Edit tour

Windows Analysis Report
MAdjnpU2Xp.exe

Overview

General Information

Sample name:	MAdjnpU2Xp.exe renamed because original name is a hash value
Original sample name:	157a3f7a20b22e78c4d3f7ea88538ff7.exe
Analysis ID:	1628657
MD5:	157a3f7a20b22e78c4d3f7ea88538ff7
SHA1:	5289f49becfab4122f62ac5dc5f4ed4a6430d1e3
SHA256:	0ffd5b54317e01a658684577fee5d5c5f53d5b2e105e7cf8c1cdfd9bd8fee780
Tags:	AsyncRATexeRATuser-abuse_ch
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

MAdjnpU2Xp.exe (PID: 6104 cmdline: "C:\Users\user\Desktop\MAdjnpU2Xp.exe" MD5: 157A3F7A20B22E78C4D3F7EA88538FF7)

RegAsm.exe (PID: 6660 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{
  "Server": "164.92.163.239",
  "Ports": "3898",
  "Version": "0.5.8",
  "Autorun": "false",
  "Install_Folder": "%AppData%",
  "AES_key": "M8gFCqrOJJZqCx1JYq0tXKezzud1GklJ",
  "Mutex": "AbDUeHz1cUxL",
  "Certificate": "MIIE8jCCAtqgAwIBAgIQAMgufplwZXWUObORbETzPTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwMjI3MTIyNTM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALAXG8I0Oda301Kb/b25SFQ5fFLOjXPGpbnc1CFJU8j8YhBdWRJtt4UXy19hKnAK188qpk8h4v6syQ4KPMmnMh87xdEs1BDkVcZoICVNHxqoffFLr6kVbwlVpseLHkyKlHAmnIfM9DwRZih0UQPvPn+rq0j9e7dAVZ6q5UbC/XvuGnJvG0N76oxm62TpMzrFp8aSSPLUjnb7cK0K9SnJTeuHKXuCzBz6ybHPeZrIGceNKzNdMwFM6f6Fv7XW33Y+TrfBJ5YcxULk8zbAaR32pXsS9PA+sQh3Hlq+bRBYLwXJtzu6Xf6cDvNL9XOzA41i7vQnhU0B70HCjZmsnKDqWbIlne6MWasnpTAHIFlcGnvfVom7ST0nQIFkFEfvTdxR5cEn4bnIOVoYZJ3dobf3xeAJ57XflyEHQFW0hUPN3UHRH+DqX5Xztf3U+HRgRyBNUAszcBIaSCJFTYq6GlZU0Hf0ICcVROCEBapE5ey0GwV4eGqDIIs47su1bmVwUt8U8dtVz+urOHKNw6EmC5uP71znTIxry4C/ypAZWG1LxcYxid/zKVNMZB+E0MFXZZfdz1Hn1FRSWskf7jN0hSMrD+dj4EruaIoBHtcwvuQHfWBLDeaqnTWgxZV7mwciOb5PwBDwCV/gnW4l4Jmc5fWU0djS0DxWY1Ay0nysXkHA78m3AgMBAAGjMjAwMB0GA1UdDgQWBBRnnlfc8PeW+7qR5y9AYLUe9ltaUjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQB/eReV/2V7aX+2wFV5wiRlIKUXEIenLdJtbuYSByqD0b0+Zhbm9MJtmSLVf1GwPCH+QUNJvqPe880VnuprYb726nCFeOX87hrofCKyxjO5CpSoo2/mT+ysOqyykdAnvkCbw8kyXu7UBXw7vIZIxW3etoK+JFrwpy1u0jJ6llnnj9Z6kdYibFrzKwmJYbJbdGHk3Ah0LgQrYwnEvt9RmgD3WsXAoHItBtXmzW8Cd4lMpfH4OZFESZf031MfVBAlXXuJHW4KxDy5/wFRFAGd5afl6lfzflqXmnXeG9LvGs28MclqDRmaEaZAnos5YEy7caXtD79bHOC6sAj4WPso2X+h97Cx7LMuXiVE5t+kVrnzNxgUUl9dmPrNu3Sf0NCfOvJZkrutScadynVqxGLQ3LPHURALsMQNUGhE7dSzxGTIw9FUzwPbE1IGuO0KzOCkRqBjzRqEEXXXjd2tckpAnPH91rGh8rC+Nre83Quhyupcs9XfClahlLTpVht/eZvkAQLJ4RD33bksoeVKsKtcxYvzodbu3Zny+aWeF89Ford0wvLoAPzbGBdpzPvsqax63HQJCql5h98ovIfG1wnBylDi7XR+f4LQm5KWJxMH2ovJH6xOZM1HVSCQO+Fvd3OWR5cLBthKHk0fqJXOjSf50OZSQOERTt6xq9biTUkjEdI4MA==",
  "ServerSignature": "r0sDxZc/+EUUY+4fptcRe+9FfNLkjcGro3dc3o1aL9ZdI8pcpfQygNIG53NXBStkXm/NXRbXYt46U6ylRZ9nVb/RCSRbTXBa5IPAB9E0ezv4H0QayUESX7efOkhTmc5dHCIjtzJeEGhqz5Eqjv2agJXQka1UPmnrHDvt5eSMP2cprqTX7ZNhjT4wIXoQbC0i7Wbqw1/EVxiLkF+Lah2t5lnZUD3o/WZoM9c24NeBxxH95LLZwIpC/tQUEVRtvGd4GKTfIRtdIAqmmMmnUW/LpszCATvrorHzOXNpUwMhJ0ByvGbaRdx+WC2mnBWEsbcA1C3Ycf1MtWD6vzTLTcrrxR9trQnPM1SMxdRjCXxJtIRoEjhVO3+5Tp8KXbq7r5Md6ipGyGHgqCIj343/WJWxuJo46EJSl3J1ukduhoiprTcncLUkDuTf5VFMuUxJ140K/0dmJGdTNCVZYSXHDX7+7oOoRZ/gDBZEzII0OfwN+JkZUuxYSgckQ0i8f0CxB7bxyVDqXwkBGtYvNN6Sqlr0028bWY3YVSlvtO4xzFA9nhGp29paQWjdMYdyDhR4Qy8FFtoJr1hOkUHRLf0Y5VX2p774v5Coukgv0dLJqKfgWEBfGuy2J3dg8WxxryWR6mCdpu6CU+vUdMZZb4cdLmzE/sRjX4yBGfqzvP8udzb5twM=",
  "BDOS": "false",
  "External_config_on_Pastebin": "null"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9789:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x902d7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9b71b:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xa6b77:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb21d7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x91618:$a2: Stub.exe 0x916a8:$a2: Stub.exe 0x9ca5c:$a2: Stub.exe 0x9caec:$a2: Stub.exe 0xa7eb8:$a2: Stub.exe 0xa7f48:$a2: Stub.exe 0xb3530:$a2: Stub.exe 0xb35c0:$a2: Stub.exe 0x8d0e7:$a3: get_ActivatePong 0x9852b:$a3: get_ActivatePong 0xa3987:$a3: get_ActivatePong 0xaefe7:$a3: get_ActivatePong 0x904ef:$a4: vmware 0x9b933:$a4: vmware 0xa6d8f:$a4: vmware 0xb23ef:$a4: vmware 0x90367:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x90369:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x9b7ad:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0xa6c09:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0xb2269:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: MAdjnpU2Xp.exe PID: 6104	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: MAdjnpU2Xp.exe PID: 6104	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1b571:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: RegAsm.exe PID: 6660	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6660	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x6142:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.MAdjnpU2Xp.exe.253e280.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.MAdjnpU2Xp.exe.253e280.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7af7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x4907:$a3: get_ActivatePong 0x7d0f:$a4: vmware 0x7b87:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5656:$a6: get_SslClient
0.2.MAdjnpU2Xp.exe.253e280.1.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x4907:$str01: get_ActivatePong 0x5656:$str02: get_SslClient 0x5672:$str03: get_TcpClient 0x3f18:$str04: get_SendSync 0x3f68:$str05: get_IsConnected 0x4697:$str06: set_UseShellExecute 0x7e2d:$str07: Pastebin 0x7eaf:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c07:$str10: timeout 3 > NUL 0x7af7:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7b87:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.MAdjnpU2Xp.exe.253e280.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7b89:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.MAdjnpU2Xp.exe.2532e24.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.MAdjnpU2Xp.exe.2532e24.2.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7af7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x4907:$a3: get_ActivatePong 0x7d0f:$a4: vmware 0x7b87:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5656:$a6: get_SslClient
0.2.MAdjnpU2Xp.exe.2532e24.2.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x4907:$str01: get_ActivatePong 0x5656:$str02: get_SslClient 0x5672:$str03: get_TcpClient 0x3f18:$str04: get_SendSync 0x3f68:$str05: get_IsConnected 0x4697:$str06: set_UseShellExecute 0x7e2d:$str07: Pastebin 0x7eaf:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c07:$str10: timeout 3 > NUL 0x7af7:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7b87:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.MAdjnpU2Xp.exe.2532e24.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7b89:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.MAdjnpU2Xp.exe.25279e0.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.MAdjnpU2Xp.exe.25279e0.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7af7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x4907:$a3: get_ActivatePong 0x7d0f:$a4: vmware 0x7b87:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5656:$a6: get_SslClient
0.2.MAdjnpU2Xp.exe.25279e0.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x4907:$str01: get_ActivatePong 0x5656:$str02: get_SslClient 0x5672:$str03: get_TcpClient 0x3f18:$str04: get_SendSync 0x3f68:$str05: get_IsConnected 0x4697:$str06: set_UseShellExecute 0x7e2d:$str07: Pastebin 0x7eaf:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c07:$str10: timeout 3 > NUL 0x7af7:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7b87:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.MAdjnpU2Xp.exe.25279e0.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7b89:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98f7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x6707:$a3: get_ActivatePong 0x9b0f:$a4: vmware 0x9987:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7456:$a6: get_SslClient
1.2.RegAsm.exe.400000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6707:$str01: get_ActivatePong 0x7456:$str02: get_SslClient 0x7472:$str03: get_TcpClient 0x5d18:$str04: get_SendSync 0x5d68:$str05: get_IsConnected 0x6497:$str06: set_UseShellExecute 0x9c2d:$str07: Pastebin 0x9caf:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a07:$str10: timeout 3 > NUL 0x98f7:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x9987:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
1.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9989:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98f7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14f57:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x162b0:$a2: Stub.exe 0x16340:$a2: Stub.exe 0x6707:$a3: get_ActivatePong 0x11d67:$a3: get_ActivatePong 0x9b0f:$a4: vmware 0x1516f:$a4: vmware 0x9987:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x14fe7:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7456:$a6: get_SslClient 0x12ab6:$a6: get_SslClient
0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6707:$str01: get_ActivatePong 0x11d67:$str01: get_ActivatePong 0x7456:$str02: get_SslClient 0x12ab6:$str02: get_SslClient 0x7472:$str03: get_TcpClient 0x12ad2:$str03: get_TcpClient 0x5d18:$str04: get_SendSync 0x11378:$str04: get_SendSync 0x5d68:$str05: get_IsConnected 0x113c8:$str05: get_IsConnected 0x6497:$str06: set_UseShellExecute 0x11af7:$str06: set_UseShellExecute 0x9c2d:$str07: Pastebin 0x1528d:$str07: Pastebin 0x9caf:$str08: Select * from AntivirusProduct 0x1530f:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x162b0:$str09: Stub.exe 0x16340:$str09: Stub.exe 0x9a07:$str10: timeout 3 > NUL
0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9989:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14fe9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98f7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14d53:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x203b3:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x16094:$a2: Stub.exe 0x16124:$a2: Stub.exe 0x2170c:$a2: Stub.exe 0x2179c:$a2: Stub.exe 0x6707:$a3: get_ActivatePong 0x11b63:$a3: get_ActivatePong 0x1d1c3:$a3: get_ActivatePong 0x9b0f:$a4: vmware 0x14f6b:$a4: vmware 0x205cb:$a4: vmware 0x9987:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x14de3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x20443:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7456:$a6: get_SslClient 0x128b2:$a6: get_SslClient 0x1df12:$a6: get_SslClient
0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6707:$str01: get_ActivatePong 0x11b63:$str01: get_ActivatePong 0x1d1c3:$str01: get_ActivatePong 0x7456:$str02: get_SslClient 0x128b2:$str02: get_SslClient 0x1df12:$str02: get_SslClient 0x7472:$str03: get_TcpClient 0x128ce:$str03: get_TcpClient 0x1df2e:$str03: get_TcpClient 0x5d18:$str04: get_SendSync 0x11174:$str04: get_SendSync 0x1c7d4:$str04: get_SendSync 0x5d68:$str05: get_IsConnected 0x111c4:$str05: get_IsConnected 0x1c824:$str05: get_IsConnected 0x6497:$str06: set_UseShellExecute 0x118f3:$str06: set_UseShellExecute 0x1cf53:$str06: set_UseShellExecute 0x9c2d:$str07: Pastebin 0x15089:$str07: Pastebin 0x206e9:$str07: Pastebin
0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9989:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14de5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x20445:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x98f7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14d3b:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x20197:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x2b7f7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x1607c:$a2: Stub.exe 0x1610c:$a2: Stub.exe 0x214d8:$a2: Stub.exe 0x21568:$a2: Stub.exe 0x2cb50:$a2: Stub.exe 0x2cbe0:$a2: Stub.exe 0x6707:$a3: get_ActivatePong 0x11b4b:$a3: get_ActivatePong 0x1cfa7:$a3: get_ActivatePong 0x28607:$a3: get_ActivatePong 0x9b0f:$a4: vmware 0x14f53:$a4: vmware 0x203af:$a4: vmware 0x2ba0f:$a4: vmware 0x9987:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6707:$str01: get_ActivatePong 0x11b4b:$str01: get_ActivatePong 0x1cfa7:$str01: get_ActivatePong 0x28607:$str01: get_ActivatePong 0x7456:$str02: get_SslClient 0x1289a:$str02: get_SslClient 0x1dcf6:$str02: get_SslClient 0x29356:$str02: get_SslClient 0x7472:$str03: get_TcpClient 0x128b6:$str03: get_TcpClient 0x1dd12:$str03: get_TcpClient 0x29372:$str03: get_TcpClient 0x5d18:$str04: get_SendSync 0x1115c:$str04: get_SendSync 0x1c5b8:$str04: get_SendSync 0x27c18:$str04: get_SendSync 0x5d68:$str05: get_IsConnected 0x111ac:$str05: get_IsConnected 0x1c608:$str05: get_IsConnected 0x27c68:$str05: get_IsConnected 0x6497:$str06: set_UseShellExecute
0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9989:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14dcd:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x20229:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2b889:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 23 entries

