Edit tour

Windows Analysis Report
250427-yfs7ca1my6.bin.exe

Overview

General Information

Sample name:	250427-yfs7ca1my6.bin.exe
Analysis ID:	1675615
MD5:	618432b575574e0a4c43eb072fdad14c
SHA1:	5e6b5c7dcc1ca567348facc468906e7c35a7ffd6
SHA256:	605eaaf66354b3d579e6d4c4abf886b6da88c1982b3ae096bb27cec15b959e05
Tags:	user-UNP4CK
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AsyncRAT

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Joe Sandbox ML detected suspicious sample

Protects its processes via BreakOnTermination flag

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

250427-yfs7ca1my6.bin.exe (PID: 8188 cmdline: "C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe" MD5: 618432B575574E0A4C43EB072FDAD14C)

cmd.exe (PID: 940 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7972 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 8084 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7904 cmdline: timeout 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

AntiVirus.exe (PID: 1488 cmdline: "C:\Users\user\AppData\Roaming\AntiVirus.exe" MD5: 618432B575574E0A4C43EB072FDAD14C)

AntiVirus.exe (PID: 7568 cmdline: C:\Users\user\AppData\Roaming\AntiVirus.exe MD5: 618432B575574E0A4C43EB072FDAD14C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.AsyncRAT as delivered by MintsLoader includes a PowerShell module with a DGA. The DGA is similar to MintsLoader's DGA, but generates more domains and uses more than one TLD.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/AsyncRAT/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
250427-yfs7ca1my6.bin.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
250427-yfs7ca1my6.bin.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa28f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6ec3:$a3: get_ActivatePong 0xa4a7:$a4: vmware 0xa31f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c95:$a6: get_SslClient
250427-yfs7ca1my6.bin.exe	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6ec3:$str01: get_ActivatePong 0x7c95:$str02: get_SslClient 0x7cb1:$str03: get_TcpClient 0x656c:$str04: get_SendSync 0x6625:$str05: get_IsConnected 0x6c97:$str06: set_UseShellExecute 0xa5c5:$str07: Pastebin 0xa647:$str08: Select * from AntivirusProduct 0xb638:$str09: Stub.exe 0xb6c8:$str09: Stub.exe 0xa39f:$str10: timeout 3 > NUL 0xa28f:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0xa31f:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
250427-yfs7ca1my6.bin.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa321:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\AntiVirus.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\AntiVirus.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa28f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6ec3:$a3: get_ActivatePong 0xa4a7:$a4: vmware 0xa31f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c95:$a6: get_SslClient
C:\Users\user\AppData\Roaming\AntiVirus.exe	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6ec3:$str01: get_ActivatePong 0x7c95:$str02: get_SslClient 0x7cb1:$str03: get_TcpClient 0x656c:$str04: get_SendSync 0x6625:$str05: get_IsConnected 0x6c97:$str06: set_UseShellExecute 0xa5c5:$str07: Pastebin 0xa647:$str08: Select * from AntivirusProduct 0xb638:$str09: Stub.exe 0xb6c8:$str09: Stub.exe 0xa39f:$str10: timeout 3 > NUL 0xa28f:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0xa31f:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
C:\Users\user\AppData\Roaming\AntiVirus.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa321:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa08f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xc238:$a2: Stub.exe 0xc2c8:$a2: Stub.exe 0x6cc3:$a3: get_ActivatePong 0xa2a7:$a4: vmware 0xa11f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7a95:$a6: get_SslClient
00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa121:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1c416:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x27466:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xafc7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xc370:$a2: Stub.exe 0xc400:$a2: Stub.exe 0x7bfb:$a3: get_ActivatePong 0xb1df:$a4: vmware 0xb057:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x89cd:$a6: get_SslClient
Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x139a8:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x208c3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2f897:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: AntiVirus.exe PID: 1488	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: AntiVirus.exe PID: 1488	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28edc:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa28f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6ec3:$a3: get_ActivatePong 0xa4a7:$a4: vmware 0xa31f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c95:$a6: get_SslClient
0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6ec3:$str01: get_ActivatePong 0x7c95:$str02: get_SslClient 0x7cb1:$str03: get_TcpClient 0x656c:$str04: get_SendSync 0x6625:$str05: get_IsConnected 0x6c97:$str06: set_UseShellExecute 0xa5c5:$str07: Pastebin 0xa647:$str08: Select * from AntivirusProduct 0xb638:$str09: Stub.exe 0xb6c8:$str09: Stub.exe 0xa39f:$str10: timeout 3 > NUL 0xa28f:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0xa31f:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa321:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x848f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x50c3:$a3: get_ActivatePong 0x86a7:$a4: vmware 0x851f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e95:$a6: get_SslClient
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x50c3:$str01: get_ActivatePong 0x5e95:$str02: get_SslClient 0x5eb1:$str03: get_TcpClient 0x476c:$str04: get_SendSync 0x4825:$str05: get_IsConnected 0x4e97:$str06: set_UseShellExecute 0x87c5:$str07: Pastebin 0x8847:$str08: Select * from AntivirusProduct 0x9838:$str09: Stub.exe 0x98c8:$str09: Stub.exe 0x859f:$str10: timeout 3 > NUL 0xb206:$str10: timeout 3 > NUL 0xb83c:$str10: timeout 3 > NUL 0x848f:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x851f:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x8521:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa28f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6ec3:$a3: get_ActivatePong 0xa4a7:$a4: vmware 0xa31f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c95:$a6: get_SslClient
0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6ec3:$str01: get_ActivatePong 0x7c95:$str02: get_SslClient 0x7cb1:$str03: get_TcpClient 0x656c:$str04: get_SendSync 0x6625:$str05: get_IsConnected 0x6c97:$str06: set_UseShellExecute 0xa5c5:$str07: Pastebin 0xa647:$str08: Select * from AntivirusProduct 0xb638:$str09: Stub.exe 0xb6c8:$str09: Stub.exe 0xa39f:$str10: timeout 3 > NUL 0xd006:$str10: timeout 3 > NUL 0xe43c:$str10: timeout 3 > NUL 0xa28f:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0xa31f:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe", ParentImage: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe, ParentProcessId: 8188, ParentProcessName: 250427-yfs7ca1my6.bin.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit, ProcessId: 940, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 940, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' , ProcessId: 7972, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• Operating System Destruction
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 250427-yfs7ca1my6.bin.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\AntiVirus.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\AntiVirus.exe

ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: 250427-yfs7ca1my6.bin.exe	Virustotal: Detection: 72%			Perma Link
Source: 250427-yfs7ca1my6.bin.exe	ReversingLabs: Detection: 83%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 97.7%

Sample uses string decryption to hide its real strings

Source: 250427-yfs7ca1my6.bin.exe	String decryptor: 23501,2410,8700
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: Alex3143-23501.portmap.io
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: 0.5.8
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: true
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: tbqoxBC1WYZB
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: MIIE8jCCAtqgAwIBAgIQAKXY0ifKY3bVsrJykzdgETANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwNDI1MTM0MjMyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM2njk4mtWKR1BbDD+8t8tP+fuWZZvNDHBiAa5bF/qN5K+TX89Ri8y7GY/IQAIJpANxxAy7jipOtSSSGDiiPPy6gaFEzBl6ekR3Q3xliT7K8llBQ1742R5tuNRQGhsG41ByfPiNm8Luat4DULTeR2ZBd1jqtZb5g2lMDn1NwQsIuXBauGZCXwDZjfao7pErbAt6PtBgB0NSBGu2Qw1iKqSKqyvAZCFEAHSCsQbnDD+2Wc37XmBHUxTTIhvhJdx3bMx1/5AWyoVQf4LxTivzwrpAOnXEXG6dD8H/5dQd9rJTiQCdsBeqBNy9tZFc8PqNlByFtZIWvRo39DncfczYaFotNgNJQvLTSx11Xl+P7wGee4GomHyxAREtawq/Xjg9vSJVYpsQwBMliTMwURNJz7UxLZ6owCMuN2Hh20QQZ9hldWBwSQ0/isoFxDVvUIE3RSVERNTwBSRybKeaoinYdIzUU1UccaoN7oxaKb+WdrI3G+JAN4gvStvKxlRdwHp0XYuKS02S/piv5NcaTspT/xl9s/Nes6hbCxAXv9t5OPedMkHZixvNR/Azh/hFEO3uSLxBVOIMun6l7W8RihCT2aQN+g2fEqSU1V46YLMMIwOipMDRZR0SnABJ6Vhrsg3IvJiqmxsJgNBt91Hvjp6lY5N6AYqswp14qBZ8Qno1CEEMLAgMBAAGjMjAwMB0GA1UdDgQWBBRUYo5XhwXxhdvkVT8MlDxABY+8ozAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCEgHThKuAtXHCLVfprlXLWkYVhNkCFiMZxkFbhGH7rsji06E7F/la3eorBhOns1hXjXCtAP88Gm1WoV6szB6/DVjvs3PNFRIKLbZ5nhcokqJpQMCEjFPvRcWOP5ajJ+sz5FGNog2iX6Zkmqq9ZSuo0oIdQoHwOvb1eWvRABzHU7uVEgWOqYU/SRM5spFEkJVos+JRKcokKV/YhNE2Xb+2FkhwV1SX/df9hF+NOGHWzjEc5tX+drFGXvCaBt69JFN02NGZRAyR7O/xraicuJONr18dG2VV09zhpKkyZBOyzF9ZrzZabAzpfRIWXAlKwhoyUfRkgBg32z3rSqwJh80w7pvBJXWXT9Pk7JD7UjvOdYxawMgstrOEk+3asH/WGXt3W/ok6dP1cubu90ujpORPUYSt4sqDbipjOyRZbxFOs76At+MXftpcHgh05dcbQwEe1gP599l0JMo7IT7zS7DPvz0MOKJy7GcUkbJguAGPPLnX6qukFrDNORIWUPV6vM3wpOixcCiibZjA3Av1lh88vQ/yvWubgQq2t0Fbl8KXB4NsGkioOa5IU153eOxRE9VtwL7f0HH5pEuvueJMmv8z+hsK4P3OwwyhaomZlrPBVuhbUJJnVBOis/sknkoRnOIhgxcuLfFQ0wygNfFukL1clrrSAJewZ0AotrHfdiI5jbQ==
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: pIZWs6DP4k4sHJMZpl0Qqj8EFKQI+jVkZrpfECiu+rH7quQFO3BVhYuU7wjuXaXqg6KXrXyJ6biadHo1TNHRENM5MWhlfNMiM977Bm56GZttRD8jw+1KS/bO0gyT03B/mFgbyDK3v1zclOMMswisv7hlQXCkAZwznWlLJVTY9FVHAI3cTRKskPNQTLRF39hXRPTMTjHehxDkp+874x6e1n/gs1EeT5EfbY4u03HqDwrUTF/yHGeqnVsUMPPkSEWP6UmUftfVfxqUeEyQB92cIY9v2IlOPgORAKUIBc2hZyOamwGk7gejcui/0bW/dXMyn1mW3pbdnQepkAAFX2ET5S07m2NeFogE8+GSD3Hrz8c9YlHZVvj/1BQaLkD6ZcXJgZWhVIN5vO1b4hrOWrveq3B4bpKpXzQEBw5M2MP+IWywUj2vTKILUjEeLRFUh2xMtXY/e3r5bPOg/4JO1O7/80dAThUfgKPLj2g91YivbZxf6LqaDz0ZWH+Ry0CaAwlCmO8sCnpCwrOfYmGnd8YWFdl0Rs5q+cIDXPYz7B9fRMmC97QSYH9AwCY9wJuQKl5AmuoZbLRfuNUTg9tiHB7TnvkE9h97tShQDg+Uksx3QDoC74Zx/ot9sugVmay9swNo1KcJrNHx1s5z22gyarytrjd8lpT0sCvGlVv4FA40TFs=
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: null
