYiDk/wFWtR1jAksZW6IGN0YvT9bGR06heXzvmLLXSN18O2R87wphTAUZh2wMJw3NTEGc5WLnAof+MDDnjUpL5J14TXesDoTYij1TPeVepUEWGQeMRlyX8L7XVz0T61zm7CCPodE3vWm7enTNnp2/v8KVa3OAZdXsV5M3NANoJC1sDoAAyNJsVOX7fE+zcZp1SDPxogd9ugpD+1XF5J8pZagh1Z4HU9d9z6H/YgpLK4yOqxniZf2FVHaXYT0o/3Oxe/2l8HBmFMiKslUyVGNfgEeq3zs+XvC0ebBQPReptNtcFZtOqQsuSraOhS9BEpMs53AMAZAj1KlHpIeFCZfzQOqfb2k0aP7P9Nwh7TwuUq12JLtJB1uIPHe+8Lkwfg/JNU
Source: tempfile.0.dr, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: tempfile.3.dr, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, Settings.cs	Base64 encoded string: 'hVXlqXz77IfksXChB0M4FG1wS+EfTd+kAocBN4DBlsjZQ8/fBGfRmboE/VBRfr89+vKoAp0HCyFsU8CN0KxxGg==', 'iZxh+vB4k04PE6LOSX9NLWN2pcEJGxF8QAQK9S3a0U1qjNg/4qkJe20vIypyLde/nlD4Iwd+49+yDUVEjh+gUw==', '/WDdD0pvfjNN75fAU13GldHdrntzpTtFzlt6XrnqY7WxhBXKMu2yAMELv0jcPwU/m7KhukN+xj93J9k44WMSOw==', 'zWl11kMUJNAdPpTZCEgJx95bL0FFEtynXJA/8UKGQJNAEXrzSHxGJK6Q3bdz7iXcg5omevOzM7aNBzVl6Mg8RA==', '/qTcxLo7f6YFq+hN+JQojNJeJSYMZNllAB8IbAuVNxD3oyn22oqbd8yrz8IpSRMVKY6RgCU31mhH1Qr1GQZV7A==', 'zr8iN2mKtjuJmwLNauAjNKu0XcrDf2AatD/xZ+UkRy3wwu7Zc6VUMBAAfzaj7QztQ9dZtBz86T2K49s9F7RHXA==', 'gjw4Zrp9HwJHkk56Rh8R1gD0IlshCR2G0R4m5tTPktq1j6APSPCli1Mg0xuqqJxD1aSw1eO+ukzAufKwnvtLBw=='

Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: tempfile.3.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: tempfile.3.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: tempfile.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: tempfile.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@8/8@0/1

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Mutant created: NULL
Source: C:\Users\user\Desktop\tempfile	Mutant created: \Sessions\1\BaseNamedObjects\E9IiT5JzUivo
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03

Source: 82eqjqLrzE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 82eqjqLrzE.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 82eqjqLrzE.exe	Virustotal: Detection: 72%
Source: 82eqjqLrzE.exe	ReversingLabs: Detection: 83%

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

File read: C:\Users\user\Desktop\82eqjqLrzE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\82eqjqLrzE.exe "C:\Users\user\Desktop\82eqjqLrzE.exe"
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process created: C:\Users\user\Desktop\tempfile "C:\Users\user\Desktop\tempfile"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile"
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process created: C:\Users\user\Desktop\tempfile "C:\Users\user\Desktop\tempfile"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile"	Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\tempfile

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 82eqjqLrzE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 82eqjqLrzE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Code function: 0_2_00007FFD9BAA00BD pushad ; iretd	0_2_00007FFD9BAA00C1
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Code function: 0_2_00007FFD9BAA0AB2 push ebx; retf	0_2_00007FFD9BAA0AB3
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Code function: 3_2_00007FFD9BAA0C29 push edx; retf	3_2_00007FFD9BAA0C2B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Code function: 3_2_00007FFD9BAA00BD pushad ; iretd	3_2_00007FFD9BAA00C1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Code function: 3_2_00007FFD9BAA0AB2 push ebx; retf	3_2_00007FFD9BAA0AB3

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Jump to dropped file
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	File created: C:\Users\user\Desktop\tempfile	Jump to dropped file

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	File created: C:\Users\user\Desktop\tempfile			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile			Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tempfile PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\tempfile, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile			Jump to dropped file
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe			Jump to dropped file

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe

Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Jump to behavior

Source: C:\Users\user\Desktop\tempfile	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tempfile PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\tempfile, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 82eqjqLrzE.exe, 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, 82eqjqLrzE.exe, 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, tempfile.3.dr, tempfile.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Memory allocated: DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Memory allocated: 1ABA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Memory allocated: 3420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Memory allocated: 520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Memory allocated: 1A4A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Memory allocated: C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Memory allocated: 45F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\tempfile	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Window / User API: threadDelayed 2276	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Window / User API: threadDelayed 7684	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Window / User API: threadDelayed 7159	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Window / User API: threadDelayed 2685	Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe TID: 7624	Thread sleep time: -2276000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\82eqjqLrzE.exe TID: 7624	Thread sleep time: -7684000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tempfile TID: 7716	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tempfile TID: 7740	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tempfile TID: 7748	Thread sleep count: 7159 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tempfile TID: 7748	Thread sleep count: 2685 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe TID: 7864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile TID: 7896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\tempfile	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\tempfile	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: tempfile.0.dr	Binary or memory string: vmware
Source: tempfile, 00000002.00000002.4165413556.000000000586F000.00000004.00000020.00020000.00000000.sdmp, tempfile, 00000002.00000002.4165149998.000000000582E000.00000004.00000020.00020000.00000000.sdmp, tempfile, 00000002.00000002.4160266032.0000000001577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\tempfile

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: tempfile, 00000002.00000002.4161978474.0000000003473000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.00000000034AC000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q
Source: tempfile, 00000002.00000002.4161978474.0000000003473000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.00000000034AC000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: tempfile, 00000002.00000002.4161978474.0000000003473000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.00000000034AC000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q%
Source: tempfile, 00000002.00000002.4161978474.00000000034AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q\|
Source: tempfile, 00000002.00000002.4161978474.0000000003473000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^qPEG
Source: tempfile, 00000002.00000002.4161978474.0000000003473000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^qpCG
Source: tempfile, 00000002.00000002.4161978474.00000000034AC000.00000004.00000800.00020000.00000000.sdmp, tempfile, 00000002.00000002.4161978474.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q

Source: C:\Users\user\Desktop\82eqjqLrzE.exe	Queries volume information: C:\Users\user\Desktop\82eqjqLrzE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Queries volume information: C:\Users\user\Desktop\tempfile VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tempfile	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\82eqjqLrzE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.252bfd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c2c018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.tempfile.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c20050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.82eqjqLrzE.exe.2c14bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2514b78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.82eqjqLrzE.exe.2520008.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tempfile PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82eqjqLrzE.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\tempfile, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, type: DROPPED

Source: tempfile, 00000002.00000002.4165149998.000000000582E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\tempfile

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	2 Process Injection	11 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	12 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
82eqjqLrzE.exe	72%	Virustotal		Browse
82eqjqLrzE.exe	83%	ReversingLabs	ByteCode-MSIL.Dropper.Crysan
82eqjqLrzE.exe	100%	Avira	TR/Dropper.Gen
82eqjqLrzE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	100%	Avira	TR/Dropper.Gen
C:\Users\user\Desktop\tempfile	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	100%	Joe Sandbox ML
C:\Users\user\Desktop\tempfile	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	71%	ReversingLabs	ByteCode-MSIL.Dropper.Crysan
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	96%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile	77%	Virustotal		Browse
C:\Users\user\Desktop\tempfile	96%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
C:\Users\user\Desktop\tempfile	77%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.23	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	tempfile, 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
144.91.79.54	unknown	Germany		51167	CONTABODE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586390
Start date and time:	2025-01-09 01:11:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	82eqjqLrzE.exe renamed because original name is a hash value
Original Sample Name:	a7f9f165cd238ccbe2ca5803fcd3209d.exe
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@8/8@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 70 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 52.149.20.212, 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target tempfile, PID 7628 because it is empty
Execution Graph export aborted for target tempfile, PID 7876 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:12:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe
19:12:08	API Interceptor	2x Sleep call for process: tempfile modified
19:12:34	API Interceptor	17133314x Sleep call for process: 82eqjqLrzE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
144.91.79.54	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	144.91.79.54/1211/file
	Ref#150062.vbe	Get hash	malicious	MassLogger RAT	Browse	144.91.79.54/1211/file
	BankInformation.vbe	Get hash	malicious	AgentTesla	Browse	144.91.79.54/1211/file
	Ref#2073306.vbe	Get hash	malicious	MicroClip	Browse	144.91.79.54/0911/file
	SWIFTCOPY202973783.vbe	Get hash	malicious	AgentTesla	Browse	144.91.79.54/0911/file
	Ref#130709.vbe	Get hash	malicious	MassLogger RAT	Browse	144.91.79.54/0911/file
	MV EAGLE EYE RFQ-92008882920-PDF.vbs	Get hash	malicious	Unknown	Browse	144.91.79.54/2210/file
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	144.91.79.54/2210/file
	Chronopost_FormulaireAdresse.vbs	Get hash	malicious	AsyncRAT	Browse	144.91.79.54/2210/file
	Ref#150689.vbe	Get hash	malicious	AgentTesla	Browse	144.91.79.54/1210/file