Suricata Signatures

ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T01:52:15.261108+0100	2035595	1	Domain Observed Used for C2 Detected	164.92.163.239	3898	192.168.2.5	49704	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T01:52:15.261108+0100	2035607	1	Domain Observed Used for C2 Detected	164.92.163.239	3898	192.168.2.5	49704	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T01:52:15.261108+0100	2842478	1	Malware Command and Control Activity Detected	164.92.163.239	3898	192.168.2.5	49704	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MAdjnpU2Xp.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "164.92.163.239", "Ports": "3898", "Version": "0.5.8", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "M8gFCqrOJJZqCx1JYq0tXKezzud1GklJ", "Mutex": "AbDUeHz1cUxL", "Certificate": "MIIE8jCCAtqgAwIBAgIQAMgufplwZXWUObORbETzPTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwMjI3MTIyNTM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALAXG8I0Oda301Kb/b25SFQ5fFLOjXPGpbnc1CFJU8j8YhBdWRJtt4UXy19hKnAK188qpk8h4v6syQ4KPMmnMh87xdEs1BDkVcZoICVNHxqoffFLr6kVbwlVpseLHkyKlHAmnIfM9DwRZih0UQPvPn+rq0j9e7dAVZ6q5UbC/XvuGnJvG0N76oxm62TpMzrFp8aSSPLUjnb7cK0K9SnJTeuHKXuCzBz6ybHPeZrIGceNKzNdMwFM6f6Fv7XW33Y+TrfBJ5YcxULk8zbAaR32pXsS9PA+sQh3Hlq+bRBYLwXJtzu6Xf6cDvNL9XOzA41i7vQnhU0B70HCjZmsnKDqWbIlne6MWasnpTAHIFlcGnvfVom7ST0nQIFkFEfvTdxR5cEn4bnIOVoYZJ3dobf3xeAJ57XflyEHQFW0hUPN3UHRH+DqX5Xztf3U+HRgRyBNUAszcBIaSCJFTYq6GlZU0Hf0ICcVROCEBapE5ey0GwV4eGqDIIs47su1bmVwUt8U8dtVz+urOHKNw6EmC5uP71znTIxry4C/ypAZWG1LxcYxid/zKVNMZB+E0MFXZZfdz1Hn1FRSWskf7jN0hSMrD+dj4EruaIoBHtcwvuQHfWBLDeaqnTWgxZV7mwciOb5PwBDwCV/gnW4l4Jmc5fWU0djS0DxWY1Ay0nysXkHA78m3AgMBAAGjMjAwMB0GA1UdDgQWBBRnnlfc8PeW+7qR5y9AYLUe9ltaUjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQB/eReV/2V7aX+2wFV5wiRlIKUXEIenLdJtbuYSByqD0b0+Zhbm9MJtmSLVf1GwPCH+QUNJvqPe880VnuprYb726nCFeOX87hrofCKyxjO5CpSoo2/mT+ysOqyykdAnvkCbw8kyXu7UBXw7vIZIxW3etoK+JFrwpy1u0jJ6llnnj9Z6kdYibFrzKwmJYbJbdGHk3Ah0LgQrYwnEvt9RmgD3WsXAoHItBtXmzW8Cd4lMpfH4OZFESZf031MfVBAlXXuJHW4KxDy5/wFRFAGd5afl6lfzflqXmnXeG9LvGs28MclqDRmaEaZAnos5YEy7caXtD79bHOC6sAj4WPso2X+h97Cx7LMuXiVE5t+kVrnzNxgUUl9dmPrNu3Sf0NCfOvJZkrutScadynVqxGLQ3LPHURALsMQNUGhE7dSzxGTIw9FUzwPbE1IGuO0KzOCkRqBjzRqEEXXXjd2tckpAnPH91rGh8rC+Nre83Quhyupcs9XfClahlLTpVht/eZvkAQLJ4RD33bksoeVKsKtcxYvzodbu3Zny+aWeF89Ford0wvLoAPzbGBdpzPvsqax63HQJCql5h98ovIfG1wnBylDi7XR+f4LQm5KWJxMH2ovJH6xOZM1HVSCQO+Fvd3OWR5cLBthKHk0fqJXOjSf50OZSQOERTt6xq9biTUkjEdI4MA==", "ServerSignature": "r0sDxZc/+EUUY+4fptcRe+9FfNLkjcGro3dc3o1aL9ZdI8pcpfQygNIG53NXBStkXm/NXRbXYt46U6ylRZ9nVb/RCSRbTXBa5IPAB9E0ezv4H0QayUESX7efOkhTmc5dHCIjtzJeEGhqz5Eqjv2agJXQka1UPmnrHDvt5eSMP2cprqTX7ZNhjT4wIXoQbC0i7Wbqw1/EVxiLkF+Lah2t5lnZUD3o/WZoM9c24NeBxxH95LLZwIpC/tQUEVRtvGd4GKTfIRtdIAqmmMmnUW/LpszCATvrorHzOXNpUwMhJ0ByvGbaRdx+WC2mnBWEsbcA1C3Ycf1MtWD6vzTLTcrrxR9trQnPM1SMxdRjCXxJtIRoEjhVO3+5Tp8KXbq7r5Md6ipGyGHgqCIj343/WJWxuJo46EJSl3J1ukduhoiprTcncLUkDuTf5VFMuUxJ140K/0dmJGdTNCVZYSXHDX7+7oOoRZ/gDBZEzII0OfwN+JkZUuxYSgckQ0i8f0CxB7bxyVDqXwkBGtYvNN6Sqlr0028bWY3YVSlvtO4xzFA9nhGp29paQWjdMYdyDhR4Qy8FFtoJr1hOkUHRLf0Y5VX2p774v5Coukgv0dLJqKfgWEBfGuy2J3dg8WxxryWR6mCdpu6CU+vUdMZZb4cdLmzE/sRjX4yBGfqzvP8udzb5twM=", "BDOS": "false", "External_config_on_Pastebin": "null"}