Source: 250427-yfs7ca1my6.bin.exe	String decryptor: Default
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: 23501,2410,8700
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: Alex3143-23501.portmap.io
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: 0.5.8
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: true
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: tbqoxBC1WYZB
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: MIIE8jCCAtqgAwIBAgIQAKXY0ifKY3bVsrJykzdgETANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjUwNDI1MTM0MjMyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM2njk4mtWKR1BbDD+8t8tP+fuWZZvNDHBiAa5bF/qN5K+TX89Ri8y7GY/IQAIJpANxxAy7jipOtSSSGDiiPPy6gaFEzBl6ekR3Q3xliT7K8llBQ1742R5tuNRQGhsG41ByfPiNm8Luat4DULTeR2ZBd1jqtZb5g2lMDn1NwQsIuXBauGZCXwDZjfao7pErbAt6PtBgB0NSBGu2Qw1iKqSKqyvAZCFEAHSCsQbnDD+2Wc37XmBHUxTTIhvhJdx3bMx1/5AWyoVQf4LxTivzwrpAOnXEXG6dD8H/5dQd9rJTiQCdsBeqBNy9tZFc8PqNlByFtZIWvRo39DncfczYaFotNgNJQvLTSx11Xl+P7wGee4GomHyxAREtawq/Xjg9vSJVYpsQwBMliTMwURNJz7UxLZ6owCMuN2Hh20QQZ9hldWBwSQ0/isoFxDVvUIE3RSVERNTwBSRybKeaoinYdIzUU1UccaoN7oxaKb+WdrI3G+JAN4gvStvKxlRdwHp0XYuKS02S/piv5NcaTspT/xl9s/Nes6hbCxAXv9t5OPedMkHZixvNR/Azh/hFEO3uSLxBVOIMun6l7W8RihCT2aQN+g2fEqSU1V46YLMMIwOipMDRZR0SnABJ6Vhrsg3IvJiqmxsJgNBt91Hvjp6lY5N6AYqswp14qBZ8Qno1CEEMLAgMBAAGjMjAwMB0GA1UdDgQWBBRUYo5XhwXxhdvkVT8MlDxABY+8ozAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCEgHThKuAtXHCLVfprlXLWkYVhNkCFiMZxkFbhGH7rsji06E7F/la3eorBhOns1hXjXCtAP88Gm1WoV6szB6/DVjvs3PNFRIKLbZ5nhcokqJpQMCEjFPvRcWOP5ajJ+sz5FGNog2iX6Zkmqq9ZSuo0oIdQoHwOvb1eWvRABzHU7uVEgWOqYU/SRM5spFEkJVos+JRKcokKV/YhNE2Xb+2FkhwV1SX/df9hF+NOGHWzjEc5tX+drFGXvCaBt69JFN02NGZRAyR7O/xraicuJONr18dG2VV09zhpKkyZBOyzF9ZrzZabAzpfRIWXAlKwhoyUfRkgBg32z3rSqwJh80w7pvBJXWXT9Pk7JD7UjvOdYxawMgstrOEk+3asH/WGXt3W/ok6dP1cubu90ujpORPUYSt4sqDbipjOyRZbxFOs76At+MXftpcHgh05dcbQwEe1gP599l0JMo7IT7zS7DPvz0MOKJy7GcUkbJguAGPPLnX6qukFrDNORIWUPV6vM3wpOixcCiibZjA3Av1lh88vQ/yvWubgQq2t0Fbl8KXB4NsGkioOa5IU153eOxRE9VtwL7f0HH5pEuvueJMmv8z+hsK4P3OwwyhaomZlrPBVuhbUJJnVBOis/sknkoRnOIhgxcuLfFQ0wygNfFukL1clrrSAJewZ0AotrHfdiI5jbQ==
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: pIZWs6DP4k4sHJMZpl0Qqj8EFKQI+jVkZrpfECiu+rH7quQFO3BVhYuU7wjuXaXqg6KXrXyJ6biadHo1TNHRENM5MWhlfNMiM977Bm56GZttRD8jw+1KS/bO0gyT03B/mFgbyDK3v1zclOMMswisv7hlQXCkAZwznWlLJVTY9FVHAI3cTRKskPNQTLRF39hXRPTMTjHehxDkp+874x6e1n/gs1EeT5EfbY4u03HqDwrUTF/yHGeqnVsUMPPkSEWP6UmUftfVfxqUeEyQB92cIY9v2IlOPgORAKUIBc2hZyOamwGk7gejcui/0bW/dXMyn1mW3pbdnQepkAAFX2ET5S07m2NeFogE8+GSD3Hrz8c9YlHZVvj/1BQaLkD6ZcXJgZWhVIN5vO1b4hrOWrveq3B4bpKpXzQEBw5M2MP+IWywUj2vTKILUjEeLRFUh2xMtXY/e3r5bPOg/4JO1O7/80dAThUfgKPLj2g91YivbZxf6LqaDz0ZWH+Ry0CaAwlCmO8sCnpCwrOfYmGnd8YWFdl0Rs5q+cIDXPYz7B9fRMmC97QSYH9AwCY9wJuQKl5AmuoZbLRfuNUTg9tiHB7TnvkE9h97tShQDg+Uksx3QDoC74Zx/ot9sugVmay9swNo1KcJrNHx1s5z22gyarytrjd8lpT0sCvGlVv4FA40TFs=
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: true
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: null
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: true
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack	String decryptor: Default