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	EEdSGSana5.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	Magicleap-bonus disbursment.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Selvi Payroll Benefits & Bonus Agreementfdp.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	atomxml.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	199.232.210.172
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.232.214.172
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	PEDIDO DE COMPRAS OC 1203 CRI234.xlsx.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	invoice-1623385214.pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	199.232.214.172
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	217.20.57.36
	Setup.exe	Get hash	malicious	LummaC	Browse	217.20.57.18
	Insomia.exe	Get hash	malicious	LummaC	Browse	84.201.210.35
	T1#U5b89#U88c5#U53052.0.6.msi	Get hash	malicious	Unknown	Browse	84.201.210.34
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	84.201.210.22
	Dd5DwDCHJD.exe	Get hash	malicious	Quasar	Browse	217.20.57.35
	46VHQmFDxC.exe	Get hash	malicious	RedLine	Browse	217.20.57.43
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	217.20.57.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CONTABODE	DF2.exe	Get hash	malicious	Unknown	Browse	173.249.2.110
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	173.249.11.35
	bot.m68k.elf	Get hash	malicious	Mirai	Browse	95.212.118.93
	bot.mips.elf	Get hash	malicious	Mirai	Browse	95.212.118.77
	SC_TR11670000_pdf.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	payload-c17f7df6-cf80-43d5-8c60-eca90366debb.exe	Get hash	malicious	Metasploit	Browse	178.238.231.204
	RFQ3978 39793980.pdf.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	ORDER-401.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	PO2412010.exe	Get hash	malicious	FormBook	Browse	161.97.142.144

Process:	C:\Users\user\Desktop\tempfile
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\tempfile
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2441017925653757
Encrypted:	false
SSDEEP:	6:kK5lL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2DImsLNkPlE99SNxAhUe/3
MD5:	04EA33E30CC0CEDB01E5CC7D7D4597C5
SHA1:	4998A99B4AA1D45B6D1DA482EFE0C5625A06232A
SHA-256:	E2591A910603BAA9EE93668A51450C8F670F3B7C53C4549B443F32F04E01665D
SHA-512:	8C3CA07B586AE8FC55A084322C7A7694CDC16EC442A7E4A0B89BB61C0B6E9B124D28C29C9570BFADD61322A8BA3933C829550CD96A66CAFB8FC7A306E108A21F
Malicious:	false
Reputation:	low
Preview:	p...... ..........Y.+b..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\82eqjqLrzE.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tempfile.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe

Download File

Process:	C:\Users\user\Desktop\82eqjqLrzE.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	165888
Entropy (8bit):	4.701012294126888
Encrypted:	false
SSDEEP:	3072:OHUWEdcWRJy1kI4E/BaSv9krW5xpvp4mKawJ1X3zsIW0sk0Y1:OHUWEdcWRYcEUS7pviIAs19
MD5:	A7F9F165CD238CCBE2CA5803FCD3209D
SHA1:	1C145BC3FA28FA807D3C831DE524B5806E0DE334
SHA-256:	F98A607F7AED8A5DD5950711A576FEDE3326857B4254DE991ABAF9A70E77BE7B
SHA-512:	F352947E7E3F9FD7157539C2890FFBFCE6A933AF4DF047E47661C7BE8E66AFE7BA994910174641915C1FF6626FBAA897C020F662AC723BC8606CD0100A613ED7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 72%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zg.................~............... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...4}... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B........................H.......\...xn............................................................(0....0................(....r...p......%......(.....o......,d ..@. .`d.a%..^E....<...\|.......d.......+zr/..p........%.r3..p.o....o....-. ....%+. .!..%&. A..$Za+........s....s....%.o.....o.... .aE.8y....(..... -&..Z d...a8a.......0..Q........u......:.... 3... ....a%...^E....W...o.......................4...............8.....o....,. \..&%+. ..'.%&+...o..... ....Z .a..a+.(....-. ...%+. .eQ.%&. .B.:Za8m..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\82eqjqLrzE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.445512357577953
Encrypted:	false
SSDEEP:	768:Nu2/0TckJ26WUsFvgmo2q7MKjPGaG6PIyzjbFgX3iE8ealLUbsC1h4tBDZOx:Nu2/0TceH2ZKTkDy3bCXSTOsC1SdOx
MD5:	E00A1AB434452FD6F77C941C09F257D6
SHA1:	19E5BB008A1C4560C60F503E03C51A5934DB1015
SHA-256:	DA22AB3197CE1C6B427ECD1111166020C8FEBA35D4153296D439F56C7B4502E8
SHA-512:	D3AD25EED77E5E55C44C623FA2A48E9C3705DA0D14696A4D9A6297D471EB3E594F6E5CF4871F3A9B258C274EFFC44936160BD06420152D7BBD53CC89B7420EA2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-e................................. ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Y...l.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...VrP%.p~....(o....#....s...

C:\Users\user\Desktop\tempfile

Download File

Process:	C:\Users\user\Desktop\82eqjqLrzE.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	46080
Entropy (8bit):	5.445512357577953
Encrypted:	false
SSDEEP:	768:Nu2/0TckJ26WUsFvgmo2q7MKjPGaG6PIyzjbFgX3iE8ealLUbsC1h4tBDZOx:Nu2/0TceH2ZKTkDy3bCXSTOsC1SdOx
MD5:	E00A1AB434452FD6F77C941C09F257D6
SHA1:	19E5BB008A1C4560C60F503E03C51A5934DB1015
SHA-256:	DA22AB3197CE1C6B427ECD1111166020C8FEBA35D4153296D439F56C7B4502E8
SHA-512:	D3AD25EED77E5E55C44C623FA2A48E9C3705DA0D14696A4D9A6297D471EB3E594F6E5CF4871F3A9B258C274EFFC44936160BD06420152D7BBD53CC89B7420EA2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\Desktop\tempfile, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\tempfile, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\Desktop\tempfile, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: C:\Users\user\Desktop\tempfile, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\Desktop\tempfile, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-e................................. ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Y...l.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...VrP%.p~....(o....#....s...