Multi AV Scanner detection for submitted file

Source: MAdjnpU2Xp.exe	ReversingLabs: Detection: 73%
Source: MAdjnpU2Xp.exe	Virustotal: Detection: 70%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 3898
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 164.92.163.239
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 0.5.8
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: false
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: AbDUeHz1cUxL
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: MIIE8jCCAtqgAwIBAgIQAMgufplwZXWUObORbETzPTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwMjI3MTIyNTM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALAXG8I0Oda301Kb/b25SFQ5fFLOjXPGpbnc1CFJU8j8YhBdWRJtt4UXy19hKnAK188qpk8h4v6syQ4KPMmnMh87xdEs1BDkVcZoICVNHxqoffFLr6kVbwlVpseLHkyKlHAmnIfM9DwRZih0UQPvPn+rq0j9e7dAVZ6q5UbC/XvuGnJvG0N76oxm62TpMzrFp8aSSPLUjnb7cK0K9SnJTeuHKXuCzBz6ybHPeZrIGceNKzNdMwFM6f6Fv7XW33Y+TrfBJ5YcxULk8zbAaR32pXsS9PA+sQh3Hlq+bRBYLwXJtzu6Xf6cDvNL9XOzA41i7vQnhU0B70HCjZmsnKDqWbIlne6MWasnpTAHIFlcGnvfVom7ST0nQIFkFEfvTdxR5cEn4bnIOVoYZJ3dobf3xeAJ57XflyEHQFW0hUPN3UHRH+DqX5Xztf3U+HRgRyBNUAszcBIaSCJFTYq6GlZU0Hf0ICcVROCEBapE5ey0GwV4eGqDIIs47su1bmVwUt8U8dtVz+urOHKNw6EmC5uP71znTIxry4C/ypAZWG1LxcYxid/zKVNMZB+E0MFXZZfdz1Hn1FRSWskf7jN0hSMrD+dj4EruaIoBHtcwvuQHfWBLDeaqnTWgxZV7mwciOb5PwBDwCV/gnW4l4Jmc5fWU0djS0DxWY1Ay0nysXkHA78m3AgMBAAGjMjAwMB0GA1UdDgQWBBRnnlfc8PeW+7qR5y9AYLUe9ltaUjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQB/eReV/2V7aX+2wFV5wiRlIKUXEIenLdJtbuYSByqD0b0+Zhbm9MJtmSLVf1GwPCH+QUNJvqPe880VnuprYb726nCFeOX87hrofCKyxjO5CpSoo2/mT+ysOqyykdAnvkCbw8kyXu7UBXw7vIZIxW3etoK+JFrwpy1u0jJ6llnnj9Z6kdYibFrzKwmJYbJbdGHk3Ah0LgQrYwnEvt9RmgD3WsXAoHItBtXmzW8Cd4lMpfH4OZFESZf031MfVBAlXXuJHW4KxDy5/wFRFAGd5afl6lfzflqXmnXeG9LvGs28MclqDRmaEaZAnos5YEy7caXtD79bHOC6sAj4WPso2X+h97Cx7LMuXiVE5t+kVrnzNxgUUl9dmPrNu3Sf0NCfOvJZkrutScadynVqxGLQ3LPHURALsMQNUGhE7dSzxGTIw9FUzwPbE1IGuO0KzOCkRqBjzRqEEXXXjd2tckpAnPH91rGh8rC+Nre83Quhyupcs9XfClahlLTpVht/eZvkAQLJ4RD33bksoeVKsKtcxYvzodbu3Zny+aWeF89Ford0wvLoAPzbGBdpzPvsqax63HQJCql5h98ovIfG1wnBylDi7XR+f4LQm5KWJxMH2ovJH6xOZM1HVSCQO+Fvd3OWR5cLBthKHk0fqJXOjSf50OZSQOERTt6xq9biTUkjEdI4MA==
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: r0sDxZc/+EUUY+4fptcRe+9FfNLkjcGro3dc3o1aL9ZdI8pcpfQygNIG53NXBStkXm/NXRbXYt46U6ylRZ9nVb/RCSRbTXBa5IPAB9E0ezv4H0QayUESX7efOkhTmc5dHCIjtzJeEGhqz5Eqjv2agJXQka1UPmnrHDvt5eSMP2cprqTX7ZNhjT4wIXoQbC0i7Wbqw1/EVxiLkF+Lah2t5lnZUD3o/WZoM9c24NeBxxH95LLZwIpC/tQUEVRtvGd4GKTfIRtdIAqmmMmnUW/LpszCATvrorHzOXNpUwMhJ0ByvGbaRdx+WC2mnBWEsbcA1C3Ycf1MtWD6vzTLTcrrxR9trQnPM1SMxdRjCXxJtIRoEjhVO3+5Tp8KXbq7r5Md6ipGyGHgqCIj343/WJWxuJo46EJSl3J1ukduhoiprTcncLUkDuTf5VFMuUxJ140K/0dmJGdTNCVZYSXHDX7+7oOoRZ/gDBZEzII0OfwN+JkZUuxYSgckQ0i8f0CxB7bxyVDqXwkBGtYvNN6Sqlr0028bWY3YVSlvtO4xzFA9nhGp29paQWjdMYdyDhR4Qy8FFtoJr1hOkUHRLf0Y5VX2p774v5Coukgv0dLJqKfgWEBfGuy2J3dg8WxxryWR6mCdpu6CU+vUdMZZb4cdLmzE/sRjX4yBGfqzvP8udzb5twM=
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: null
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 1
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: 3898
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: 164.92.163.239
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: 0.5.8
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: false
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: AbDUeHz1cUxL
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: MIIE8jCCAtqgAwIBAgIQAMgufplwZXWUObORbETzPTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwMjI3MTIyNTM3WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALAXG8I0Oda301Kb/b25SFQ5fFLOjXPGpbnc1CFJU8j8YhBdWRJtt4UXy19hKnAK188qpk8h4v6syQ4KPMmnMh87xdEs1BDkVcZoICVNHxqoffFLr6kVbwlVpseLHkyKlHAmnIfM9DwRZih0UQPvPn+rq0j9e7dAVZ6q5UbC/XvuGnJvG0N76oxm62TpMzrFp8aSSPLUjnb7cK0K9SnJTeuHKXuCzBz6ybHPeZrIGceNKzNdMwFM6f6Fv7XW33Y+TrfBJ5YcxULk8zbAaR32pXsS9PA+sQh3Hlq+bRBYLwXJtzu6Xf6cDvNL9XOzA41i7vQnhU0B70HCjZmsnKDqWbIlne6MWasnpTAHIFlcGnvfVom7ST0nQIFkFEfvTdxR5cEn4bnIOVoYZJ3dobf3xeAJ57XflyEHQFW0hUPN3UHRH+DqX5Xztf3U+HRgRyBNUAszcBIaSCJFTYq6GlZU0Hf0ICcVROCEBapE5ey0GwV4eGqDIIs47su1bmVwUt8U8dtVz+urOHKNw6EmC5uP71znTIxry4C/ypAZWG1LxcYxid/zKVNMZB+E0MFXZZfdz1Hn1FRSWskf7jN0hSMrD+dj4EruaIoBHtcwvuQHfWBLDeaqnTWgxZV7mwciOb5PwBDwCV/gnW4l4Jmc5fWU0djS0DxWY1Ay0nysXkHA78m3AgMBAAGjMjAwMB0GA1UdDgQWBBRnnlfc8PeW+7qR5y9AYLUe9ltaUjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQB/eReV/2V7aX+2wFV5wiRlIKUXEIenLdJtbuYSByqD0b0+Zhbm9MJtmSLVf1GwPCH+QUNJvqPe880VnuprYb726nCFeOX87hrofCKyxjO5CpSoo2/mT+ysOqyykdAnvkCbw8kyXu7UBXw7vIZIxW3etoK+JFrwpy1u0jJ6llnnj9Z6kdYibFrzKwmJYbJbdGHk3Ah0LgQrYwnEvt9RmgD3WsXAoHItBtXmzW8Cd4lMpfH4OZFESZf031MfVBAlXXuJHW4KxDy5/wFRFAGd5afl6lfzflqXmnXeG9LvGs28MclqDRmaEaZAnos5YEy7caXtD79bHOC6sAj4WPso2X+h97Cx7LMuXiVE5t+kVrnzNxgUUl9dmPrNu3Sf0NCfOvJZkrutScadynVqxGLQ3LPHURALsMQNUGhE7dSzxGTIw9FUzwPbE1IGuO0KzOCkRqBjzRqEEXXXjd2tckpAnPH91rGh8rC+Nre83Quhyupcs9XfClahlLTpVht/eZvkAQLJ4RD33bksoeVKsKtcxYvzodbu3Zny+aWeF89Ford0wvLoAPzbGBdpzPvsqax63HQJCql5h98ovIfG1wnBylDi7XR+f4LQm5KWJxMH2ovJH6xOZM1HVSCQO+Fvd3OWR5cLBthKHk0fqJXOjSf50OZSQOERTt6xq9biTUkjEdI4MA==
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: r0sDxZc/+EUUY+4fptcRe+9FfNLkjcGro3dc3o1aL9ZdI8pcpfQygNIG53NXBStkXm/NXRbXYt46U6ylRZ9nVb/RCSRbTXBa5IPAB9E0ezv4H0QayUESX7efOkhTmc5dHCIjtzJeEGhqz5Eqjv2agJXQka1UPmnrHDvt5eSMP2cprqTX7ZNhjT4wIXoQbC0i7Wbqw1/EVxiLkF+Lah2t5lnZUD3o/WZoM9c24NeBxxH95LLZwIpC/tQUEVRtvGd4GKTfIRtdIAqmmMmnUW/LpszCATvrorHzOXNpUwMhJ0ByvGbaRdx+WC2mnBWEsbcA1C3Ycf1MtWD6vzTLTcrrxR9trQnPM1SMxdRjCXxJtIRoEjhVO3+5Tp8KXbq7r5Md6ipGyGHgqCIj343/WJWxuJo46EJSl3J1ukduhoiprTcncLUkDuTf5VFMuUxJ140K/0dmJGdTNCVZYSXHDX7+7oOoRZ/gDBZEzII0OfwN+JkZUuxYSgckQ0i8f0CxB7bxyVDqXwkBGtYvNN6Sqlr0028bWY3YVSlvtO4xzFA9nhGp29paQWjdMYdyDhR4Qy8FFtoJr1hOkUHRLf0Y5VX2p774v5Coukgv0dLJqKfgWEBfGuy2J3dg8WxxryWR6mCdpu6CU+vUdMZZb4cdLmzE/sRjX4yBGfqzvP8udzb5twM=
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: false
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: null
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: false
Source: 1.2.RegAsm.exe.400000.0.unpack	String decryptor: 1

Source: MAdjnpU2Xp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MAdjnpU2Xp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 164.92.163.239:3898 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 164.92.163.239:3898 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert : 164.92.163.239:3898 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 164.92.163.239:3898 -> 192.168.2.5:49704

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 164.92.163.239:3898

Source: Joe Sandbox View

ASN Name: ASN-DPSDUS ASN-DPSDUS

Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.163.239

Source: RegAsm.exe, 00000001.00000002.3304562828.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000001.00000002.3304562828.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabj
Source: RegAsm.exe, 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MAdjnpU2Xp.exe PID: 6104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6660, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: MAdjnpU2Xp.exe PID: 6104, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6660, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_015865C0	1_2_015865C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01585CF0	1_2_01585CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_015859A8	1_2_015859A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0158A878	1_2_0158A878

Source: MAdjnpU2Xp.exe, 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs MAdjnpU2Xp.exe
Source: MAdjnpU2Xp.exe, 00000000.00000002.2061115097.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MAdjnpU2Xp.exe
Source: MAdjnpU2Xp.exe, 00000000.00000000.2058639999.0000000000162000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameaitstatic.exe4 vs MAdjnpU2Xp.exe
Source: MAdjnpU2Xp.exe	Binary or memory string: OriginalFilenameaitstatic.exe4 vs MAdjnpU2Xp.exe