Source: 250427-yfs7ca1my6.bin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 250427-yfs7ca1my6.bin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: unknown

DNS traffic detected: query: Alex3143-23501.portmap.io replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: Alex3143-23501.portmap.io

Source: 250427-yfs7ca1my6.bin.exe, 00000000.00000002.1297211381.00000000029BD000.00000004.00000800.00020000.00000000.sdmp, AntiVirus.exe, 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE
Source: Yara match	File source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AntiVirus.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: 00 00 00 00			Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: 01 00 00 00			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: AntiVirus.exe PID: 1488, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Code function: 0_2_00CB4088	0_2_00CB4088
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Code function: 0_2_00CB4958	0_2_00CB4958
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Code function: 0_2_00CB5B20	0_2_00CB5B20
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Code function: 0_2_00CB3D40	0_2_00CB3D40
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Code function: 12_2_00C04088	12_2_00C04088
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Code function: 12_2_00C04958	12_2_00C04958
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Code function: 12_2_00C05B20	12_2_00C05B20
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Code function: 12_2_00C03D40	12_2_00C03D40

Source: 250427-yfs7ca1my6.bin.exe, 00000000.00000002.1306310769.0000000004CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 250427-yfs7ca1my6.bin.exe
Source: 250427-yfs7ca1my6.bin.exe, 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs 250427-yfs7ca1my6.bin.exe
Source: 250427-yfs7ca1my6.bin.exe, 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs 250427-yfs7ca1my6.bin.exe
Source: 250427-yfs7ca1my6.bin.exe	Binary or memory string: OriginalFilenameStub.exe" vs 250427-yfs7ca1my6.bin.exe