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.701012294126888
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	82eqjqLrzE.exe
File size:	165'888 bytes
MD5:	a7f9f165cd238ccbe2ca5803fcd3209d
SHA1:	1c145bc3fa28fa807d3c831de524b5806e0de334
SHA256:	f98a607f7aed8a5dd5950711a576fede3326857b4254de991abaf9a70e77be7b
SHA512:	f352947e7e3f9fd7157539c2890ffbfce6a933af4df047e47661c7be8e66afe7ba994910174641915c1ff6626fbaa897c020f662ac723bc8606cd0100a613ed7
SSDEEP:	3072:OHUWEdcWRJy1kI4E/BaSv9krW5xpvp4mKawJ1X3zsIW0sk0Y1:OHUWEdcWRYcEUS7pviIAs19
TLSH:	C0F3132839EA705EF173EE759FD43CA6DA5EB673270B541A1053038A8B1ED43CE9143A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zg.................~............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x429d2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677A178D [Sun Jan 5 05:24:29 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29cd4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x27d34	0x27e00	6fd6a89147e334d58a092dc406a58571	False	0.4611456700626959	data	4.71157345448764	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2a000	0x4ce	0x600	e0651b41454eeaafc4724e6f2ade55ad	False	0.37109375	data	3.714878526660704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0xc	0x200	074a5de55ee9576330fd10e81f16f9b5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2a0a0	0x244	data			0.46379310344827585
RT_MANIFEST	0x2a2e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T01:12:07.785445+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	144.91.79.54	32769	192.168.2.4	49730	TCP
2025-01-09T01:12:07.785445+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	144.91.79.54	32769	192.168.2.4	49730	TCP
2025-01-09T01:12:07.785445+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	144.91.79.54	32769	192.168.2.4	49730	TCP
2025-01-09T01:12:07.785445+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	144.91.79.54	32769	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 01:12:06.894884109 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:06.899795055 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:06.899872065 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:06.911355972 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:06.916177988 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:07.773891926 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:07.773912907 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:07.773988962 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:07.780664921 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:07.785444975 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:08.119621992 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:08.161653996 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:09.530853033 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:09.535696030 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:09.535753965 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:09.540537119 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:20.459564924 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:20.464396000 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:20.464481115 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:20.469291925 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:20.836832047 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:20.880465031 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:20.973927975 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:20.980290890 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:20.985109091 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:20.985179901 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:20.989937067 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:31.603703976 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:31.608586073 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:31.608637094 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:31.613460064 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:31.917157888 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:31.958831072 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:32.052136898 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:32.054626942 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:32.059462070 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:32.059539080 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:32.064315081 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:37.888434887 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:37.942950010 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:38.020536900 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:38.067976952 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:42.537250042 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:42.542078018 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:42.542154074 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:42.546921015 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:42.849859953 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:42.896203995 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:42.989778042 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:42.991966963 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:42.996745110 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:42.996808052 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:43.001614094 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:53.474693060 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:53.479569912 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:53.479674101 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:53.484460115 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:53.788991928 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:53.833609104 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:53.927279949 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:53.933944941 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:53.939265013 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:12:53.943223000 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:12:53.948466063 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:04.412240982 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:04.417140007 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:04.417187929 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:04.421935081 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:04.726695061 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:04.771226883 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:04.864733934 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:04.866553068 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:04.871438980 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:04.871495962 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:04.876282930 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:07.896157980 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:07.942994118 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:08.037034988 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:08.083614111 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:15.473613024 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:15.478468895 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:15.480015039 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:15.484817982 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:15.861032009 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:15.927393913 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:16.005645990 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:16.013487101 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:16.018281937 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:16.018476009 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:16.023255110 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:26.396616936 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:26.401484966 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:26.401649952 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:26.406636953 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:26.709477901 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:26.818049908 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:26.849942923 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:26.852344990 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:26.857063055 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:26.857177973 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:26.861957073 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.334465027 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:37.339250088 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.339293957 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:37.344055891 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.647033930 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.787350893 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.787404060 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:37.790471077 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:37.795227051 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.795280933 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:37.800144911 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:37.928080082 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:38.132013083 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:48.271766901 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:48.277209044 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:48.277321100 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:48.282818079 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:48.654002905 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:48.787575960 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:48.787694931 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:48.791596889 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:48.796485901 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:48.796586037 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:48.801665068 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:59.209356070 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:59.214287996 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:59.214340925 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:59.219192982 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:59.531395912 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:59.630609989 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:59.663156986 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:59.665410995 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:59.670284033 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:13:59.670332909 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:13:59.675200939 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:07.896071911 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:08.038207054 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:08.038278103 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:10.146626949 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:10.151475906 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:10.151633978 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:10.156398058 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:10.458687067 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:10.600749016 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:10.600922108 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:10.617568970 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:10.622354031 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:10.626362085 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:10.631234884 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:21.084403992 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:21.089279890 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:21.089324951 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:21.094127893 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:21.396090031 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:21.521251917 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:21.538326979 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:21.540626049 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:21.545510054 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:21.545551062 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:21.550288916 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:32.022145987 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:32.027128935 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:32.027179956 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:32.031996965 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:32.335024118 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:32.475902081 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:32.478321075 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:32.487704039 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:32.492554903 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:32.494520903 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:32.499284029 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:37.885566950 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:37.927544117 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:38.022809029 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:38.132091999 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:42.959676027 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:42.964492083 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:42.966207981 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:42.971020937 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:43.275506020 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:43.318372011 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:43.413683891 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:43.416313887 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:43.421247005 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:43.421291113 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:43.426064968 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:53.896805048 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:54.130707026 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:54.169630051 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:54.169640064 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:54.176229000 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:54.181036949 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:54.348670006 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:54.492039919 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:54.492214918 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:54.494781971 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:54.499532938 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:14:54.500185013 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:14:54.504925966 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:04.834259033 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:04.910016060 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:04.910271883 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:04.915165901 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:05.218869925 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:05.333827019 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:05.351450920 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:05.354310989 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:05.359124899 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:05.359179020 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:05.364012003 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:07.891531944 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:08.021339893 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:08.023272991 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:08.130714893 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:08.379235029 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:08.380264997 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:15.771889925 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:15.796900034 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:15.796957016 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:15.801800013 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:16.109621048 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:16.242414951 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:16.242561102 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:16.245491028 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:16.250323057 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:16.252197027 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:16.256912947 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:26.712163925 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:26.717019081 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:26.720230103 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:26.725027084 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:27.241530895 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:27.318252087 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:27.398804903 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:27.401338100 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:27.406178951 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:27.406235933 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:27.410978079 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:37.646950006 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:37.651779890 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:37.651829004 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:37.656620979 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:37.890053988 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:38.021517992 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:38.021575928 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:38.113146067 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:38.115794897 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:38.121345997 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:38.121392012 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:38.126192093 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:48.584275007 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:48.589099884 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:48.592278957 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:48.597176075 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:48.896827936 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:49.023195982 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:49.039680004 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:49.045759916 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:49.050574064 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:49.056278944 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:49.061086893 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:59.522310972 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:59.528582096 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:59.528629065 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:59.534931898 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:59.836376905 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:59.927671909 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:59.977319956 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:59.979165077 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:59.984020948 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:15:59.984066010 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:15:59.988809109 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.397181034 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:07.403696060 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.403764963 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:07.410160065 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.709892035 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.755820036 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:07.853389978 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.854120016 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:07.858889103 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.858939886 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:07.863709927 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:07.993304968 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:08.037065029 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:18.334356070 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:18.339293003 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:18.339370012 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:18.344208002 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:18.647821903 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:18.695369005 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:18.790345907 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:18.791945934 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:18.796706915 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:18.800306082 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:18.806152105 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:29.271929026 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:29.277002096 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:29.277060986 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:29.281827927 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:29.587631941 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:29.630870104 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:29.743761063 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:29.744582891 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:29.749370098 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:29.749475002 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:29.754245043 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:37.900665998 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:37.943378925 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:38.071027040 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:38.115250111 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:40.209381104 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:40.214298964 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:40.214358091 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:40.219153881 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:40.523188114 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:40.568397999 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:40.665716887 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:40.666539907 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:40.671406984 CET	32769	49730	144.91.79.54	192.168.2.4
Jan 9, 2025 01:16:40.671503067 CET	49730	32769	192.168.2.4	144.91.79.54
Jan 9, 2025 01:16:40.676311970 CET	32769	49730	144.91.79.54	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 01:12:08.280997992 CET	1.1.1.1	192.168.2.4	0x3145	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:08.280997992 CET	1.1.1.1	192.168.2.4	0x3145	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 9, 2025 01:12:19.943397045 CET	1.1.1.1	192.168.2.4	0xda79	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	19:12:01
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\82eqjqLrzE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\82eqjqLrzE.exe"
Imagebase:	0x840000
File size:	165'888 bytes
MD5 hash:	A7F9F165CD238CCBE2CA5803FCD3209D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.4161121191.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	19:12:01
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	19:12:02
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\tempfile
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tempfile"
Imagebase:	0xf80000
File size:	46'080 bytes
MD5 hash:	E00A1AB434452FD6F77C941C09F257D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000002.00000000.1718915320.0000000000F82000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000002.4161978474.0000000003421000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\Desktop\tempfile, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\tempfile, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\Desktop\tempfile, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: C:\Users\user\Desktop\tempfile, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\Desktop\tempfile, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	19:12:14
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe"
Imagebase:	0xa0000
File size:	165'888 bytes
MD5 hash:	A7F9F165CD238CCBE2CA5803FCD3209D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000003.00000002.1906014341.00000000024C6000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs Detection: 72%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:12:14
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:12:15
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile"
Imagebase:	0x2e0000
File size:	46'080 bytes
MD5 hash:	E00A1AB434452FD6F77C941C09F257D6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9BAA0AD5 Relevance: .1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4162059624.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_82eqjqLrzE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2f7199e4aadc0debc50a53fee330d718b65c3845bb0b60ebd2204b61e420ae
Instruction ID: 8c2505475e6a354b2714d5e5d59e0823f091f9ae903c530f9213799cb3ef8063
Opcode Fuzzy Hash: bb2f7199e4aadc0debc50a53fee330d718b65c3845bb0b60ebd2204b61e420ae
Instruction Fuzzy Hash: 6A310B31B4E3890FD36D6AB44C765B6BB96EB83620B0641BED08AC71B3ED5864034395