Source: MAdjnpU2Xp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: MAdjnpU2Xp.exe PID: 6104, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: RegAsm.exe PID: 6660, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: MAdjnpU2Xp.exe, by-unknown-------------------------.cs	Base64 encoded string: 'QzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XFJlZ0FzbS5leGU='
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, Settings.cs	Base64 encoded string: 'sVohXfKrijEkGH2c0tJkCBeeUU3iLoSonfcYaKeM4wVa81M+9yJBmv7oj47DOLL5s8sLGbRPLkJSPD144E3WqQ==', 'qph12/RO46gxGPPkuJpFTTgUGGY0pOdsXOg16gAj297DNrUp7SuzrocJreMMWA1RNeHHvIoLBr1cy8vXaI6VhXcClWABWzayNjzefsvmefJUxGwHFiVFaeZgJAVU+kAdO+vOlB3+ha00AOWxFXZMOTaI78gdx2WdBTgDAS15UfTckuKuynGks2OwFWYN5OYeCUkCvESxBn+uHfHyCW3xaRu0Xm9KdoD+8xq5aYSXzAFef6nImcYbRkb3J6ismGU6iHUKBnvlLB2rqJ8DToSkSVZAZZeo0XwAXizfgsRuEZoszKSgV29uZ9DL8PGW11iE245cVcOSAkZAogANk4Yr0VVTkMhF5FPGRWOzURTtk46BKOoO5baIGmGIKgIB+YqV4dCmjwDp/n8LCxaevSBCuz6FeIgnxfrwhQaRIHUVgaVhVleU+MijRgrLzg6DvRMz3i1GnX2HBB3DXpgw1q1PHrKstS3IE/89DC0xNJ5B8sXR6Zo70hOYBImjiusHVJFhi09D4695JIk+fRcSLL1vY+090I/lgqCHhjlws+kS5gXeLWk3Dgj4R3LeYQWETfMlXD2tXnUtIBRiERcSyL2etbfUprt+AUlGqXyqpwN6bJzpbu1AG3cbwBWV7QQ4qepKELuBdcJm4/fwWpcLhkjG1J32vI+VI3xKjmUCRvkEKqaZIStC2oSFsXHM/Fq23QeFU+KQIeh9vxiT6pHh6o54vRz7pGndx6L30ZQL5K0jrTdGgJ9zMzONaKw0/y1Mkq3spO8dEQf5uq25VxgaASiyVTNfUd1NyXnTeELjH2ox6SMJSOpmAg5Az7n0AzJ4/ZE28BoLTmTU4T2byCpQZ2K5KHwjW5CqCXoMrM8uW4PCYm7NmdZPtBm/GUEEporIGvPnzXfqBpUPUBhaSKsud3MhrXVdXNioIDKH3l/EAm9vdbyF0UU/mcrZoJHXsYrNZ+tsZt3Fh4HZ/m03Wnpbr/zPUw==', 'iUdWGOAoTNMYjBUpIfXXBiJtqLwZr0OkZj+ZMDbPdUK9XuovjA8gJ1JYC6GgSlvhjMaRzGf2TFATfudct3MGXA==', 'KH5gIq5lpA7PV71+vW7LBB4xH9eN36+xAaoxuvuDLJ9qQouHMeA7C/6ppJXkBxGjevPAQ0knZgGcuffA64OlXA=='
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, Settings.cs	Base64 encoded string: 'sVohXfKrijEkGH2c0tJkCBeeUU3iLoSonfcYaKeM4wVa81M+9yJBmv7oj47DOLL5s8sLGbRPLkJSPD144E3WqQ==', 'qph12/RO46gxGPPkuJpFTTgUGGY0pOdsXOg16gAj297DNrUp7SuzrocJreMMWA1RNeHHvIoLBr1cy8vXaI6VhXcClWABWzayNjzefsvmefJUxGwHFiVFaeZgJAVU+kAdO+vOlB3+ha00AOWxFXZMOTaI78gdx2WdBTgDAS15UfTckuKuynGks2OwFWYN5OYeCUkCvESxBn+uHfHyCW3xaRu0Xm9KdoD+8xq5aYSXzAFef6nImcYbRkb3J6ismGU6iHUKBnvlLB2rqJ8DToSkSVZAZZeo0XwAXizfgsRuEZoszKSgV29uZ9DL8PGW11iE245cVcOSAkZAogANk4Yr0VVTkMhF5FPGRWOzURTtk46BKOoO5baIGmGIKgIB+YqV4dCmjwDp/n8LCxaevSBCuz6FeIgnxfrwhQaRIHUVgaVhVleU+MijRgrLzg6DvRMz3i1GnX2HBB3DXpgw1q1PHrKstS3IE/89DC0xNJ5B8sXR6Zo70hOYBImjiusHVJFhi09D4695JIk+fRcSLL1vY+090I/lgqCHhjlws+kS5gXeLWk3Dgj4R3LeYQWETfMlXD2tXnUtIBRiERcSyL2etbfUprt+AUlGqXyqpwN6bJzpbu1AG3cbwBWV7QQ4qepKELuBdcJm4/fwWpcLhkjG1J32vI+VI3xKjmUCRvkEKqaZIStC2oSFsXHM/Fq23QeFU+KQIeh9vxiT6pHh6o54vRz7pGndx6L30ZQL5K0jrTdGgJ9zMzONaKw0/y1Mkq3spO8dEQf5uq25VxgaASiyVTNfUd1NyXnTeELjH2ox6SMJSOpmAg5Az7n0AzJ4/ZE28BoLTmTU4T2byCpQZ2K5KHwjW5CqCXoMrM8uW4PCYm7NmdZPtBm/GUEEporIGvPnzXfqBpUPUBhaSKsud3MhrXVdXNioIDKH3l/EAm9vdbyF0UU/mcrZoJHXsYrNZ+tsZt3Fh4HZ/m03Wnpbr/zPUw==', 'iUdWGOAoTNMYjBUpIfXXBiJtqLwZr0OkZj+ZMDbPdUK9XuovjA8gJ1JYC6GgSlvhjMaRzGf2TFATfudct3MGXA==', 'KH5gIq5lpA7PV71+vW7LBB4xH9eN36+xAaoxuvuDLJ9qQouHMeA7C/6ppJXkBxGjevPAQ0knZgGcuffA64OlXA=='
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, Settings.cs	Base64 encoded string: 'sVohXfKrijEkGH2c0tJkCBeeUU3iLoSonfcYaKeM4wVa81M+9yJBmv7oj47DOLL5s8sLGbRPLkJSPD144E3WqQ==', 'qph12/RO46gxGPPkuJpFTTgUGGY0pOdsXOg16gAj297DNrUp7SuzrocJreMMWA1RNeHHvIoLBr1cy8vXaI6VhXcClWABWzayNjzefsvmefJUxGwHFiVFaeZgJAVU+kAdO+vOlB3+ha00AOWxFXZMOTaI78gdx2WdBTgDAS15UfTckuKuynGks2OwFWYN5OYeCUkCvESxBn+uHfHyCW3xaRu0Xm9KdoD+8xq5aYSXzAFef6nImcYbRkb3J6ismGU6iHUKBnvlLB2rqJ8DToSkSVZAZZeo0XwAXizfgsRuEZoszKSgV29uZ9DL8PGW11iE245cVcOSAkZAogANk4Yr0VVTkMhF5FPGRWOzURTtk46BKOoO5baIGmGIKgIB+YqV4dCmjwDp/n8LCxaevSBCuz6FeIgnxfrwhQaRIHUVgaVhVleU+MijRgrLzg6DvRMz3i1GnX2HBB3DXpgw1q1PHrKstS3IE/89DC0xNJ5B8sXR6Zo70hOYBImjiusHVJFhi09D4695JIk+fRcSLL1vY+090I/lgqCHhjlws+kS5gXeLWk3Dgj4R3LeYQWETfMlXD2tXnUtIBRiERcSyL2etbfUprt+AUlGqXyqpwN6bJzpbu1AG3cbwBWV7QQ4qepKELuBdcJm4/fwWpcLhkjG1J32vI+VI3xKjmUCRvkEKqaZIStC2oSFsXHM/Fq23QeFU+KQIeh9vxiT6pHh6o54vRz7pGndx6L30ZQL5K0jrTdGgJ9zMzONaKw0/y1Mkq3spO8dEQf5uq25VxgaASiyVTNfUd1NyXnTeELjH2ox6SMJSOpmAg5Az7n0AzJ4/ZE28BoLTmTU4T2byCpQZ2K5KHwjW5CqCXoMrM8uW4PCYm7NmdZPtBm/GUEEporIGvPnzXfqBpUPUBhaSKsud3MhrXVdXNioIDKH3l/EAm9vdbyF0UU/mcrZoJHXsYrNZ+tsZt3Fh4HZ/m03Wnpbr/zPUw==', 'iUdWGOAoTNMYjBUpIfXXBiJtqLwZr0OkZj+ZMDbPdUK9XuovjA8gJ1JYC6GgSlvhjMaRzGf2TFATfudct3MGXA==', 'KH5gIq5lpA7PV71+vW7LBB4xH9eN36+xAaoxuvuDLJ9qQouHMeA7C/6ppJXkBxGjevPAQ0knZgGcuffA64OlXA=='

Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/3@0/1

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MAdjnpU2Xp.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\AbDUeHz1cUxL

Source: MAdjnpU2Xp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MAdjnpU2Xp.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MAdjnpU2Xp.exe	ReversingLabs: Detection: 73%
Source: MAdjnpU2Xp.exe	Virustotal: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\MAdjnpU2Xp.exe "C:\Users\user\Desktop\MAdjnpU2Xp.exe"
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: MAdjnpU2Xp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MAdjnpU2Xp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: MAdjnpU2Xp.exe

Static PE information: section name: .text entropy: 7.297608531471922

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MAdjnpU2Xp.exe PID: 6104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6660, type: MEMORYSTR

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MAdjnpU2Xp.exe PID: 6104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6660, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: MAdjnpU2Xp.exe, 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory allocated: 22B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory allocated: 24A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory allocated: 44A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5330000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2357			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7488			Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe TID: 6156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7032	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1276	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1276	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5560	Thread sleep count: 2357 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5560	Thread sleep count: 7488 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 00000001.00000002.3304701900.0000000001725000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: RegAsm.exe, 00000001.00000002.3306852373.0000000005880000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3306767759.0000000005874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: MAdjnpU2Xp.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: ReadProcessMemory(by_002Dunknown_2642_D83D_DCA3_FFFD_D83D_DD2D_FFFD_FFFD_FFFD_D83E_DD70_FFFD_200D_FFFD_FFFD_D83D_DE33_D83D_DE1C_FFFD_FFFD_D83D_DDE8_FFFD_FFFD.ProcessHandle, num3 + 4 + 4, ref by_002Dunknown_FFFD_FFFD_FFFD_FFFD_FE0F_FE0F_FFFD_26A7_FFFD_FE0F_D83D_DE36_FFFD_FFFD_FFFD_FE0F_FFFD_D83C_DEC1_FFFD_D83E_DCA3_FFFD_200D_FFFD, 4, ref by_002Dunknown_FFFD_D83E_DCAB_FE0F_26A7_200D_FE0F_D83D_DEA0_200D_FFFD_FFFD_FFFD_FFFD_FFFD_FE0F_FFFD_D83E_DD14_FFFD_D83D_DD70_D83D_DF2B_FFFD)
Source: MAdjnpU2Xp.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: VirtualAllocEx(by_002Dunknown_2642_D83D_DCA3_FFFD_D83D_DD2D_FFFD_FFFD_FFFD_D83E_DD70_FFFD_200D_FFFD_FFFD_D83D_DE33_D83D_DE1C_FFFD_FFFD_D83D_DDE8_FFFD_FFFD.ProcessHandle, num2, num4, 12288, 64)
Source: MAdjnpU2Xp.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: WriteProcessMemory(by_002Dunknown_2642_D83D_DCA3_FFFD_D83D_DD2D_FFFD_FFFD_FFFD_D83E_DD70_FFFD_200D_FFFD_FFFD_D83D_DE33_D83D_DE1C_FFFD_FFFD_D83D_DDE8_FFFD_FFFD.ProcessHandle, num6, by_002Dunknown_FFFD_FE0F_FFFD_2642_FFFD_D83E_DCAB_FFFD_FFFD_D83E_DD2D_200D_D83D_DFF3_FFFD_D83D_DD29_D83E_DEC1_FE0F_FFFD_FFFD_FFFD_D83D_DD75, num5, ref by_002Dunknown_FFFD_D83E_DCAB_FE0F_26A7_200D_FE0F_D83D_DEA0_200D_FFFD_FFFD_FFFD_FFFD_FFFD_FE0F_FFFD_D83E_DD14_FFFD_D83D_DD70_D83D_DF2B_FFFD)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1067008	Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.3305094853.0000000003399000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.000000000339D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.0000000003390000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q
Source: RegAsm.exe, 00000001.00000002.3305094853.0000000003399000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.000000000339D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.0000000003390000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000001.00000002.3305094853.0000000003399000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.0000000003390000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.00000000033BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q%
Source: RegAsm.exe, 00000001.00000002.3305094853.0000000003399000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3305094853.0000000003390000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q
Source: RegAsm.exe, 00000001.00000002.3305094853.00000000033BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]qDG<
Source: RegAsm.exe, 00000001.00000002.3305094853.00000000033BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q$I<

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe	Queries volume information: C:\Users\user\Desktop\MAdjnpU2Xp.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MAdjnpU2Xp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.253e280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.2532e24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MAdjnpU2Xp.exe.25279e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MAdjnpU2Xp.exe PID: 6104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6660, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	312 Process Injection	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MAdjnpU2Xp.exe	74%	ReversingLabs	Win32.Spyware.AsyncRAT
MAdjnpU2Xp.exe	70%	Virustotal		Browse
MAdjnpU2Xp.exe	100%	Avira	TR/Dropper.Gen