Source: 250427-yfs7ca1my6.bin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: AntiVirus.exe PID: 1488, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: 250427-yfs7ca1my6.bin.exe, gPUHtAYKRkPVh.cs	Base64 encoded string: '//IW+SJkVi7g0g/q+5TADjFADWJ0txhm/C2GN2XJYN/fH49wVKNtRfR4oItNqsPkvwTwl1pdAF3LYKtpeZPrGA==', 'py3Ucp/VtMmzcb0BtBdkau62G5CK8hp431UkXU9B+Hgo0I7HH0f37CtigBWxR8fBne6E61Vki+9QKN4Uj+uj0g==', 'ntbnLsvlfwdIkEzZrIXQVICn/2sNoKRrEa8110QF3L/4Ack2/RA4nVPEgjw1BLioUKGh0smew37pQy3FdjpR8w==', 'GZ/YqjguCItaoho4FTLFmvxSgG+0XKsr8A8m/NAox/lUfsCCwF21DnJNk51AASWenEy3SGySx18E+Vt4Il9g9PS7PKhxZx76epEAjS+vJqSVEhhtbW0UajEEVCLjeSpTY+DnJolWvcMJ1pJ193GP15lMjtYmhoJOlN8t9ty9kkhdFHLNsok480IRjk755MJHgn8ntAk2p3gKZDmftq0wPHRtp38EmK/IPQgv+YHOcty1iP4bbIGyWrlAXhkJ3C2ubl4KI+Zf+P9qzSpTeQAsEGwwgifLa5WPjKZZZmS/sunpJHxMTWzmAEMNgb8YMBv/8b8MGC1ow1WsM/8HKN4p1zrzKeqlZbCesmsVMn3A5U+FJVVDE3fWCdZvR4v9ZGveXeqFw21BopmkHse77tbfg1IcVJCaokQr4o1Y/bz+WHEmC6HoHgpOivlJGLfDuLT6VANnF9Lt5aYakyWtC/4TL38xQzqx33v8mmTntzzTqFEK3XvFoouizzF7XHk4YzLCTdC+inxRrE2Ud8jZPyCNVcQTA8cuuGlYkDwnCIWhT+bPcpA7T/4VDw+Zw59hI83I/RxokDUsa0s4wTwyt+1kgyALw0iMCTKUuqIGdC/NxPxZM7i0MPECLK6NZ9LPUk8zlPoLBK07U2GDerwveSfLQnJ3CtVwv2b7/5gJomJxfTjoGbUYQ/zOq9Pt5pFkGcSj01YcGl0nDZwzKN6ongljRHrDXUV4G+RPOmdc5cate+JDNVnVxUdMBesdjFKD8B3aeDCIJhFcI7lYXlSELR5mqNzpqISJ9+Oj8U7nSu8NgvCV5jMLT9tsW3LPY7cCVoB4Y62f2sl+VBamSrWC40Bchlm4zaWPPjfmOiRbcI7A5wanzIMTfKYvR7K76ps0K6ej1jTeueBx2QILCmNYRiwoXwA6DTaRGjGtqBtmZZjZzBzkmbjijq+5opPVpH39ebJyEavXrG+KR0/WlIpGu4UsJa1UP2n9WjKwZmyudRDGl7nf3gOSX1A9Lzi4Rcv0n70oosSVxoOKAPt91VTByHXt/HoOJuo/hw2o7Hx7txW368N3Cn0783B0VCORSEuKYqmX4MJto0E3QaEPGYyW8Dbod5uKlX7C5dMk42ZF+N1TZu8lehUv/uqwvXZtxYaaM6oM3/D8k+vwjycrI7Ytqpi7BXel9ilQ/gbpvtSkJ0VzCRjpFxTGPMrx/0WXGzoDe35Uk6rFzrm/PHWt1Bhn6CFGdp0PLKk7DKZC7cQ58RncqIFbQgmb3qGiOLJeaB07FtO3UMgTBzhUDUmfdX5JYJunpKP09AdqGDd9+dH+DzJcCSGTnr2V1quo5t57vEb2vHPsmWYfowlYMMBA1SXmxOpwgnyaVfvHmW1HulO7asU4Jbx0J5Ba1F9eq+rORUMWQV4YrinZiiFbq8fX9HoP98rpD9E1Mo8Xo5X/DjgpOzAnoTgzhA6V4XhU1iZjusdu4Fg/6taXdJVW7WsT5R6Xp2H9Po+O+t7SS53p/NbxuleNUYeK1yiGB+9TuA8eYZYZtoQQJWOoUy0D3RKm3OHYKGhf7RGEl2rZjtlx2WoW9xKfnN3J9oKLEKNXv6z143gOyWZx6wAInRfBh6jSqIxsOsNT5ynSmFkkrlhwnX9a14Yr4tBPh57HKEeHci6unTxL9bw9WZIl1kUtqVCO9rel6fWmgdkkoag1WrghuLcTdw9Oe0ukb9nZKglAAvXD6Ctuy1EM5VaGF/Lzb9WIYWZTVHJAQaOj93wPzXWpKSYkPRjFtuPYmDuV7Wszg/