Function 00007FFD9BAA0DE9 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FFD9BAA0EAF

Memory Dump Source

Source File: 00000000.00000002.4162059624.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_82eqjqLrzE.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: e2181d39daf349ddb53a1968370397acf141dda706cec05b971ee493883133e3
Instruction ID: 7f4d8a305a33f975eacdec4ee7cd75edf6dcf254836226a0c4a20e410f5117e3
Opcode Fuzzy Hash: e2181d39daf349ddb53a1968370397acf141dda706cec05b971ee493883133e3
Instruction Fuzzy Hash: 7C41067190DB888FDB26DB688855AE5BFF0EF57320F05429FD089C71A3D664680ACB51

Function 00007FFD9BAA1CDE Relevance: 1.6, APIs: 1, Instructions: 97
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FFD9BAA1D6F

Memory Dump Source

Source File: 00000000.00000002.4162059624.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_82eqjqLrzE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bec11941ff2cf8a681dad1451e0e53fef2931fd4a52f4987c46d5eddade04341
Instruction ID: a794bbbd41723373121bd84f170aa7f024c17ff0ef49b775f7e096094c135cfe
Opcode Fuzzy Hash: bec11941ff2cf8a681dad1451e0e53fef2931fd4a52f4987c46d5eddade04341
Instruction Fuzzy Hash: 5B315C30A1CB188FDB58DB58D846BE8B7F1FB99321F10429AD04DA7251CB34A981CFC2

Analysis Process: tempfilePID: 7628, Parent PID: 7556COMMON

Executed Functions

Function 033C5CF0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VLm, xrefs: 033C5FA7

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: 72a9cdb20ecde26408d778cefeb9f46baf99d94ecc72b3dbba0430c19fbb2be2
Instruction ID: f0bded495f227961e9afb66f91407ff577aa546c3e66ac896c3c272f843ee7d9
Opcode Fuzzy Hash: 72a9cdb20ecde26408d778cefeb9f46baf99d94ecc72b3dbba0430c19fbb2be2
Instruction Fuzzy Hash: 08B15C70E20259CFDB14CFA9C9957DEBBF2AF89304F18812DD815AB254EB74A845CB81

Function 033C65C0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ec5e4799e932c56666e743f7f96505472f6b60a61d3004dd4bb7558185d280
Instruction ID: bca6bde46b9884e53d813a4f74bc52782663111cb32bff43905763ccd7945777
Opcode Fuzzy Hash: 96ec5e4799e932c56666e743f7f96505472f6b60a61d3004dd4bb7558185d280
Instruction Fuzzy Hash: 81B15C74E20249CFDF10CFA9D88679DBBF2BF88314F18852DE415AB294EB749845CB81

Function 033C1727 Relevance: 5.4, Strings: 4, Instructions: 442COMMON

Download Yara Rule

Strings

a^q, xrefs: 033C1D3C
a^q, xrefs: 033C1CDF
xbq, xrefs: 033C1D76
,, xrefs: 033C1870

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: a^q$ a^q$,$xbq
API String ID: 0-2180861429
Opcode ID: f70934ecd1db43d16f4513eec57bd8f14208e14ee72e64834adb0c45002f4131
Instruction ID: 9372e7176b059ac6d9c2152d8609036c52cd67d93927e3c64be6e1bc774f0669
Opcode Fuzzy Hash: f70934ecd1db43d16f4513eec57bd8f14208e14ee72e64834adb0c45002f4131
Instruction Fuzzy Hash: 9C027B74B002419FD718DF68D594B6ABBE2BF84304F248AA8E4059F3A5DF79DC85CB81

Function 033C1962 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

a^q, xrefs: 033C1D3C
a^q, xrefs: 033C1CDF
xbq, xrefs: 033C1D76

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: a^q$ a^q$xbq
API String ID: 0-2081302502
Opcode ID: 5e740f1e3e64d3b2930878f6462325925e221c1fa62f89e13d713284efbf3f20
Instruction ID: 8bb0e272a3350706cc6eccd3f5dff048555f7bd75c134bfb555e6f313e74d266
Opcode Fuzzy Hash: 5e740f1e3e64d3b2930878f6462325925e221c1fa62f89e13d713284efbf3f20
Instruction Fuzzy Hash: 4A618C78B002408FD718EF29D994B5A7BF2FF85704F108968D4059F3A5DBB9ED858B90

Function 033C9EE0 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

+, xrefs: 033CA0FE
xbq, xrefs: 033CA226

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: xbq$+
API String ID: 0-3688029685
Opcode ID: 8b7a758ed01f22b514147f6e9d9e8724425222d489c10c5d40277dd875c414ad
Instruction ID: ae986b5e74eecb427ca8bb7f944553e3f74bbb82114fc8aebfdd022d9c7b6c2d
Opcode Fuzzy Hash: 8b7a758ed01f22b514147f6e9d9e8724425222d489c10c5d40277dd875c414ad
Instruction Fuzzy Hash: A391A9B8D122588FDB14EF2AE6843143BF1F785715F04456DC8008B29ADBBE9F418B92

Function 033C0EBA Relevance: 2.7, Strings: 2, Instructions: 166COMMON

Download Yara Rule

Strings

(bq, xrefs: 033C1192
Te^q, xrefs: 033C0EED

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: (bq$Te^q
API String ID: 0-2856382362
Opcode ID: f17bfddf349a6458eb76f1d7b6c031744e97cfdeccbf01fa27383a44beaed9df
Instruction ID: fc6eb00651901d265135a561ad730b88a2b771c427228878aec995a3a13efbdc
Opcode Fuzzy Hash: f17bfddf349a6458eb76f1d7b6c031744e97cfdeccbf01fa27383a44beaed9df
Instruction Fuzzy Hash: 73519E34B101149FC744DF6DC898A9EBBF6EF89710F2581A9E805DB3A6CA75ED018B90

Function 033C0D20 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

Hbq, xrefs: 033C0E40
dLdq, xrefs: 033C0D5B

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Hbq$dLdq
API String ID: 0-411705877
Opcode ID: 48d790cc3f3058d4896c5e3bb5f8733a8cde5fe098fe90faa6937657f4ddfea7
Instruction ID: ae50879f834af643c852ddd85b545426761de072ed2ded35cc3268df806ebc68
Opcode Fuzzy Hash: 48d790cc3f3058d4896c5e3bb5f8733a8cde5fe098fe90faa6937657f4ddfea7
Instruction Fuzzy Hash: 5741B4357042448FCB19DF79C898A9EBBF6EF89200F1485A9E405DB361CA75DD05CB90

Function 033C9278 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$^q, xrefs: 033C92AD
$^q, xrefs: 033C92B7

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: b9f2711751a4d3a13f6af216001bfc210067d12e0448138a607eaf6d8cab1975
Instruction ID: a137467d9a46d6cf3fc71da4223e7bdf622531bde0484d6f8f63889e04d124b2
Opcode Fuzzy Hash: b9f2711751a4d3a13f6af216001bfc210067d12e0448138a607eaf6d8cab1975
Instruction Fuzzy Hash: 80415F70B28445CFC758AF5A958862DBBB6BF847017298899F0068B7D8CF36DC17CB85

Function 033C5CE4 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

\VLm, xrefs: 033C5FA7

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: \VLm
API String ID: 0-2808160488
Opcode ID: 8dba0686ee85fb5946e0394615145a4790fca1190e3e51555309908ea50e90b2
Instruction ID: e03d2288f6af457abe3ee929ba74451561dd1874dfdf518dbccd4b645d7d2de9
Opcode Fuzzy Hash: 8dba0686ee85fb5946e0394615145a4790fca1190e3e51555309908ea50e90b2
Instruction Fuzzy Hash: C8B17D71E20259CFEB14CFA9C9857DEBBF2AF89304F18812DD815A7254EB34AC45CB81