Name	IP	Active	Malicious	Antivirus Detection	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
164.92.163.239	unknown	United States		46930	ASN-DPSDUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1628657
Start date and time:	2025-03-04 01:51:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MAdjnpU2Xp.exe renamed because original name is a hash value
Original Sample Name:	157a3f7a20b22e78c4d3f7ea88538ff7.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/3@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 64 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 217.20.57.19, 13.107.246.60, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 6660 because it is empty
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:52:15	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	IPE Rigging Corp Request For Proposal.pdf	Get hash	malicious	Unknown	Browse	217.20.57.36
	TR Swisslife Request for Timely Document Review and Approval.msg	Get hash	malicious	Unknown	Browse	84.201.210.39
	SecuriteInfo.com.Other.Malware-gen.10169.30262.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.23
	door.bat	Get hash	malicious	Unknown	Browse	217.20.57.34
	POETDB24-25815.xla.xlsx	Get hash	malicious	Unknown	Browse	217.20.57.19
	TxSGVmS8uR.exe	Get hash	malicious	PureCrypter, AsyncRAT	Browse	84.201.210.39
	q3na5Mc.exe	Get hash	malicious	Vidar	Browse	84.201.210.23
	Technical_Requirements.xls	Get hash	malicious	Unknown	Browse	217.20.57.20
	Technical_Requirements.xls	Get hash	malicious	Unknown	Browse	217.20.57.18
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse	217.20.57.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-DPSDUS	yakov.ppc.elf	Get hash	malicious	Mirai	Browse	164.92.0.31
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	164.94.100.158
	https://infocorporacion.pe/Kennyiryiio/COCOPOOOUT.html	Get hash	malicious	HTMLPhisher	Browse	164.92.93.159
	telnet.arm.elf	Get hash	malicious	Unknown	Browse	164.92.71.254
	sora.arm.elf	Get hash	malicious	Mirai	Browse	164.92.178.93
	RFQ PC25-1301 Product Specifications_PDF.exe	Get hash	malicious	FormBook	Browse	164.92.166.75
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	164.92.178.86
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	164.94.212.231
	https://webservice.ucampaign.unear.net/UmailTracking/t.aspx?p=64620006&c=MTI2NjMxOA==&up=46435316&e=jlim@vvblawyers.com&l=MTczODQ=&i=1126&u=aHR0cHM6Ly9zcGhleGFtcy5jb20vLndlbGwta25vdy8/MHM1N2RiPU1UTW1NVE1tTVRNbU1UTW1RakVtUmpRbWIySnhkRWN6SmtRMEprMTFiSGR5VkdoSGVVdFpMaTQ1U2pOWU5sSnlhbVk2Y2tZMEpqTXpKblY1Wm5VdWIyWmxaV3BwTXpNbVJUUW1kSFJpYldReE15WnZZbkYwUkRRbVFqRW1SalFtYlc1MWFVY3pKa1EwSmtJeEprWTBKbnBsY0dOSE15WkVOQ1pDTVNaR05DWjZaWEJqUkRRbVFqRW1SalFtWldKbWFVY3pKa1EwSmtJeEprWTBKbVp0ZW5WMFJ6TW1SRFFtTVRNbU1UTW1NVE1tTVRNbVFqRW1SVGdtTVRNbU1UTW1NVE1tTVRNbU1UTW1NVE1tTVRNbU1UTW1RakVtUXpRbWIyWmxaV3BwTVRNbVFqUW1lblZxYldwamFuUnFkekV6SmpFekpqRXpKakV6SmpFekpqRXpKakV6SmpFekpqRXpKakV6SmpFekpqRXpKa0l4SmtNMEptWjFhbWw0TVRNbVFqUW1jM0J0Y0dReE15WXhNeVl4TXlZeE15WXhNeVl4TXlZeE15WXhNeVl4TXlZeE15WXhNeVl4TXlaQ01TWkRPQ1l4TXlaMWVXWjFMbTltWldWcWFTOHhNeVl4TXlZeE15WXhNeVl4TXlZeE15WXhNeVl4TXlaQ01TWkdOQ1ptYlhwMWRFUTBKakV6SmpFekpqRXpKakV6SmtJeEprWTBKbVp0ZFdwMVJ6TW1SRFFtWm01d1NVWTBKbVp0ZFdwMVJEUW1NVE1tTVRNbU1UTW1NVE1tUWpFbVJ6TW1LekV6Sm1aek1UTW1aV1ZpTVRNbVJUUW1SVFFtUlRRbVJUUW1SVFFtUlRRbVJEUW1NVE1tSzBjekpqRXpKakV6SmtZMEpqTXpKa1UwSmpFelkyczJSR054UjFoamIwTkdaWHRYU0dWemVtZHNkSHBtYVdkdWMydGxhVFF6SmtjekptWnpSek1tWldSSE15WjRjRzlzTG0xdFpuZ3ZSek1tYUhOd0wyWnRZbTl3YW50aWIzTm1kVzlxYjJadVlrY3pKa2N6SmtJMEpuUnhkWFZwUlRRbWJYTjJRelFtTXpNekprVTBKblZ2Wm5WdmNHUXhNeVl6TXlacGRHWnpaMlp6TXpNbVJUUW1kMnAyY21ZdWNYVjFhVEV6Sm1KMVptNUVOQ1l4TXlZeE15WXhNeVl4TXlaQ01TWkdOQ1l6TXlZNUxrZFZWak16SmtVMEpuVm1kSE5pYVdReE15WmlkV1p1UkRRbU1UTW1NVE1tTVRNbU1UTW1RakVtUmpRbVpXSm1hVVEwSmtJeEprWTBKbTF1ZFdsRU5DWkNNU1pHTkNadlluRjBSek1tUkRRbVpHczNhRnBXUkRRbWRIczFUVVUwSmt4WWJYZ3hUMUZuWkZoUVdYTjdOWGRIT1h0UlJUWW1RMDlHTkNZek15WjFlV1oxTG05bVpXVnFhVE16SmtVMEpuUjBZbTFrTVRNbWIySnhkRVEwSmtJeEpnPT0=	Get hash	malicious	HTMLPhisher	Browse	164.92.188.247
	https://google.sk/url?q=gcwogJLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/fvh1/emVnZXJ0dmFuZGVybGluZ2VuQHJveWFsZmxvcmFob2xsYW5kLmNvbQ==%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	164.92.191.86

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.183651560957911
Encrypted:	false
SSDEEP:	6:kKLBGmcvSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:zBGmCkPlE99SNxAhUeq8S
MD5:	0B146A43825A8DB9838E9A4A6520DE7E
SHA1:	D624254046DE0E38A728D0BA68FB7DB34F20A8BF
SHA-256:	E4601024715A25BD428AEC2990DE47A9220776AB0774FDF79829C7A58DB86552
SHA-512:	E5162F5533E15618402C212D203AE87A11B0480951709EAD5E365B9C928D385A067A77346202009EADAABFFE878DC520464CD8A56A11EE39E4218F890CACB38E
Malicious:	false
Reputation:	low
Preview:	p...... ..........W.....(....................................................... ..................(...........Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MAdjnpU2Xp.exe.log

Download File

Process:	C:\Users\user\Desktop\MAdjnpU2Xp.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.2464499623102805
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MAdjnpU2Xp.exe
File size:	90'112 bytes
MD5:	157a3f7a20b22e78c4d3f7ea88538ff7
SHA1:	5289f49becfab4122f62ac5dc5f4ed4a6430d1e3
SHA256:	0ffd5b54317e01a658684577fee5d5c5f53d5b2e105e7cf8c1cdfd9bd8fee780
SHA512:	cd517f17d8253dfd8681fce97eaf5f591b8a7427cea2de132d68e1bc047227c287e9d5b11890e16503cf730d52c1117a5312b506ddcca4e223413f271f79f652
SSDEEP:	1536:fMQTBX+ACkkNQDm4KWtVeZJmDKmVBo2wJhtycPPsahIP7fsLt/vO35T:fMuzFkeS47tgJeKmfoBJhNPsahIP7fsy
TLSH:	ED93D64B40C0762ECA272A3B84535FC19B737A932D0DDF7964224B4D61682CFE647DAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................V...........t... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41749e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C30C96 [Sat Mar 1 13:33:10 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17448	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x552	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x154a4	0x15600	d5d74c60fcadbdd0df24dcbeb5b6d7ad	False	0.6929253472222222	data	7.297608531471922	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x552	0x600	afb933c344bc5da46512319ef8f74810	False	0.4055989583333333	data	3.9187396535488928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	3b5caf221fe36d81ad297934a2e33486	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x180a0	0x2c8	data			0.4508426966292135
RT_MANIFEST	0x18368	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
CompanyName	Microsoft .NET Assembly Registration Utility
FileDescription
FileVersion	0.0.0.0
InternalName	aitstatic.exe
LegalCopyright
OriginalFilename	aitstatic.exe
ProductVersion	0.0.0.0
Assembly Version	0.0.0.0

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-04T01:52:15.261108+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	164.92.163.239	3898	192.168.2.5	49704	TCP
2025-03-04T01:52:15.261108+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	164.92.163.239	3898	192.168.2.5	49704	TCP
2025-03-04T01:52:15.261108+0100	2035595	ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert	1	164.92.163.239	3898	192.168.2.5	49704	TCP
2025-03-04T01:52:15.261108+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	164.92.163.239	3898	192.168.2.5	49704	TCP

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 01:52:14.609786034 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:14.614942074 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:14.615056038 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:14.628148079 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:14.633233070 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:15.247400999 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:15.247450113 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:15.247648954 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:15.256038904 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:15.261107922 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:15.440079927 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:15.487679958 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:16.681968927 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:16.687118053 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:16.687207937 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:16.692256927 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:29.801711082 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:29.806787968 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:29.806848049 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:29.811846018 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:30.123770952 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:30.172631979 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:30.267973900 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:30.298475027 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:30.303560972 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:30.303628922 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:30.308595896 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:41.949733019 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:42.003329992 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:42.081604004 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:42.128403902 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:42.926160097 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:42.931364059 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:42.931435108 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:42.936589003 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:43.268027067 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:43.315840960 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:43.408642054 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:43.410826921 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:43.415879965 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:43.415951014 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:43.421026945 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:56.050875902 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:56.055898905 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:56.055963993 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:56.060899019 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:56.376832008 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:56.425363064 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:56.518532991 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:56.520261049 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:56.525289059 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:52:56.525346994 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:52:56.530318022 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:09.176001072 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:09.181201935 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:09.181351900 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:09.186799049 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:09.499767065 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:09.550204992 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:09.669048071 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:09.692729950 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:09.697932005 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:09.698010921 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:09.703088999 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:11.954149008 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:12.003344059 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:12.096697092 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:12.143960953 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:22.300976038 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:22.306117058 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:22.306236029 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:22.311347961 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:22.658247948 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:22.706486940 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:22.800137043 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:22.801948071 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:22.807102919 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:22.807183981 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:22.812292099 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:35.425898075 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:35.431171894 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:35.431395054 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:35.436449051 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:35.756277084 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:35.800261974 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:35.894412994 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:35.896178961 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:35.901248932 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:35.901328087 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:35.906356096 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:41.968741894 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:42.019007921 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:42.097666979 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:42.144157887 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:48.550873995 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:48.562475920 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:48.562653065 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:48.569953918 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:48.946065903 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:48.987720966 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:49.112689018 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:49.114450932 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:49.119498968 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:53:49.120342016 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:53:49.125690937 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:01.675724030 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:01.681030035 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:01.682485104 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:01.687565088 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:02.000709057 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:02.050255060 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:02.144678116 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:02.147219896 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:02.152337074 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:02.152473927 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:02.157527924 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:11.975524902 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:12.019022942 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:12.113581896 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:12.159632921 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:15.019376993 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:15.024662018 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:15.028160095 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:15.035207987 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:15.334325075 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:15.378504038 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:15.472992897 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:15.473735094 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:15.478897095 CET	3898	49704	164.92.163.239	192.168.2.5
Mar 4, 2025 01:54:15.478986979 CET	49704	3898	192.168.2.5	164.92.163.239
Mar 4, 2025 01:54:15.484134912 CET	3898	49704	164.92.163.239	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.39	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	A (IP address)	IN (0x0001)	false
Mar 4, 2025 01:52:15.571625948 CET	1.1.1.1	192.168.2.5	0xb902	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	A (IP address)	IN (0x0001)	false

Statistics

Click to jump to process

Memory Usage

• MAdjnpU2Xp.exe
• RegAsm.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• MAdjnpU2Xp.exe
• RegAsm.exe

Click to jump to process

Target ID:	0
Start time:	19:52:09
Start date:	03/03/2025
Path:	C:\Users\user\Desktop\MAdjnpU2Xp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MAdjnpU2Xp.exe"
Imagebase:	0x160000
File size:	90'112 bytes
MD5 hash:	157A3F7A20B22E78C4D3F7EA88538FF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.2061714758.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:52:09
Start date:	03/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	#system32
Imagebase:	0xee0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000002.3303566672.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000002.3305094853.0000000003331000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	37.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	3

Callgraph

Hide Legend

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 022F0CD1 Relevance: 3.4, APIs: 2, Instructions: 359
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 022F0548: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 022F1354

Part of subcall function 022F0554: Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,022F0DCC), ref: 022F14B3

Part of subcall function 022F0560: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,022F0E0A,?,00000004,?), ref: 022F1571

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 022F0ECF
ResumeThread.KERNELBASE(?), ref: 022F0FE4

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: ProcessThread$AllocContextCreateMemoryReadResumeVirtualWow64
String ID:
API String ID: 2498194165-0
Opcode ID: b3b9580a6150a956f27072ec4300a55592b40500c467b91bdc9956f80c019cde
Instruction ID: 63562a5866d9a32b954b83e28b4925d14f6942c01c2763537b17f27166003aac
Opcode Fuzzy Hash: b3b9580a6150a956f27072ec4300a55592b40500c467b91bdc9956f80c019cde
Instruction Fuzzy Hash: 07D19C71E102198BDB64DFA8C890BAEBBB2BF84304F548168D509EB395DF349E45CB91

Function 022F120C Relevance: 1.6, APIs: 1, Instructions: 142
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 022F1354

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: eacd5e4ace9464c23b9b430f4622d15806def6c6d1c80315b7bfa9ceca54d337
Instruction ID: 1eb63a7f5058e6728b6b3126df4a47524e19548708ace82ec89ab18264d6068c
Opcode Fuzzy Hash: eacd5e4ace9464c23b9b430f4622d15806def6c6d1c80315b7bfa9ceca54d337
Instruction Fuzzy Hash: 17513671901329DFDF25CFA9C944BDDBBB1BF49304F0080AAE508AB254C7759A88CF51