BiKt2y4KXvZaomnV4MRf7gLCtEc8IX7FAEilcvqQhXizqmUlz6pr9jyRo/fsVMfLl3X8ppDJOU0k2w4Eg+RzMF6DhKi/A18tNxkvQfKqzkCl12jI2243gLOIeCd6V/WWHT2JKQhS3CnrLbTNfTL5Bawl1RN4nhs36IhKGPyxb96m85Wfb72pjcS9bHyVRsJ4ttFVM9oRA3USadq0duAK4ry+nbBaY0vDmhSI350rdm+6FcOpNTQ5K5gFy44tgPsUzFxXxMNZ5Pkp1yFastG4uRviM9D48AyN6pG8lDdqEbnHXfARWXgK2rldX8necUrFRYcA8m979CbOou4Bed/f5eEelP1VSEO5+/fKqw2cHzDSkFj2m2FsqeA+VPHYv2I6oqTTkwTfpcz/r/3LpQ/+QhaqM6ocW/3F/+u/czZ1qZSDnV9v4uww/d+GXAnzY56KqCt9h5sTVgPkl3iTHEFiXt9DSx6qp777Euq/GRsIwm0jmo6YsnFdf4YXM5qLgX8wmdNkU9jDauQOjQRWXN48VWlgrd78LCEY+708xxVAD3888AhmA41HE=', 'LazTWHtJhMA7CpCYClTXAaSFQsRAbyG4ipGRcYP5xX0l/N7BCzHGxUoFltop4sqZmuRkd3HFzBc83Alk11bd2AH9+fl2aCpQNePpSF2cXny9rN27gi2+mDKWyK1u5D3tgyRPC9dhLVlZBBuZuaXkS8FIhIb/Li9GpASqcMw0B9FFJnTpvqCyf5d9uEq4cXxcolxl+6eqSezvJJvHMuzM+gfXjiYdImD0Ociwpx9nBCuI3A5bf2T5K+LQkhAHDC8F+l6T7zWdiqOTNxGahwbTGpyD5r5J+n8p8bJTtK71gN5nUAMbGUwwdWTnwr4nKjNr3r2NYGYcPDjoqObo3/HWIlKmkihRE+izTwKy7Ezb81JpP8qVJ+F
Source: AntiVirus.exe.0.dr, gPUHtAYKRkPVh.cs	Base64 encoded string: '//IW+SJkVi7g0g/q+5TADjFADWJ0txhm/C2GN2XJYN/fH49wVKNtRfR4oItNqsPkvwTwl1pdAF3LYKtpeZPrGA==', 'py3Ucp/VtMmzcb0BtBdkau62G5CK8hp431UkXU9B+Hgo0I7HH0f37CtigBWxR8fBne6E61Vki+9QKN4Uj+uj0g==', 'ntbnLsvlfwdIkEzZrIXQVICn/2sNoKRrEa8110QF3L/4Ack2/RA4nVPEgjw1BLioUKGh0smew37pQy3FdjpR8w==', 'GZ/YqjguCItaoho4FTLFmvxSgG+0XKsr8A8m/NAox/lUfsCCwF21DnJNk51AASWenEy3SGySx18E+Vt4Il9g9PS7PKhxZx76epEAjS+vJqSVEhhtbW0UajEEVCLjeSpTY+DnJolWvcMJ1pJ193GP15lMjtYmhoJOlN8t9ty9kkhdFHLNsok480IRjk755MJHgn8ntAk2p3gKZDmftq0wPHRtp38EmK/IPQgv+YHOcty1iP4bbIGyWrlAXhkJ3C2ubl4KI+Zf+P9qzSpTeQAsEGwwgifLa5WPjKZZZmS/sunpJHxMTWzmAEMNgb8YMBv/8b8MGC1ow1WsM/8HKN4p1zrzKeqlZbCesmsVMn3A5U+FJVVDE3fWCdZvR4v9ZGveXeqFw21BopmkHse77tbfg1IcVJCaokQr4o1Y/bz+WHEmC6HoHgpOivlJGLfDuLT6VANnF9Lt5aYakyWtC/4TL38xQzqx33v8mmTntzzTqFEK3XvFoouizzF7XHk4YzLCTdC+inxRrE2Ud8jZPyCNVcQTA8cuuGlYkDwnCIWhT+bPcpA7T/4VDw+Zw59hI83I/RxokDUsa0s4wTwyt+1kgyALw0iMCTKUuqIGdC/NxPxZM7i0MPECLK6NZ9LPUk8zlPoLBK07U2GDerwveSfLQnJ3CtVwv2b7/5gJomJxfTjoGbUYQ/zOq9Pt5pFkGcSj01YcGl0nDZwzKN6ongljRHrDXUV4G+RPOmdc5cate+JDNVnVxUdMBesdjFKD8B3aeDCIJhFcI7lYXlSELR5mqNzpqISJ9+Oj8U7nSu8NgvCV5jMLT9tsW3LPY7cCVoB4Y62f2sl+VBamSrWC40Bchlm4zaWPPjfmOiRbcI7A5wanzIMTfKYvR7K76ps0K6ej1jTeueBx2QILCmNYRiwoXwA6DTaRGjGtqBtmZZjZzBzkmbjijq+5opPVpH39ebJyEavXrG+KR0/WlIpGu4UsJa1UP2n9WjKwZmyudRDGl7