Function 033C9BB8 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Te^q, xrefs: 033C9C56

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 462a23611c11e322cb67e0f56dc1b315970a06b158cc6aa9236d18f24963a12f
Instruction ID: 4e9adcca39d600f1ef11dbfe87167370880816b2c2ab9c9bb8e3de3c28bbcce5
Opcode Fuzzy Hash: 462a23611c11e322cb67e0f56dc1b315970a06b158cc6aa9236d18f24963a12f
Instruction Fuzzy Hash: F1519D30610245DFE724DF29C998B69BBF6FF49714F158159E812AB3E1CB7AAC80CB40

Function 033C9261 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

$^q, xrefs: 033C92AD

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 6e89a8a896e344b9347daf8da89ecd01c66270d5f8784f62e645d995894b2b12
Instruction ID: b565fd14d664e2ca923d8619e4535d4967dfb24795343c6c9a567eadb232dc3b
Opcode Fuzzy Hash: 6e89a8a896e344b9347daf8da89ecd01c66270d5f8784f62e645d995894b2b12
Instruction Fuzzy Hash: EA418270A28484DFC3599F59858862DBBB6BB8470172A8899E046CB7D8CF36DC17CB85

Function 033C1339 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR^q, xrefs: 033C138B

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 813721dbb7f3ef51a786d6e3cd2e4a3e71bd3bd17c2ce7466463d912cf3c2ea3
Instruction ID: b8c0b6a0fdae75290a7ec4219b0ce0eab0101679c6b14e2f57d988464019d2f0
Opcode Fuzzy Hash: 813721dbb7f3ef51a786d6e3cd2e4a3e71bd3bd17c2ce7466463d912cf3c2ea3
Instruction Fuzzy Hash: 9D31B174F102568FDB04DB79899066EBBF6BFC9204B1440ADE549DB355EE30DD02C792

Function 033C0D10 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

dLdq, xrefs: 033C0D5B

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: dLdq
API String ID: 0-3390252261
Opcode ID: c7963bb7c2c06ce88bb563037626422e4d028a3a286d49dd342fd0f45b0ba8de
Instruction ID: 12001e13f041b6c7023cca8f2a597cbd65e30cce45a41d6b06f7f0c25eddcc5f
Opcode Fuzzy Hash: c7963bb7c2c06ce88bb563037626422e4d028a3a286d49dd342fd0f45b0ba8de
Instruction Fuzzy Hash: BC317C75A00244CFCB18DF69C598B9EBBF6EF88300F188569D401AB361CB75ED45CB90

Function 033C9190 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Te^q, xrefs: 033C91AA

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2c668671407e20859b4ae7798de9dadca3866b23219109c915ecbe538d7e91f5
Instruction ID: f77b88211763e989b7ef72796e63ea749a9d8ba64d8f368161c2488de1c5e22d
Opcode Fuzzy Hash: 2c668671407e20859b4ae7798de9dadca3866b23219109c915ecbe538d7e91f5
Instruction Fuzzy Hash: 5D2193357201548FCB44DB68C998BAD7BFAAF8C710F25415DE502EB3A0CF759C048B91

Function 033C3321 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

|, xrefs: 033C3380

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 3f30dfa7174e6ff6625e82a7dd1408fe3a533ea2f4955e683895151027799df4
Instruction ID: 031e2863597a52da2b2bc99858c5c790c2a0df301bad730ba70c981b503b87f1
Opcode Fuzzy Hash: 3f30dfa7174e6ff6625e82a7dd1408fe3a533ea2f4955e683895151027799df4
Instruction Fuzzy Hash: 15119D75B102149FDB44DB78C945B6E7BF5AF88610F10846AE50ADB3A0DB39DD01CB85

Function 033C9697 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Te^q, xrefs: 033C96C3

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: f6157aa1bdf21f3fc3d1fad317881e0f271823977bd82d2dfa782ac3f25256d0
Instruction ID: 72a353b4590a651f3cd9865c9858fcdee1876de0feeb451a7505205b4705c39b
Opcode Fuzzy Hash: f6157aa1bdf21f3fc3d1fad317881e0f271823977bd82d2dfa782ac3f25256d0
Instruction Fuzzy Hash: 69118E74B50245CFDB04DF68C898B6EBBE6AF88710F25405EE502EF3A6CA759C01CB90

Function 033C96A8 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Te^q, xrefs: 033C96C3

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2d8003273576e31fa185a55457c76d865508e2f5ba7bcea0f4504b14f3b62ab6
Instruction ID: 39e4717de90065a9a6d3786e2d0beaa981c152e76a5bfd36640257319767a02f
Opcode Fuzzy Hash: 2d8003273576e31fa185a55457c76d865508e2f5ba7bcea0f4504b14f3b62ab6
Instruction Fuzzy Hash: D6113D34B50244DFDB14DF69C898B6EBBE6AF88710F154059E902AF3A5CBB5AC01CB90

Function 033CA6A1 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

Te^q, xrefs: 033CA6CD

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 061d72c92dc1bbe5db37853927d25e4ae23640ee19012ba7282a5753ba2fcb53
Instruction ID: 5985386f52dc10aef5c32ce8e88a60e84fc143631c4800eebe9263851ff345e6
Opcode Fuzzy Hash: 061d72c92dc1bbe5db37853927d25e4ae23640ee19012ba7282a5753ba2fcb53
Instruction Fuzzy Hash: 2E11A176B101189FCB04DB58C959BAEBBF6AB8C700F204069F402EB3A1CF759D018BD1

Function 033C0E3F Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Hbq, xrefs: 033C0E40

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 56b58529a0b021c990c3459bd4b07952032401767ab871acb41967b321fea528
Instruction ID: 3751d5b9c80db3430476a27a122c421665ffd04e68ffcd53810add62525a987c
Opcode Fuzzy Hash: 56b58529a0b021c990c3459bd4b07952032401767ab871acb41967b321fea528
Instruction Fuzzy Hash: 56F046713092841FC345AB3DA86446E7FEBEFCA11031948FAE149CF392DD288D0783A5

Function 033C8CD8 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

LR^q, xrefs: 033C8CED

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 5e4f151c77197b47e8f33ca47fd2762bc301f954789841475e538390d1c53ec3
Instruction ID: 68ed5f15032d99fef3f435294776920523d5ddbe2d40136874074f8fed6a7a54
Opcode Fuzzy Hash: 5e4f151c77197b47e8f33ca47fd2762bc301f954789841475e538390d1c53ec3
Instruction Fuzzy Hash: B401AD76F102159FDB44EBB8D9956AEB7B9FB88600F1040ADE509DF250EB709E018BC1

Function 033C887F Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4'^q, xrefs: 033C8851

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4cdaeda49dac4859356f9e69b78d3a52faa8f80b0e77fbf29a2b9b2ef9afaa78
Instruction ID: 3d6f5e94872dd5ffa6853d866fb32fc8197bf14784cc361cb481e0d761f7dc6c
Opcode Fuzzy Hash: 4cdaeda49dac4859356f9e69b78d3a52faa8f80b0e77fbf29a2b9b2ef9afaa78
Instruction Fuzzy Hash: 85F0F635B011089FCB04EAA8E9A469D77A9EFC2605F1440E9D0099F355CF259D0647C1

Function 033C65BF Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41215565ba6951be7d1b627fc7724988e66bd12cc2ab29aedcdec17330fa5de8
Instruction ID: 43cfe8e5a6b6b2bc84eab5f0949bcf8486fb59551efe0be3f52679c127ef6db9
Opcode Fuzzy Hash: 41215565ba6951be7d1b627fc7724988e66bd12cc2ab29aedcdec17330fa5de8
Instruction Fuzzy Hash: D5A14C70E20249CFDF10CFA9D98679DBBF1BF48314F18852DE419AB294EB749895CB81

Function 033CA2D8 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169a4e7e907ccfadd7444249176f8a5d53a0b2c450d1097cd62654332d1b47e2
Instruction ID: ecb72a40cee8794dc66d49f4795013b9b98731487e6c89b5bf6803dd6971632d
Opcode Fuzzy Hash: 169a4e7e907ccfadd7444249176f8a5d53a0b2c450d1097cd62654332d1b47e2
Instruction Fuzzy Hash: E6A1DE78B102058FCB09EF38D69465EB7F2EF89200B508AADC806DB355DF799D46CB80