Function 022F0548 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 022F1354

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0ebe38bd9af08e3cb60ebc563a0c3a235eff73c0243417fa4f0751aa790c7223
Instruction ID: 426cf42c88b732edd805955ed5d8cdce752a63fda42ef28b9f9f7a273003e9d4
Opcode Fuzzy Hash: 0ebe38bd9af08e3cb60ebc563a0c3a235eff73c0243417fa4f0751aa790c7223
Instruction Fuzzy Hash: 42511571900229DFDF64CF99C944BDDBBB6FF49304F1080AAE608AB254D7759A88CF91

Function 022F056C Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,022F11AD,?,?,00000000), ref: 022F163C

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8b1a95b2d9635bc9a47f7a4c203387f5c4a28c9a76773a9b6c0ff540a4f4667f
Instruction ID: 2c3166e12c40691c02df4d5220828520446d36c4c5c78c4683c82d3b2345fec2
Opcode Fuzzy Hash: 8b1a95b2d9635bc9a47f7a4c203387f5c4a28c9a76773a9b6c0ff540a4f4667f
Instruction Fuzzy Hash: AC21D5B5910349DFDB10DF99C884BDEFBF4FB48314F54842AEA18A7240D378A954CBA5

Function 022F15B8 Relevance: 1.6, APIs: 1, Instructions: 62
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,022F11AD,?,?,00000000), ref: 022F163C

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2970d6e4330452337fd80acb18d2ba596ba2f4a6c9d3e520948212111980b0c0
Instruction ID: 667115898f28ee50b20fb7d3755dc2463f30e5b9d3c40236a9c9fb9cd261bc3d
Opcode Fuzzy Hash: 2970d6e4330452337fd80acb18d2ba596ba2f4a6c9d3e520948212111980b0c0
Instruction Fuzzy Hash: 1F21F0B5901249DFDB10CFAAD884ADEFBF4FB48314F54842AE958A7250D378A944CFA1

Function 022F0560 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,022F0E0A,?,00000004,?), ref: 022F1571

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 07f5c84af1c3563e269ba96771fcd393400f92954fe9b7a74a9dc8fe6bc4f900
Instruction ID: 50898062c96132222c6bb0edcdfb6e65203512821b1f0f208fafd51186698dff
Opcode Fuzzy Hash: 07f5c84af1c3563e269ba96771fcd393400f92954fe9b7a74a9dc8fe6bc4f900
Instruction Fuzzy Hash: ED21E4B5900349DFCB10DF9AC884BDEFBF4FB08310F50842AE918A7250D378A954CBA5

Function 022F0578 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,022F0DCC), ref: 022F14B3

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ae5a28e08f93101b226649b08ffb1d24239242b1710d8448f10e0e711b70dabc
Instruction ID: 73544bd4d3388fbbf2cbbc1a69642fc441f9126a921b9d48f06016a2604f09c7
Opcode Fuzzy Hash: ae5a28e08f93101b226649b08ffb1d24239242b1710d8448f10e0e711b70dabc
Instruction Fuzzy Hash: E51123B5D106498FCB10DF9AC944BEEFBF8FB88320F548029E518A3200D378A545CFA1

Function 022F0554 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,022F0DCC), ref: 022F14B3

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2fc0a2aed4859a6399894ae0d496480ee632b7d8014aa7e1261d9c95be951632
Instruction ID: b4f33706f326897259beca470b33052646a4c3ffd0d945bdc4b93dd0075c5730
Opcode Fuzzy Hash: 2fc0a2aed4859a6399894ae0d496480ee632b7d8014aa7e1261d9c95be951632
Instruction Fuzzy Hash: D31112B59106498FCB10DF9AC944BEEFBF8EB88320F548069E518A7200D378A545CFA1

Function 022F14F8 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,022F0E0A,?,00000004,?), ref: 022F1571

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b0ab6657a07ac75bf4a0ff5275a3dd46bcbbfb1c84b46dd2351ea9ada97ea13c
Instruction ID: 26dd7ebd18df6300faf8b5304977f6e8fedd7b15ca39fafab9cfe519adc7373c
Opcode Fuzzy Hash: b0ab6657a07ac75bf4a0ff5275a3dd46bcbbfb1c84b46dd2351ea9ada97ea13c
Instruction Fuzzy Hash: 1B21E4B5C012499FDB10CF9AD885ADEFBF4FB48310F10856AE958A3251C3789544CFA5

Function 022F1443 Relevance: 1.6, APIs: 1, Instructions: 55
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,022F0DCC), ref: 022F14B3

Memory Dump Source

Source File: 00000000.00000002.2061584689.00000000022F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22f0000_MAdjnpU2Xp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a2f5f6f8e3604fe64b381cac476f2bd8a66c55446f65276acc27efd7730b4e30
Instruction ID: 29ee85bf6ddfcbf0a38a50dbcc6ccd0fbbd49f84e7ca47fa45258e70ee10a134
Opcode Fuzzy Hash: a2f5f6f8e3604fe64b381cac476f2bd8a66c55446f65276acc27efd7730b4e30
Instruction Fuzzy Hash: E01112B6D042498FDB10CFAAC884BEEFBF4AB88210F14816AD458A3241D3789545CFA1

Analysis Process: RegAsm.exePID: 6660, Parent PID: 6104COMMON

Executed Functions

Function 01585CF0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ceba6f55af4677ee64f4fe4040f988fdc44f2ad472a40c15342382e9dac8133
Instruction ID: 14cc417e3aa135af9240472b69557e3ad9fd5a80f877a6af203074548c23d9c5
Opcode Fuzzy Hash: 3ceba6f55af4677ee64f4fe4040f988fdc44f2ad472a40c15342382e9dac8133
Instruction Fuzzy Hash: F9B14C70E10209CFDF14DFA9C98579EBBF2BF88314F148529E815BB294EB749846CB85

Function 015865C0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74afd6ff2cacbddea4287fd5e64fb93add4c26b1ff195cba4df78a1953c81bf4
Instruction ID: de45a67596f71bfa202fb772b79acb245ec357a5a2db083e1a372b1889acaee3
Opcode Fuzzy Hash: 74afd6ff2cacbddea4287fd5e64fb93add4c26b1ff195cba4df78a1953c81bf4
Instruction Fuzzy Hash: E6B12AB0E102098FDF14EFA9D9857ADBBF2BF88314F148529D419BB254EB749885CB81

Function 01581727 Relevance: 5.4, Strings: 4, Instructions: 442COMMON

Download Yara Rule

Strings

,, xrefs: 01581870
xaq, xrefs: 01581D76
a]q, xrefs: 01581CDF
a]q, xrefs: 01581D3C

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: a]q$ a]q$,$xaq
API String ID: 0-452644037
Opcode ID: 33561871381e650c006b47982b52de5486b0a9827010f833d1aeb43446de94ca
Instruction ID: cff78d03bf56ec73adff465cfb1f3998709ce31bf33970feb84bf1bc80295262
Opcode Fuzzy Hash: 33561871381e650c006b47982b52de5486b0a9827010f833d1aeb43446de94ca
Instruction Fuzzy Hash: 0B027B707002059FD714AF68D494B2E7BE6FF88315F248969D406AF3A9DBB89C46CB81

Function 01581962 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

xaq, xrefs: 01581D76
a]q, xrefs: 01581CDF
a]q, xrefs: 01581D3C

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: a]q$ a]q$xaq
API String ID: 0-315583803
Opcode ID: cda3ce86e48ef2c2bfba03df9d4c1b231d9d5fcf122c651a6fac6ae6d282788c
Instruction ID: 4575408b52e89086a2301d51ca7fc9fb013c79a0224c47219eda44ac611cd346
Opcode Fuzzy Hash: cda3ce86e48ef2c2bfba03df9d4c1b231d9d5fcf122c651a6fac6ae6d282788c
Instruction Fuzzy Hash: 9561AA707402018FD714AF29D484B2E7BE6FF89704F158929D506AF3A8DBB59C4ACB80

Function 01589EE0 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

xaq, xrefs: 0158A226
+, xrefs: 0158A0FE

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: xaq$+
API String ID: 0-1432214038
Opcode ID: 9c5c3b966ccc079691b26a80a3d3439ef089689c509e0ff03da45da78c6fcb06
Instruction ID: 89746ab5fbe258c5ff5323bf3c6010d23543e5385e2a3c50bd3cfddccfc31a8b
Opcode Fuzzy Hash: 9c5c3b966ccc079691b26a80a3d3439ef089689c509e0ff03da45da78c6fcb06
Instruction Fuzzy Hash: 18918A70502201CFD739EF2CE4047183FE1B785719F9E852ACA819BAA8D7B59A45CF92

Function 01580EBA Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

Te]q, xrefs: 01580EED
(aq, xrefs: 01581192

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$Te]q
API String ID: 0-2961548996
Opcode ID: 2beb31f4506fd48b3a688a56b2738665879264bfb70ea91e65f5130ad5c2e8c2
Instruction ID: 08ee58e532eee721df6f3d2cfd31268b757b3a4323d1f2187d932c2dec516d34
Opcode Fuzzy Hash: 2beb31f4506fd48b3a688a56b2738665879264bfb70ea91e65f5130ad5c2e8c2
Instruction Fuzzy Hash: BA517F70B505158FCB54EF69C494A9DBBF2FF89710F2581AAE406EB3A5CA75DC02CB80

Function 01580D20 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

dLcq, xrefs: 01580D5B
Haq, xrefs: 01580E40

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: ac4bf95799c07a03c376ed8d5e490968374dcd3e3794769edcf95ec5726d62e6
Instruction ID: db98d729e04741465ab09a8f853d2796ff77dce3fecdfa927146ec5b4dbd3a16
Opcode Fuzzy Hash: ac4bf95799c07a03c376ed8d5e490968374dcd3e3794769edcf95ec5726d62e6
Instruction Fuzzy Hash: DB51B0307042048FDB189F69D494AAEBBF6FF89310F1585AAE405EB3A1CB759C05CB90

Function 01589278 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$]q, xrefs: 015892B7
$]q, xrefs: 015892AD

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1c567b754fb346e20d29d1db9038c71cee91b4aa1b07eb923dce4b85e1c7ab3b
Instruction ID: b093ca36e746b6984de5cd364074ed444df56e8b33cce6e128a4e31a8a2b6755
Opcode Fuzzy Hash: 1c567b754fb346e20d29d1db9038c71cee91b4aa1b07eb923dce4b85e1c7ab3b
Instruction Fuzzy Hash: 55418C34708401DBC3296F6A908843DBBB7BFC47093689858E156AB798CF329C53CB95

Function 0158899D Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01588CED

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: d4377f1f39367df415e6551dc7e2fc6e6a1c6b3581428787ab1e08e2837f7532
Instruction ID: 4250e5eb0d8bd00822cc34216f11130de5e5aac5186d7b19ac2c401d939cfdfe
Opcode Fuzzy Hash: d4377f1f39367df415e6551dc7e2fc6e6a1c6b3581428787ab1e08e2837f7532
Instruction Fuzzy Hash: A211A170B052919FC745EB7888117AE3BF1FFAA200F54419ED045EF2A2E7745D018791

Function 01582DA8 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

./\, xrefs: 01582DD8, 01582FD4

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: ./\
API String ID: 0-3176372042
Opcode ID: 977287aaeb2d8aa63e21246344f6dc8c5dfa41edc86e8770b2691a33b6892d01
Instruction ID: 119377cb5223955075974c009060294b8d66ac918ec0b009fd55004ee188fba0
Opcode Fuzzy Hash: 977287aaeb2d8aa63e21246344f6dc8c5dfa41edc86e8770b2691a33b6892d01
Instruction Fuzzy Hash: FF91BE30A002058FCB16EF68C5805AEBFF2FF85310F1585AAD419AF296DB34EC46CB91

Function 01589BB8 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Te]q, xrefs: 01589C56

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: a015ee6b85eb51e6110f563d4759ac3b1c20dd3a3336345908756347939ab1b9
Instruction ID: 0abecb80a52fc1b3c518f71434cd905042b768f6106273ccd5d082a2b83abf58
Opcode Fuzzy Hash: a015ee6b85eb51e6110f563d4759ac3b1c20dd3a3336345908756347939ab1b9
Instruction Fuzzy Hash: 32517A706402019FE714EF29C954BA9BBF6FF88719F208159E502AB3E1CBB1AC41CF40