nf3gOSX1A9Lzi4Rcv0n70oosSVxoOKAPt91VTByHXt/HoOJuo/hw2o7Hx7txW368N3Cn0783B0VCORSEuKYqmX4MJto0E3QaEPGYyW8Dbod5uKlX7C5dMk42ZF+N1TZu8lehUv/uqwvXZtxYaaM6oM3/D8k+vwjycrI7Ytqpi7BXel9ilQ/gbpvtSkJ0VzCRjpFxTGPMrx/0WXGzoDe35Uk6rFzrm/PHWt1Bhn6CFGdp0PLKk7DKZC7cQ58RncqIFbQgmb3qGiOLJeaB07FtO3UMgTBzhUDUmfdX5JYJunpKP09AdqGDd9+dH+DzJcCSGTnr2V1quo5t57vEb2vHPsmWYfowlYMMBA1SXmxOpwgnyaVfvHmW1HulO7asU4Jbx0J5Ba1F9eq+rORUMWQV4YrinZiiFbq8fX9HoP98rpD9E1Mo8Xo5X/DjgpOzAnoTgzhA6V4XhU1iZjusdu4Fg/6taXdJVW7WsT5R6Xp2H9Po+O+t7SS53p/NbxuleNUYeK1yiGB+9TuA8eYZYZtoQQJWOoUy0D3RKm3OHYKGhf7RGEl2rZjtlx2WoW9xKfnN3J9oKLEKNXv6z143gOyWZx6wAInRfBh6jSqIxsOsNT5ynSmFkkrlhwnX9a14Yr4tBPh57HKEeHci6unTxL9bw9WZIl1kUtqVCO9rel6fWmgdkkoag1WrghuLcTdw9Oe0ukb9nZKglAAvXD6Ctuy1EM5VaGF/Lzb9WIYWZTVHJAQaOj93wPzXWpKSYkPRjFtuPYmDuV7Wszg/BiKt2y4KXvZaomnV4MRf7gLCtEc8IX7FAEilcvqQhXizqmUlz6pr9jyRo/fsVMfLl3X8ppDJOU0k2w4Eg+RzMF6DhKi/A18tNxkvQfKqzkCl12jI2243gLOIeCd6V/WWHT2JKQhS3CnrLbTNfTL5Bawl1RN4nhs36IhKGPyxb96m85Wfb72pjcS9bHyVRsJ4ttFVM9oRA3USadq0duAK4ry+nbBaY0vDmhSI350rdm+6FcOpNTQ5K5gFy44tgPsUzFxXxMNZ5Pkp1yFastG4uRviM9D48AyN6pG8lDdqEbnHXfARWXgK2rldX8necUrFRYcA8m979CbOou4Bed/f5eEelP1VSEO5+/fKqw2cHzDSkFj2m2FsqeA+VPHYv2I6oqTTkwTfpcz/r/3LpQ/+QhaqM6ocW/3F/+u/czZ1qZSDnV9v4uww/d+GXAnzY56KqCt9h5sTVgPkl3iTHEFiXt9DSx6qp777Euq/GRsIwm0jmo6YsnFdf4YXM5qLgX8wmdNkU9jDauQOjQRWXN48VWlgrd78LCEY+708xxVAD3888AhmA41HE=', 'LazTWHtJhMA7CpCYClTXAaSFQsRAbyG4ipGRcYP5xX0l/N7BCzHGxUoFltop4sqZmuRkd3HFzBc83Alk11bd2AH9+fl2aCpQNePpSF2cXny9rN27gi2+mDKWyK1u5D3tgyRPC9dhLVlZBBuZuaXkS8FIhIb/Li9GpASqcMw0B9FFJnTpvqCyf5d9uEq4cXxcolxl+6eqSezvJJvHMuzM+gfXjiYdImD0Ociwpx9nBCuI3A5bf2T5K+LQkhAHDC8F+l6T7zWdiqOTNxGahwbTGpyD5r5J+n8p8bJTtK71gN5nUAMbGUwwdWTnwr4nKjNr3r2NYGYcPDjoqObo3/HWIlKmkihRE+izTwKy7Ezb81JpP8qVJ+F
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, gPUHtAYKRkPVh.cs	Base64 encoded string: '//IW+SJkVi7g0g/q+5TADjFADWJ0txhm/C2GN2XJYN/fH49wVKNtRfR4oItNqsPkvwTwl1pdAF3LYKtpeZPrGA==', 'py3Ucp/VtMmzcb0BtBdkau62G5CK8hp431UkXU9B+Hgo0I7HH0f37CtigBWxR8fBne6E61Vki+9QKN4Uj+uj0g==', 'ntbnLsvlfwdIkEzZrIXQVICn/2sNoKRrEa8110QF3L/4Ack2/RA4nVPEgjw1BLioUKGh0smew37pQy3FdjpR8w==', 