Function 033C2DA8 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f018462d69be8391a2f628fbd700a36f44b455141fcae83ce589f32831a424
Instruction ID: 99e7e848e0ff18a6d9e735add0ec977fed57233fe4c2bdc6bd8006bd0f80ad0f
Opcode Fuzzy Hash: d5f018462d69be8391a2f628fbd700a36f44b455141fcae83ce589f32831a424
Instruction Fuzzy Hash: 1E91CC31A102598FCB15EF68C58069EFBB2FF85310F148AA9D419EB355DB70ED86CB90

Function 033C2A20 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd8973a550287f81d40c6d61e5dbd4f1beb08a86c3bd190ca1f091bce3b858f
Instruction ID: b02c0b29ae6304c166a38677901de958d814f148a6895e9107874a5340d6fdfa
Opcode Fuzzy Hash: 9fd8973a550287f81d40c6d61e5dbd4f1beb08a86c3bd190ca1f091bce3b858f
Instruction Fuzzy Hash: 02A1BDB46013019FDB15EF30D588A1E7BB2FF84710B5086A9D5068B359DF7ADE8ACB81

Function 033C2A30 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44dead8c21012ab1f886675ffd6fba2f08455797e7b72d463b37551da38bd21c
Instruction ID: 2cbe35587e070f542548c136eb7b22141bfd96bb8e31d3803e247dd38dff4a53
Opcode Fuzzy Hash: 44dead8c21012ab1f886675ffd6fba2f08455797e7b72d463b37551da38bd21c
Instruction Fuzzy Hash: 8BA19DB46012019FDB15EF30D548A1E7BB2FF84710B5086A9D5068B359DF7ADD8ACB81

Function 033C9429 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136d980f0a0428e135a9ca58531d995430b54593e584ebb47db6703f838075fa
Instruction ID: bcc2cae32e05abec4b170c83b3f928df2cdab7537652c9c5cc173291d76f5c7c
Opcode Fuzzy Hash: 136d980f0a0428e135a9ca58531d995430b54593e584ebb47db6703f838075fa
Instruction Fuzzy Hash: 92813674710641CFD714DF68C998A6ABBB2FF89311F1684A9E8069F7A6CB31EC41CB50

Function 033C436C Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e67499d82aafb4214f5bcdcfe72c121e05bad4feb404f5c913a60472f9fc8d
Instruction ID: 17a605edfbd8c271c2edbc3b2e791416ce9a981e634eeb192dcd1fafa927bdcf
Opcode Fuzzy Hash: a9e67499d82aafb4214f5bcdcfe72c121e05bad4feb404f5c913a60472f9fc8d
Instruction Fuzzy Hash: 415167B5C10289CFDB11DFA9C9A47DEBFB4BF48314F24841DE40AAB250DB74598ACB90

Function 033C37F8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44adedaf10daba84b69cf9fec5a51bbb6dd8f67bfe66ad639a2217877a5573f4
Instruction ID: 744f759f125909e433957c4892f21902a2579a5349e8a6a14583069fa5fa7319
Opcode Fuzzy Hash: 44adedaf10daba84b69cf9fec5a51bbb6dd8f67bfe66ad639a2217877a5573f4
Instruction Fuzzy Hash: C641A075B043888FCB24EB7994947AEBBE6EBC9214F14846DD14ADB340CF349C058B95

Function 033C0AA0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fd24dcb07c5aa2cd8c4a928ea1f73196f4b41bee3a0f44dbfa5cfff53b5c2c
Instruction ID: 99cabdd981948ddcfce59c8fa42f0a6a922fb3a5bbad680cd20d24d8859c8408
Opcode Fuzzy Hash: 39fd24dcb07c5aa2cd8c4a928ea1f73196f4b41bee3a0f44dbfa5cfff53b5c2c
Instruction Fuzzy Hash: 1951F874202206DFD725EF34EA945597773FF853057908A68D8098B369EB3EAD86CF80

Function 033C11D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd72dd314ceadcbc0ab72c77286ce38b1917d29f0449ceb066302dff15328967
Instruction ID: d9754f7bd491471b088374e800b3a1e20f32f1dc458d6c707dc05d356f4a6a69
Opcode Fuzzy Hash: fd72dd314ceadcbc0ab72c77286ce38b1917d29f0449ceb066302dff15328967
Instruction Fuzzy Hash: 3A418274F00209AFCB44EFB9C99466EFBFAEF89300F208569D449D7345DA359D428B91

Function 033C4210 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e033729d0ce135db3a22e311ca14eb27b4ad39a4ddfdddc25f3fb34c1852524
Instruction ID: 249934d73a1e7378ff2acfb331c6a9ed2aa89a7557ee715cd58770c8358638ef
Opcode Fuzzy Hash: 4e033729d0ce135db3a22e311ca14eb27b4ad39a4ddfdddc25f3fb34c1852524
Instruction Fuzzy Hash: DE41E1B0D0034DDFDB10DF9AC994ADEBFB5BF48314F148029E819AB254DB75A985CB90

Function 033C4207 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30aed2ef713deb8a2de63178b2d5976e5cabbf34a7bf834f1ea3354498644e91
Instruction ID: 658d7b5c7524bf5a3ae405ea9a06a6d96acb8b706a6989201ec4c53b0e7fda58
Opcode Fuzzy Hash: 30aed2ef713deb8a2de63178b2d5976e5cabbf34a7bf834f1ea3354498644e91
Instruction Fuzzy Hash: 124111B5D00349DFCB10DFA9C990ADEBFB5FF48310F14842AE819AB254DB349985CB80

Function 033C1030 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb0d9830e8a6f42c3f79c8da039ee90e165bf1a8a513e59b1675864b4f8b48c
Instruction ID: 084be1ffbd331ae17b1f7ce4c9b64d4c75d605331a24d83a4c95f68ca6c8aaf3
Opcode Fuzzy Hash: adb0d9830e8a6f42c3f79c8da039ee90e165bf1a8a513e59b1675864b4f8b48c
Instruction Fuzzy Hash: AB212839B101549FD714DB69C994BAEBBF6FF88720F248198E801EB3A5CA759C00CB80

Function 033C0998 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0933a009b929787df24deb0ce0c8aa248f00e2cedb87f7a18039e3593c3385
Instruction ID: f1cb9a49fed507ca50282b38daaac2afc7af82ca09a13c752649be9961e835c2
Opcode Fuzzy Hash: cf0933a009b929787df24deb0ce0c8aa248f00e2cedb87f7a18039e3593c3385
Instruction Fuzzy Hash: 65217F787212C3DFEB6CEFB5DE8872E7BA9AB51201708446DD807C5144EB38CE498B55

Function 0303D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161084233.000000000303D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0303D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_303d000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a39a9918bdf2d306f6805d79ae0c758f6849649e31f7e318a8d6f12da4b39c
Instruction ID: 00a341db09347c14ec287880e454b70a896ce65aba951a0ffa35a9d04ffdd255
Opcode Fuzzy Hash: 24a39a9918bdf2d306f6805d79ae0c758f6849649e31f7e318a8d6f12da4b39c
Instruction Fuzzy Hash: 55213771545200DFDB05DF14D9C0B2BBFA9FF99318F24C5A9E90A0B256C336D456CBA2

Function 033C09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf4ab86e2888e4c12fbfd963c90be6d8ff8ce89176a884a45fe469775c844fa
Instruction ID: 7507404599bf3830469e6817f9894b47b7fbc0edfa6caa1939940ee45fbd34cc
Opcode Fuzzy Hash: 1bf4ab86e2888e4c12fbfd963c90be6d8ff8ce89176a884a45fe469775c844fa
Instruction Fuzzy Hash: 2C2130787212C3CFDF6CFFB5AE9872E7AA9AF41205704446D980BC5144EB28CE49CB56

Function 033C8FF3 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afeb05741114ab2728b187d235ac3f11337824ac1230a67603132eb938d6bca
Instruction ID: 5aafed52a079662f7ae92e858e2f238b7df0a935a5a398d62e2e86385c905cd8
Opcode Fuzzy Hash: 7afeb05741114ab2728b187d235ac3f11337824ac1230a67603132eb938d6bca
Instruction Fuzzy Hash: D2217835A00254CFDB29EB74C9946AEBBB6EF89204F14446CC402EB360DF7A9D42CB91