Function 01581339 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

LR]q, xrefs: 0158138B

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 0f4df5e4b3b2d2c9644017263d25a2f9e899af7c99d0b93301020c110b08b4b1
Instruction ID: 6060edd68daf51e50b0d05656678a86d0be2c2bf9ccfc936b2f95dd58f5bd50f
Opcode Fuzzy Hash: 0f4df5e4b3b2d2c9644017263d25a2f9e899af7c99d0b93301020c110b08b4b1
Instruction Fuzzy Hash: B0310334F002168FCB14AB7D949056E7BF6FFC9220B14456ED54AEB3A5DE34CC028792

Function 01589261 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

$]q, xrefs: 015892AD

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 9cb2d7f15cde37f2d44c06a9be3c774f86ebf0ebcbc452e92d6993541979052f
Instruction ID: d51d884ec2bbf35c6c30433f2f9850b1bdb2bf98177de50345af0c8b7c3a4c0d
Opcode Fuzzy Hash: 9cb2d7f15cde37f2d44c06a9be3c774f86ebf0ebcbc452e92d6993541979052f
Instruction Fuzzy Hash: 8341AE30708541DBC72A2F69908443CBFB3BFC57093288889E086AF699CF318D53CB92

Function 01580D10 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

dLcq, xrefs: 01580D5B

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: d66a617647581d08379c906df901be50574dc9c41664857d728ca69a2c0c5ba1
Instruction ID: 39404d327812d12ab539c35ceafcd65c3806490650c5f01c987b5e181a4d1f32
Opcode Fuzzy Hash: d66a617647581d08379c906df901be50574dc9c41664857d728ca69a2c0c5ba1
Instruction Fuzzy Hash: 56318171A002048FDB14DF69C454BAEBBF5FF88300F14856AE405AB3A1C775ED45CB90

Function 01589183 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Te]q, xrefs: 015891AA

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 92cac8faf69437572cb2bdbd80735eaed274aed20db68d0ef2a42b0556f9afe6
Instruction ID: ec2f5108e86b1d45a2ba6a14e1cdab655b2289d54d73971e1e3c7a3fde66210d
Opcode Fuzzy Hash: 92cac8faf69437572cb2bdbd80735eaed274aed20db68d0ef2a42b0556f9afe6
Instruction Fuzzy Hash: C42189317101158FDB14AB68C828BAD7BF2BF89704F154099E502EB3A0CBB08C01CB51

Function 01589190 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Te]q, xrefs: 015891AA

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: dded48561681a5327695419c863c88dc83638b790bffcfb09bd0985dd52c1428
Instruction ID: add4cb5ce7e3011a2b69f48ea39ec61b7604e249c291746b2ff7e4566017f8fe
Opcode Fuzzy Hash: dded48561681a5327695419c863c88dc83638b790bffcfb09bd0985dd52c1428
Instruction Fuzzy Hash: 982156317101158FDB14AB68C868BAE7BF6BFC8B14F21815AE502EB3A1CF718C058B91

Function 01583321 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

|, xrefs: 01583380

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: f2c3c1faf30e601ff7a44d5cf19e7ae8300f61083590b0427c587c6e8adbf310
Instruction ID: ec9293562d70cb36069963b1206998e49da52f39c13a9ac108f744e820620e7c
Opcode Fuzzy Hash: f2c3c1faf30e601ff7a44d5cf19e7ae8300f61083590b0427c587c6e8adbf310
Instruction Fuzzy Hash: 3A219071F442259FCB54EB7888547AD7BF1BF48710F1084AAE50AEB3A5DB749901CB81

Function 01589697 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Te]q, xrefs: 015896C3

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 08646bce49e55bee4ca33eefb62a0937a3735f752a6a8536b840cf5a21487e21
Instruction ID: 3c8027ddb86ac951fa808d13abced2b212493c3059b75e4d4953ed85a367971e
Opcode Fuzzy Hash: 08646bce49e55bee4ca33eefb62a0937a3735f752a6a8536b840cf5a21487e21
Instruction Fuzzy Hash: 47119070B502049FDB14AF29C899B6EBFE6BF89710F14405AE502EF3A6CA719C01CB91

Function 0158887F Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

4']q, xrefs: 01588851

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 19081e74b40582268b39cbf29bdb463f3478500330a11a897c9f250f8e2ba060
Instruction ID: 2fc8181962c5644896f5a08d182a0e32c8a6633ac76d84687a6ea10897aa3952
Opcode Fuzzy Hash: 19081e74b40582268b39cbf29bdb463f3478500330a11a897c9f250f8e2ba060
Instruction Fuzzy Hash: 96110132B0100A8FCB09EF74F8815EC3FA4FF96604B4015D9D584AF366DB3A9C068B82

Function 015896A8 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Te]q, xrefs: 015896C3

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 30d7f0e92c5fbaa6226e8fa35833259f1f6aa929e73ae967fa7ed002f8b1ad47
Instruction ID: 0d1f2f2e27bcf89d7b608aa4e144ea70145d5df443905ce1f89093befefdf491
Opcode Fuzzy Hash: 30d7f0e92c5fbaa6226e8fa35833259f1f6aa929e73ae967fa7ed002f8b1ad47
Instruction Fuzzy Hash: 96118C70B50105DFDB14AF29C899BAEBBE6FF88710F144059E902EF3A5CAB19C01CB90

Function 0158A6A1 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0158A6CD

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 2d7feb564dd8ff2335844bbd34cfb9f291e5b823c1faca04b0ac37bd9fbf3aba
Instruction ID: bb49b81df3747f622890b8415f00a8cb5ea591be4389687b8d7f05285cd0a9c3
Opcode Fuzzy Hash: 2d7feb564dd8ff2335844bbd34cfb9f291e5b823c1faca04b0ac37bd9fbf3aba
Instruction Fuzzy Hash: D711A3357102009FCB25AB68C869BAD7BF2BF89700F5540A9E502EB7A1CB715D02CB91

Function 01580E3F Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Haq, xrefs: 01580E40

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 93039f01f7dcaa0217c82732b3dcc6939fad39b2a6a7d10da2a626ac11c217ef
Instruction ID: 23525048842e5541e036cf1f01fb8e69e512cb2b50f4ecf02ea52127007f8219
Opcode Fuzzy Hash: 93039f01f7dcaa0217c82732b3dcc6939fad39b2a6a7d10da2a626ac11c217ef
Instruction Fuzzy Hash: E901DC307482504FC7899B3D94544AE3FE2AFDA22035A88FBD009CF7A6CE288C068391

Function 01588CD8 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01588CED

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: d4328b67bf065325a16a4c5caae6d4d9bb4e1a2d3846d9b5b8ee944e4d09a545
Instruction ID: 3d8b9926f49cc13abb3cc60e938be2c21acbf14ac44ba605091398da9e2536c3
Opcode Fuzzy Hash: d4328b67bf065325a16a4c5caae6d4d9bb4e1a2d3846d9b5b8ee944e4d09a545
Instruction Fuzzy Hash: B9016971B001169FCB44EFB8D9016AE77F5FB98610F5040A9E50AEF290EA70AE018BD1

Function 01585CE4 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2485ca628a65fce5bc3a3299effb206e7198f38ff9db2bb3c9122bd72854b400
Instruction ID: eedc7863698020a1232f9fe6ae8613fd412bd9affa4fe0570199e195dd06d861
Opcode Fuzzy Hash: 2485ca628a65fce5bc3a3299effb206e7198f38ff9db2bb3c9122bd72854b400
Instruction Fuzzy Hash: 33B14C70E10209CFDB11DFA9C98579EBBF2BF88314F148129D815BB294EB749846CF85

Function 015865B7 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852d13013fbce70f95b4832d0d5dcc73b2fefb9f888e74c59623a87806711394
Instruction ID: 353c728cda589df702b72003d2aceb701d63cced1c3ec96c930a80395d867266
Opcode Fuzzy Hash: 852d13013fbce70f95b4832d0d5dcc73b2fefb9f888e74c59623a87806711394
Instruction Fuzzy Hash: 78B139B0E10209CFDF10EFA9D98579DBBF2BF88314F148529D819BB254EB749885CB81

Function 0158A2D8 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795ff8bbb446f2a59f863e3bf82510753f50aa6802f2997c269d043f400afc6a
Instruction ID: 687fe417555be1a12f61af628110f56a715140da15e87fde659949b6aad59ddd
Opcode Fuzzy Hash: 795ff8bbb446f2a59f863e3bf82510753f50aa6802f2997c269d043f400afc6a
Instruction Fuzzy Hash: 8BA17B70B012068FCB19EF35E450A6E7BE6FFC9305F14856AD806AB365DB399C46CB81

Function 01582A20 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6f9d8b25687b7aa8dda4d7f7fb932e014f4fe7c4d763af739d368d3e92dfa7
Instruction ID: 63c85f96be57681eadcb5d68c11d475488afd4fe57c0d250392f4eabd023433c
Opcode Fuzzy Hash: 0f6f9d8b25687b7aa8dda4d7f7fb932e014f4fe7c4d763af739d368d3e92dfa7
Instruction Fuzzy Hash: C3A18E706002418FDB05EF30E444A6E7FBAFF89311F218669D5068B36ADB399D4ACF81

Function 01582A30 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b616fe669153798b59fd65bf6813d413da53b50441116eda2b6b2f87d0342d
Instruction ID: 4a15e2406ad8b28d3b933b7ebc05eb75b02099245b12b9ca72a624a59eeb4206
Opcode Fuzzy Hash: 88b616fe669153798b59fd65bf6813d413da53b50441116eda2b6b2f87d0342d
Instruction Fuzzy Hash: 58A16D746002419FDB05EF30E444A2E7BBAFF89315F218669D5068B36ADB399D4ACFC1

Function 0158942B Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33d0b5e870a3f18d6f960cc1069307447e893ee37e66bc7c35ff4a74c76013f
Instruction ID: 6b836006fb609f2af94de680233453e51055f1ea48800259d0340a5e9c3f91ea
Opcode Fuzzy Hash: a33d0b5e870a3f18d6f960cc1069307447e893ee37e66bc7c35ff4a74c76013f
Instruction Fuzzy Hash: A8518C74604255DFCB15EF68C884A6EBBB2FF89315F5580A5E446AF3A6C730EC01CB60

Function 015837F8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01707fd44729aeffeae27aca1b5eb66e2789465e9a494165009465d36bb7556
Instruction ID: 3051dab6944f772244ba758088619bfb15f173027fefef945903e3a1c4c82e4a
Opcode Fuzzy Hash: d01707fd44729aeffeae27aca1b5eb66e2789465e9a494165009465d36bb7556
Instruction Fuzzy Hash: F4419171B042448FCB24EFB9D4546AEBBE6BFD9710F14882DD50AAB354CF349846CB91

Function 01580AA0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976c404456484f1c4606545ce2750224b9490e9c8428dbe673ca5ec1850bef81
Instruction ID: 6688c07e36afdac35a4ff210cb9ad0c1464b61d9e66010777d6ab82afec87940
Opcode Fuzzy Hash: 976c404456484f1c4606545ce2750224b9490e9c8428dbe673ca5ec1850bef81
Instruction Fuzzy Hash: 3451A330600205CFD719DF28F5449697B6AFF88306F91E669D805CB269EB3DAD46CF80

Function 015811D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec1179f857bda1743e4a5dadda25c2ca80ceddfe121a725191805e0a633a442
Instruction ID: 225b37749135d0eb9da658ae6171f2be1a2d248b177339c70687cc41ac750d79
Opcode Fuzzy Hash: fec1179f857bda1743e4a5dadda25c2ca80ceddfe121a725191805e0a633a442
Instruction Fuzzy Hash: 4F41A2B0E00209AFCB44EFBAC54466EBFFAFF89300F20856AD449D7355DA349D428B91

Function 01584207 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dacbdda2f0d49b3b1ff1aa9d0584e77d2cb162c87211b4aba8e6e1f762d76c6
Instruction ID: f4e3422ed19220dc5b8c052687431ead13b8d21dddb7789c141cc22e9b6d7b01
Opcode Fuzzy Hash: 8dacbdda2f0d49b3b1ff1aa9d0584e77d2cb162c87211b4aba8e6e1f762d76c6
Instruction Fuzzy Hash: 3A41F2B1D00349DFDB14DFA9C480ADEBFB1FF48314F248429E809AB254DB75A985CB90

Function 01584210 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af1157a8a6c5795c18b4aa87321bda08cf6d8888ecdd404485a1102c2759a63
Instruction ID: cb74ce6acf2b68a4495b6c23ca891b574afd264cdbc5beec595a674132c3d1b8
Opcode Fuzzy Hash: 3af1157a8a6c5795c18b4aa87321bda08cf6d8888ecdd404485a1102c2759a63
Instruction Fuzzy Hash: 3A41EEB0D00349DFDB14DF99C584ADEBFB5BF48314F24842AE809AB214DB75A985CB90

Function 01580998 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12119858a76540700e43c17bf2ab3d9999d87bea44a4cd570196e26cc139b96
Instruction ID: 96c28e338014d689f2a88fe345bc22805ed595c8c8c13d9b23f7c749d37c96af
Opcode Fuzzy Hash: f12119858a76540700e43c17bf2ab3d9999d87bea44a4cd570196e26cc139b96
Instruction Fuzzy Hash: 5921A1307442029FEB64BB78D50867EBFA4BF44301B469A2DB807EE1D1EBB4C948CB51

Function 0149D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3303865747.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_149d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4229d43b0682718a5ef64255c669aa34d820e5b9240625bced4ea4544fbe23
Instruction ID: 7e14770a905bdc18f932ce96f340a695067afa8a9e92582acb3a199c3d3044da
Opcode Fuzzy Hash: ab4229d43b0682718a5ef64255c669aa34d820e5b9240625bced4ea4544fbe23
Instruction Fuzzy Hash: 4D210371944240DFDF06DF98D9C0B27BF65FB88328F24C56AD9090A326C33AD456CBA2

Function 01588FF3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861a105184caa6ca48aa0c4234b8a639fb2c26a32cdd14c9d459aef8c389858
Instruction ID: f2157287ef19a96b9091eeacc8155ff7d8be930dabc20187013a5f252e7f941e
Opcode Fuzzy Hash: d861a105184caa6ca48aa0c4234b8a639fb2c26a32cdd14c9d459aef8c389858
Instruction Fuzzy Hash: 08212730600215CFDB19EBB8D4546BE7BF6FF89709F144468C402AB364DB359C42DB92

Function 015809A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e7b8733d70cb3aecc7a20e2412600d5df91b5ac49858e48780d6483b7b0c24
Instruction ID: ab22bf450a3eb3a8728572b7966c9e425c590d263ef72cadb54470b2fbae4ff7
Opcode Fuzzy Hash: c6e7b8733d70cb3aecc7a20e2412600d5df91b5ac49858e48780d6483b7b0c24
Instruction Fuzzy Hash: 2921A1307002039FEB64BB78E51863EBFA8BF04201B454639B907EE1D1EBB0C908CB52

Function 0158A2CB Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab27bf2725d204c50c89def10285ff0c5ebca7c4b15960c9541c5164aa1d7b5
Instruction ID: 618554e661df3022e1037c11792c6d13f9caa5270296858671be22f8cde6257e
Opcode Fuzzy Hash: 2ab27bf2725d204c50c89def10285ff0c5ebca7c4b15960c9541c5164aa1d7b5
Instruction Fuzzy Hash: 051101317002014BCB19AB79E85056E7BEAEFCD614F00857AC906DB359EF359D0687D2

Function 01589E00 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229af2962756e3f44a60b1b4e2a006e12915b13729c783de24e80b57c9ccbe40
Instruction ID: 3f71dbe9f760649691359d3ad2e3479579bd67a56924492bdbd8c2c7b2b0aa92
Opcode Fuzzy Hash: 229af2962756e3f44a60b1b4e2a006e12915b13729c783de24e80b57c9ccbe40
Instruction Fuzzy Hash: 9721A1B1A002464FCB05FF34E400AAE7FA5EFD6214F5486AAC0069F255EB359906CBD1

Function 01581431 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccd16b43fd746c4792c88c8c58fb04e6dcd88b989c57e13d5e67d2eb8035352
Instruction ID: 030c403d3a6c5937f49adc793209e8a644bddb2ea78484fd9a151b1c7258a7de
Opcode Fuzzy Hash: cccd16b43fd746c4792c88c8c58fb04e6dcd88b989c57e13d5e67d2eb8035352
Instruction Fuzzy Hash: 83118870A00215CFCB54EB78D44456E7BE6FF88312B1249B9D405DB220EB398C52CB80

Function 0149D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3303865747.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_149d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: 70b24f61fd7c38717d20403abe4c2cf495b4d59e4266d8ec57324a09feba19bb
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: 2311B176904280CFDF16CF58D9C4B16BF61FB84324F24C5AAD9094B627C336D45ACBA2

Function 01581440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4404a21fe7e1cd28b2227ca5583ea96b1782a5a34e99cdd30b40482cd13c57aa
Instruction ID: ba7891d60ee594cfe7da9790fec755e7458e9f789bd6124a7b40988efdefa13b
Opcode Fuzzy Hash: 4404a21fe7e1cd28b2227ca5583ea96b1782a5a34e99cdd30b40482cd13c57aa
Instruction Fuzzy Hash: 23117970A002059FCB54EBBDD44462A7BEAFF88206B1048B8D50ADB364EA349C42CB90

Function 01589E10 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a5efbf08cf19412fff1fb1faa4b8db66e1ad1f0e24b356c156ce9bd92be6ec
Instruction ID: 7f74364806ee5cea8e0a27c7b6185f0847a05beb08602bcd1a01da4186fd8cdf
Opcode Fuzzy Hash: c7a5efbf08cf19412fff1fb1faa4b8db66e1ad1f0e24b356c156ce9bd92be6ec
Instruction Fuzzy Hash: B8118FB06002068FCB44FF39E400AAE7FA9FFD5314F508669C105AF295EB75990ACBD5

Function 015837E9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eaa05c00bf397dfb99bcf6bf7ceaf6362b49b5a317f188dfcaf1f36a5bd9d8c
Instruction ID: 7cede44a9f7edd7d42d95fedde26e2e3e7bb8d9cd969c5908ea9fd8108f62b1a
Opcode Fuzzy Hash: 3eaa05c00bf397dfb99bcf6bf7ceaf6362b49b5a317f188dfcaf1f36a5bd9d8c
Instruction Fuzzy Hash: 8301C0303092808BC726B63895A423D7BD7BFC6250B04457DD006CB352CF74CC46D742

Function 01588D60 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9bcf9bcfd1c86956fc412a6d9ee45b7766ac84945b6fe8967cd8bedd0fc68c
Instruction ID: 86045f393fc3b217563c87aba4d82dc6e9edc20b93dac5a3695688f2b34ae33f
Opcode Fuzzy Hash: ac9bcf9bcfd1c86956fc412a6d9ee45b7766ac84945b6fe8967cd8bedd0fc68c
Instruction Fuzzy Hash: F71100B58002498FDB20DF9AD984BDEBFF4EB09324F208819D529B7210C778A584CFA1

Function 01588D68 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc3e87b9fc90ab1d995eb7e898538359035698e4b6f9593b0aacae305bffb8f
Instruction ID: 57e78495271dec08adab72edad1ffdcfacc7fdf1c1c4d3aac140aa1f9dec6de3
Opcode Fuzzy Hash: 5cc3e87b9fc90ab1d995eb7e898538359035698e4b6f9593b0aacae305bffb8f
Instruction Fuzzy Hash: 69110DB58002498FDB20DF9AC584B9EBBF4EB08324F20881AD519B7210C378A984CFA1

Function 01589D56 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2010c54623210f356ba8246fe9e120a60e905871f014a669779bb4252dde15f
Instruction ID: 08ef342f2c67d032dd3e04605bc82eb391bd22be1a96c168f52b02836420c35e
Opcode Fuzzy Hash: a2010c54623210f356ba8246fe9e120a60e905871f014a669779bb4252dde15f
Instruction Fuzzy Hash: A5F0EC79A45107AFD701BF11C911ABD3BB4BF9660DF541446D052FF263D7348801CB65

Function 01589E6B Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570ba49b27884f325106765c6993b9771ae4e7a020e04d2f905076aad0fbf295
Instruction ID: 1662505fb015cf067f9bb67525c4d1039b27b8103f52b2f7260be9b4b8fad299
Opcode Fuzzy Hash: 570ba49b27884f325106765c6993b9771ae4e7a020e04d2f905076aad0fbf295
Instruction Fuzzy Hash: 45F0A7712041478ACF04FB30E4046AD7B91FFD1355F648759C1111F295DB759517CBC5

Function 015825F1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac5ca0df61453493b502174df01e9019105b3356a3fdd6f54d115d7a1873106
Instruction ID: 01a5c4299c980012bb38e0211e2a66465bd41b4957514958ecb27267b66f8c85
Opcode Fuzzy Hash: 9ac5ca0df61453493b502174df01e9019105b3356a3fdd6f54d115d7a1873106
Instruction Fuzzy Hash: 24F0157150E3C18FC3039F34C861810BF74BE6720574A40CBD481CF2B3D22A9819DB22

Function 01580E80 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9109c44fa679e2a89fedf15a0f4cbf2a4ba1d02a7aa2ad8ee5f86d555a75ca44
Instruction ID: 9bb51ec321515a79b7ebe347d2084f4a09c4f503399c1bb1fc1a147ba9ae35eb
Opcode Fuzzy Hash: 9109c44fa679e2a89fedf15a0f4cbf2a4ba1d02a7aa2ad8ee5f86d555a75ca44
Instruction Fuzzy Hash: FAE08C313001005F83449A2EA88485ABBDBEBC922535544BAE10DC7325CD60DC024790

Function 01580A73 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4835e3a36bb21f61ce502e068c7fa5be7962dfac5b8372b12e596ae384d670
Instruction ID: 749d59b7a19e2685bade873f468111acff5cebfccffd7e7b1ebe3537d6548207
Opcode Fuzzy Hash: ee4835e3a36bb21f61ce502e068c7fa5be7962dfac5b8372b12e596ae384d670
Instruction Fuzzy Hash: 5AC08C2211424ACEDB303374D20C66CBEA1BB40301F890616B1431C4FA8EF404088B1B

Function 01580A8F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deae0148b1796b3a8d017b047c3c8383414b660bc7f97861b17c490898a9349a
Instruction ID: b0a415ebf02e02f5ec57958e0433f6d19113341e74460ac83d035acda33faebf
Opcode Fuzzy Hash: deae0148b1796b3a8d017b047c3c8383414b660bc7f97861b17c490898a9349a
Instruction Fuzzy Hash: 30C08C26114207CED73033B4D20C66CBEA1BF40301F890612B1431C4FA8EF404088B1B

Function 01582600 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70a0165c991a4214281ceb308803981f595dc0176e12e8f3cb9891f2b239ac6
Instruction ID: 594ce7855cf9e0600e82d4add5b8400af3c6f6efbd893ffd15526bdcbbd1d4ea
Opcode Fuzzy Hash: c70a0165c991a4214281ceb308803981f595dc0176e12e8f3cb9891f2b239ac6
Instruction Fuzzy Hash: E9C048352602088F8244EA99E588C22B7ACFF58B02B415099E9018B722CB21FC10DA61

Non-executed Functions

Function 0158A878 Relevance: 1.0, Instructions: 1025COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578c99e5ab378aef8003e4e7e80b1d82a6b4821fbd7816178b3480ff9c9bbc5b
Instruction ID: c4dd58547a5ed5d81fe5a4d77f65392e24edef48566af2b6c24aca4be664e9b9
Opcode Fuzzy Hash: 578c99e5ab378aef8003e4e7e80b1d82a6b4821fbd7816178b3480ff9c9bbc5b
Instruction Fuzzy Hash: B9825A707002058FDB18EF69C994B2EBAE6FF84700F248869D5069B3A5DBB5DC0ACB51

Function 015859A8 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3304334051.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1580000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1da9ed059886779328fa0fabee30d2d67fdb17df19e0c1174b469908a5f77ae
Instruction ID: 6f909edd54eb6f768780ecb7701658bd6ac2543899f6704a937d9cf2ee399c3f
Opcode Fuzzy Hash: c1da9ed059886779328fa0fabee30d2d67fdb17df19e0c1174b469908a5f77ae
Instruction Fuzzy Hash: 0F915B70E102098FDF14DFA9C98179DBBF2BF88715F248529E419BB294EB749885CF81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MAdjnpU2Xp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MAdjnpU2Xp.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Suricata IDS Alerts

TCP Packets

DNS Answers

Windows Analysis Report
MAdjnpU2Xp.exe