Function 033CA2C9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a193565afb5c861c72272b9591d0a9d8a00fa7ad21609cc0191a2527234f19
Instruction ID: 5342fe5be60cb25c6c7bd3670707b31c6addfb0dc32cf7c47090ea01cd187760
Opcode Fuzzy Hash: 30a193565afb5c861c72272b9591d0a9d8a00fa7ad21609cc0191a2527234f19
Instruction Fuzzy Hash: 0811E3797012144BDB18E778DA901AE77E6EBC8604B4086BDCD06C7349EF7A9D0A4BC6

Function 033C9E00 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8600426b97e54cc14cb65c58353604730bedf8aa472b60a800aa9e5af7af82cb
Instruction ID: ee602278a9329ebc8120f9f93b9bdf093b8ed2a0efbc12018e1b76df2f527755
Opcode Fuzzy Hash: 8600426b97e54cc14cb65c58353604730bedf8aa472b60a800aa9e5af7af82cb
Instruction Fuzzy Hash: 2E11D0B4A003559FCB00FB38D58069EBBF1EF81314B508AADC1059F345EB769E4A8BD5

Function 033C1431 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06bdc9c6c85fffa4b84dd1d42a2fea2857944e408f8d387c19ddb8024a80ab0
Instruction ID: 22426af72e2dc802d8db7d88ab72bf4f90fe3e060f4005d08ce9abe2fbe47f0a
Opcode Fuzzy Hash: f06bdc9c6c85fffa4b84dd1d42a2fea2857944e408f8d387c19ddb8024a80ab0
Instruction Fuzzy Hash: 53118E71E01246DFCB50EBB8D5846AABBF6EF8920571404BDD809CB351EA35CD82CB80

Function 0303D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161084233.000000000303D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0303D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_303d000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 1a14b7f9d8c4245a1232638661b2c91e3dfca69f6a62668fc768038bc51c977a
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 36110372804240CFCB02CF04D5C4B16BFB6FF85324F28C1A9D9090B256C336D45ACBA2

Function 033C1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5443bb5618bb6a3430d252cbdffc918d55e7d49b054fcdf8af0583167d4738
Instruction ID: 7e761d93ad7fdc480ddba5c117ec860673413093e0475dfb3b83b82a4c2a5341
Opcode Fuzzy Hash: fb5443bb5618bb6a3430d252cbdffc918d55e7d49b054fcdf8af0583167d4738
Instruction Fuzzy Hash: 81118B70B01209DFCB54EFB9D944A6A7BFAAF8820575004BDD40ACB355EA36CC82CB90

Function 033C9E10 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6825273fa615e33e4f66e3096d014cb39da500aa34a2382bdc87863aa4dd69e0
Instruction ID: a70e265f3577b19b9978942dc055682cc1d32f08b6a9109c01f46602faa7bd64
Opcode Fuzzy Hash: 6825273fa615e33e4f66e3096d014cb39da500aa34a2382bdc87863aa4dd69e0
Instruction Fuzzy Hash: C711CEB4A003558FCB00FB38D58069EBBE1EF81314B508AADC1059F385EB769E4A8BD5

Function 033C37E9 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d869531456b529f847b828138d1e001eba0427369c8e6ef1b1329e567cabb6
Instruction ID: 093aec616d6f39570682789fcf78978307c7bbe41c0bc156c9e506a66ce53bba
Opcode Fuzzy Hash: a8d869531456b529f847b828138d1e001eba0427369c8e6ef1b1329e567cabb6
Instruction Fuzzy Hash: B30184393053804BCB19A6399AD477EB6D3ABC5255B04457DE14BCB755CF74CC068742

Function 033C8D68 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90533ef25dc64417e3cd21cff1a7887db9982fce85efa85f8aa8ebb3529b0529
Instruction ID: c8d587f1b690b3e94dec4c8cd2422d614596764169a506ff933087af0e95137c
Opcode Fuzzy Hash: 90533ef25dc64417e3cd21cff1a7887db9982fce85efa85f8aa8ebb3529b0529
Instruction Fuzzy Hash: BB111EB5800288CFCB20DF9AC588BDEBBF4EB08324F20845AD559A7250C334A984CFA5

Function 033C8D60 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391bd7b7206a09b9b51d0756d272375bf4fb48977a52bce467a07706c01680a3
Instruction ID: 413597bbdd47522989aeb71f5799b18b63bad7c5097b3f8ee2c58e604765839e
Opcode Fuzzy Hash: 391bd7b7206a09b9b51d0756d272375bf4fb48977a52bce467a07706c01680a3
Instruction Fuzzy Hash: 151100BA800248CFDB10CF99C588BDEFBF4AB08324F20845AD569B7250C334A984CFA4

Function 033C25F1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884c4b3641b88bffc2536b92503140417fe7efb42f7dfc22f4a78261a612d1f0
Instruction ID: 8adfa5a015ea71a6b334161a1cef21c1800f8eb1495e27c50f83161df87c1d3c
Opcode Fuzzy Hash: 884c4b3641b88bffc2536b92503140417fe7efb42f7dfc22f4a78261a612d1f0
Instruction Fuzzy Hash: 14F0A5B155E3C08FD3038B28D864851BFB4AE6760134A00DBD484CB6A3D2199D1ADB22

Function 033C0A73 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6712329d52f37086d5f4b9085dc80a94571c6ab2463f630a0ee2ce1d51defd
Instruction ID: 4fde642d773023860573878649a3a46865d53485695cd1a7638337486e0fe85b
Opcode Fuzzy Hash: 5c6712329d52f37086d5f4b9085dc80a94571c6ab2463f630a0ee2ce1d51defd
Instruction Fuzzy Hash: 46C0126C1151C6CFDB18B7649B4D61C29186742301F00005BA042044458F688E444716

Function 033C0A8F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e43f4460fe87982752f55f5de24544c509be205c05cc5701ec1b155e3c2b7c
Instruction ID: d621c099e0da29588262c6460e9d1d8658b18cfd7b7ab54795a27d45cbe02003
Opcode Fuzzy Hash: 68e43f4460fe87982752f55f5de24544c509be205c05cc5701ec1b155e3c2b7c
Instruction Fuzzy Hash: 63C012AC1262C6CFD718B7A49B8D62C2918AB82301F00009AA0420448A8FA88E08471A

Function 033C2600 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4161794244.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_33c0000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e5a11e2fac5343e74e2b19d30e2edfe631b472eedd1ad027847e6543229d5f
Instruction ID: 7971ef95a3226b55ff0d46bb6253b0aca705c5b206a666b5cef276056fe12924
Opcode Fuzzy Hash: a1e5a11e2fac5343e74e2b19d30e2edfe631b472eedd1ad027847e6543229d5f
Instruction Fuzzy Hash: D2C048352602088F8244EEA9E688C12B7A8FF58A003810099E9058B722CB26FC10DA61

Analysis Process: 82eqjqLrzE.exePID: 7808, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	20.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9BAA1049 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FFD9BAA110F

Memory Dump Source

Source File: 00000003.00000002.1906615773.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_82eqjqLrzE.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 2ab894fb408b306923a4d1936fe436ff0bb8e17a548b1a4774685a019c7c07b8
Instruction ID: e98f2fbe621dfea4b52943bcf98a266649c296bb4c7c81801817f758b9ec486e
Opcode Fuzzy Hash: 2ab894fb408b306923a4d1936fe436ff0bb8e17a548b1a4774685a019c7c07b8
Instruction Fuzzy Hash: EF41F53190DB888FDB16DB688855AE5BFF0EF57320F08429FD089C71A3D764680ACB51

Function 00007FFD9BAA1CDE Relevance: 1.6, APIs: 1, Instructions: 97
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FFD9BAA1D6F

Memory Dump Source

Source File: 00000003.00000002.1906615773.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_82eqjqLrzE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1a45ed0e48866b15d9f9c397ee04cfe38c40d5485ce848cd19184225d182a078
Instruction ID: a794bbbd41723373121bd84f170aa7f024c17ff0ef49b775f7e096094c135cfe
Opcode Fuzzy Hash: 1a45ed0e48866b15d9f9c397ee04cfe38c40d5485ce848cd19184225d182a078
Instruction Fuzzy Hash: 5B315C30A1CB188FDB58DB58D846BE8B7F1FB99321F10429AD04DA7251CB34A981CFC2

Function 00007FFD9BAA053A Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FFD9BAA110F

Memory Dump Source

Source File: 00000003.00000002.1906615773.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baa0000_82eqjqLrzE.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 9b3232e6986ad7c37dbaa825dcd647c356ba156d972774a4459d5d98d4dc85af
Instruction ID: 985f70389e5f4800bc6b173905307017b51162b37ecbc2d25a62189cac09cb12
Opcode Fuzzy Hash: 9b3232e6986ad7c37dbaa825dcd647c356ba156d972774a4459d5d98d4dc85af
Instruction Fuzzy Hash: 69217771A0CA0C9FDB68DF98D846BF9B7E0EB59321F00422ED04ED3551DB74A405CB51

Analysis Process: tempfilePID: 7876, Parent PID: 7808COMMON

Executed Functions

Function 00C40EBC Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00C40EED
(bq, xrefs: 00C41192

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID: (bq$Te^q
API String ID: 0-2856382362
Opcode ID: 76c8e1cacea081ed0f4d299caaaa3364f9de1557fd699eedb09477b14e9167fc
Instruction ID: 4c6eb9c7be1b5d13c01e801774dd843a0df90a70f16957e8574088ab5713314a
Opcode Fuzzy Hash: 76c8e1cacea081ed0f4d299caaaa3364f9de1557fd699eedb09477b14e9167fc
Instruction Fuzzy Hash: 1B518A30B105149FCB54DF6DC498A6EBBF6FF89710F2581A9E906DB3A6CA71DD018B80

Function 00C40D20 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00C40E40
dLdq, xrefs: 00C40D5B

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID: Hbq$dLdq
API String ID: 0-411705877
Opcode ID: 3d689aeb607f935d908c79e65663a29443a5b2ff6c3601996ffbb27797f35223
Instruction ID: a8eaca422d5b5adb99c2a1c14b1cb54ad78f9d70f08eaf2a6b8767d06279ce60
Opcode Fuzzy Hash: 3d689aeb607f935d908c79e65663a29443a5b2ff6c3601996ffbb27797f35223
Instruction Fuzzy Hash: D841B1317042049FCB15DF69D458AAEBBF6FF89300F2444AAE505DB3A2CA759D05CB91

Function 00C41339 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00C4138B

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 829e1e313e95f8570b127386bf2fa6a018f4346b911f0c0f237d64c7ac3cde54
Instruction ID: 057aa8d74993d3d4d66633fc1b93dba6db6630560a278490d9c579f5eac43b14
Opcode Fuzzy Hash: 829e1e313e95f8570b127386bf2fa6a018f4346b911f0c0f237d64c7ac3cde54
Instruction Fuzzy Hash: D841FF35B002068FCB14AB7DD455A6EBBF6FFC9314B144169E98ADB3A5DE30CD428782

Function 00C40D10 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

dLdq, xrefs: 00C40D5B

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID: dLdq
API String ID: 0-3390252261
Opcode ID: 307c46f5321e39ecfbbd0448dcb2a70408f34142315e25e24020b44f2db61e34
Instruction ID: b6a8a8b58f3d52c1672394cef11a44ef11c8088792c5a6660a6c7b1e5f4dea87
Opcode Fuzzy Hash: 307c46f5321e39ecfbbd0448dcb2a70408f34142315e25e24020b44f2db61e34
Instruction Fuzzy Hash: 8C315B75A00204DFDB14DF69C448BAEBBF2FF89300F248569E501AB361CB75AD48CB91

Function 00C40E3F Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00C40E40

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 714ba378e6eeac0ea2f5c5d5a33c69c8541e0532eeff63740cbfaa42d01acf73
Instruction ID: aa7f2e00a9855922a72de35ab6d3067b3f54ef82a6d6aaf577a64bb7b6bf3931
Opcode Fuzzy Hash: 714ba378e6eeac0ea2f5c5d5a33c69c8541e0532eeff63740cbfaa42d01acf73
Instruction Fuzzy Hash: C4F0A4313086445FC345AB7DA81453E7FEBEFCA25031548F6E245CB3A2CD359C168355

Function 00C40AA0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7fcb7f1c3bbf115a4d7ad856c8c39f69e1dde9f9df7329bf0f9561dd6f34a15
Instruction ID: 8797a1c7f6f57006024d21df2be1c4358ce6074ce0e368c25ded70ad74a56527
Opcode Fuzzy Hash: c7fcb7f1c3bbf115a4d7ad856c8c39f69e1dde9f9df7329bf0f9561dd6f34a15
Instruction Fuzzy Hash: B151B378101605DFDB06EB38E984D697BA2FBC93057508669D501CB37DEB31A94EEF80

Function 00C411D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ed9decb840f0d51559f9f5378d665b57c2bae41922114f942cad162f989d6e
Instruction ID: e43f07d60473e682bd9d7570a1ce79176b8d7cfb33ebdba9653b873f7acf5fc1
Opcode Fuzzy Hash: 63ed9decb840f0d51559f9f5378d665b57c2bae41922114f942cad162f989d6e
Instruction Fuzzy Hash: A2419F70B00209AFCB04EFB9854866EBBFAFF89310F248569D449D7345DA309E428B91

Function 008ED3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1893898928.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8ed000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d2c4ba933ac4ce7271ab0eae346f640394be0908da69a1376764b0482d1d1d
Instruction ID: 6906ea9e49a074e65d8b9bfa5a010c85206c6d7cf3a5f9386d994c0303bbb887
Opcode Fuzzy Hash: c3d2c4ba933ac4ce7271ab0eae346f640394be0908da69a1376764b0482d1d1d
Instruction Fuzzy Hash: 802125B1500384DFCB05DF15D9C0B27BF65FBA5318F20C569E8098B296C336E85AC6A2

Function 00C40998 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f0932d8c4a7823e0c8430a5f65850a53f2f08827cf9fd101853cb0b058a81d
Instruction ID: bd5a297dadb88831e3f4d6faa9adb7cc07ebe54b51c3763893d08a78dad70bfb
Opcode Fuzzy Hash: e6f0932d8c4a7823e0c8430a5f65850a53f2f08827cf9fd101853cb0b058a81d
Instruction Fuzzy Hash: DA216F30780702DFEB68AB75D948A3E3BA8FF55305B20542DDA07C6161EF30CA45EB56

Function 00C409A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3184da8c0baf1b0eac84661055a277fe71be62dd8f4348d9ad762ac81e9837
Instruction ID: 09ea335a5ee17163f92bc251f55c5c2a79283a668d4b811adc1dc44f4bf81b22
Opcode Fuzzy Hash: 9b3184da8c0baf1b0eac84661055a277fe71be62dd8f4348d9ad762ac81e9837
Instruction Fuzzy Hash: EB216F307807038FEF64ABB5E918A3E3BA4BF50305720442D9B07C6151EE30CA45E766

Function 00C41431 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6b73d8c6f36d08b427b036a97851b8bebb41dc63e4537ea93f9387bc1a69cb
Instruction ID: e1cc4351a83b85976d893d84cbde37aa8f6197c337309b07510718daea6b4085
Opcode Fuzzy Hash: 4b6b73d8c6f36d08b427b036a97851b8bebb41dc63e4537ea93f9387bc1a69cb
Instruction Fuzzy Hash: CD118B75A00205CFCB50EBB9D404A6A7BF2FF8932571418B9D80ACB365EB30CD82DB80

Function 008ED3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1893898928.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8ed000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: cf4033ebe3626a525a648de6ae96e6ab85c7a2258b37b74dbbb74ac09b3f98f4
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 0111B176504380CFCB16CF10D5C4B16BF71FBA4318F24C5A9D8494B656C336E85ACBA1

Function 00C41440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1894238187.0000000000C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c40000_tempfile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633cbc8367a98c587038a221816ee1c1ce3aaf8239f7558bb5c206d88ca3b03d
Instruction ID: b5f41431e7d8a08592a7e896d48774a573b75120a027136f8fb43c34754ee538
Opcode Fuzzy Hash: 633cbc8367a98c587038a221816ee1c1ce3aaf8239f7558bb5c206d88ca3b03d
Instruction Fuzzy Hash: 9E118074B00209DFCB54EBB9D504A6A7BF6FF8871571408B9D40ADB364EA31DD46CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 82eqjqLrzE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\82eqjqLrzE.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tempfile.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82eqjqLrzE.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempfile

C:\Users\user\Desktop\tempfile

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
82eqjqLrzE.exe

Function 00007FFD9BAA0AD5 Relevance: .1, Instructions: 113
COMMON

Function 00007FFD9BAA0DE9 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Function 00007FFD9BAA1CDE Relevance: 1.6, APIs: 1, Instructions: 97
processCOMMON