'GZ/YqjguCItaoho4FTLFmvxSgG+0XKsr8A8m/NAox/lUfsCCwF21DnJNk51AASWenEy3SGySx18E+Vt4Il9g9PS7PKhxZx76epEAjS+vJqSVEhhtbW0UajEEVCLjeSpTY+DnJolWvcMJ1pJ193GP15lMjtYmhoJOlN8t9ty9kkhdFHLNsok480IRjk755MJHgn8ntAk2p3gKZDmftq0wPHRtp38EmK/IPQgv+YHOcty1iP4bbIGyWrlAXhkJ3C2ubl4KI+Zf+P9qzSpTeQAsEGwwgifLa5WPjKZZZmS/sunpJHxMTWzmAEMNgb8YMBv/8b8MGC1ow1WsM/8HKN4p1zrzKeqlZbCesmsVMn3A5U+FJVVDE3fWCdZvR4v9ZGveXeqFw21BopmkHse77tbfg1IcVJCaokQr4o1Y/bz+WHEmC6HoHgpOivlJGLfDuLT6VANnF9Lt5aYakyWtC/4TL38xQzqx33v8mmTntzzTqFEK3XvFoouizzF7XHk4YzLCTdC+inxRrE2Ud8jZPyCNVcQTA8cuuGlYkDwnCIWhT+bPcpA7T/4VDw+Zw59hI83I/RxokDUsa0s4wTwyt+1kgyALw0iMCTKUuqIGdC/NxPxZM7i0MPECLK6NZ9LPUk8zlPoLBK07U2GDerwveSfLQnJ3CtVwv2b7/5gJomJxfTjoGbUYQ/zOq9Pt5pFkGcSj01YcGl0nDZwzKN6ongljRHrDXUV4G+RPOmdc5cate+JDNVnVxUdMBesdjFKD8B3aeDCIJhFcI7lYXlSELR5mqNzpqISJ9+Oj8U7nSu8NgvCV5jMLT9tsW3LPY7cCVoB4Y62f2sl+VBamSrWC40Bchlm4zaWPPjfmOiRbcI7A5wanzIMTfKYvR7K76ps0K6ej1jTeueBx2QILCmNYRiwoXwA6DTaRGjGtqBtmZZjZzBzkmbjijq+5opPVpH39ebJyEavXrG+KR0/WlIpGu4UsJa1UP2n9WjKwZmyudRDGl7nf3gOSX1A9Lzi4Rcv0n70oosSVxoOKAPt91VTByHXt/HoOJuo/hw2o7Hx7txW368N3Cn0783B0VCORSEuKYqmX4MJto0E3QaEPGYyW8Dbod5uKlX7C5dMk42ZF+N1TZu8lehUv/uqwvXZtxYaaM6oM3/D8k+vwjycrI7Ytqpi7BXel9ilQ/gbpvtSkJ0VzCRjpFxTGPMrx/0WXGzoDe35Uk6rFzrm/PHWt1Bhn6CFGdp0PLKk7DKZC7cQ58RncqIFbQgmb3qGiOLJeaB07FtO3UMgTBzhUDUmfdX5JYJunpKP09AdqGDd9+dH+DzJcCSGTnr2V1quo5t57vEb2vHPsmWYfowlYMMBA1SXmxOpwgnyaVfvHmW1HulO7asU4Jbx0J5Ba1F9eq+rORUMWQV4YrinZiiFbq8fX9HoP98rpD9E1Mo8Xo5X/DjgpOzAnoTgzhA6V4XhU1iZjusdu4Fg/6taXdJVW7WsT5R6Xp2H9Po+O+t7SS53p/NbxuleNUYeK1yiGB+9TuA8eYZYZtoQQJWOoUy0D3RKm3OHYKGhf7RGEl2rZjtlx2WoW9xKfnN3J9oKLEKNXv6z143gOyWZx6wAInRfBh6jSqIxsOsNT5ynSmFkkrlhwnX9a14Yr4tBPh57HKEeHci6unTxL9bw9WZIl1kUtqVCO9rel6fWmgdkkoag1WrghuLcTdw9Oe0ukb9nZKglAAvXD6Ctuy1EM5VaGF/Lzb9WIYWZTVHJAQaOj93wPzXWpKSYkPRjFtuPYmDuV7Wszg/BiKt2y4KXvZaomnV4MRf7gLCtEc8IX7FAEilcvqQhXizqmUlz6pr9jyRo/fsVMfLl3X8ppDJOU0k2w4Eg+RzMF6DhKi/A18tNxkvQfKqzkCl12jI2243gLOIeCd6V/WWHT2JKQhS3CnrLbTNfTL5Bawl1RN4nhs36IhKGPyxb96m85Wfb72pjcS9bHyVRsJ4ttFVM9oRA3USadq0duAK4ry+nbBaY0vDmhSI350rdm+6FcOpNTQ5K5gFy44tgPsUzFxXxMNZ5Pkp1yFastG4uRviM9D48AyN6pG8lDdqEbnHXfARWXgK2rldX8necUrFRYcA8m979CbOou4Bed/f5eEelP1VSEO5+/fKqw2cHzDSkFj2m2FsqeA+VPHYv2I6oqTTkwTfpcz/r/3LpQ/+QhaqM6ocW/3F/+u/czZ1qZSDnV9v4uww/d+GXAnzY56KqCt9h5sTVgPkl3iTHEFiXt9DSx6qp777Euq/GRsIwm0jmo6YsnFdf4YXM5qLgX8wmdNkU9jDauQOjQRWXN48VWlgrd78LCEY+708xxVAD3888AhmA41HE=', 'LazTWHtJhMA7CpCYClTXAaSFQsRAbyG4ipGRcYP5xX0l/N7BCzHGxUoFltop4sqZmuRkd3HFzBc83Alk11bd2AH9+fl2aCpQNePpSF2cXny9rN27gi2+mDKWyK1u5D3tgyRPC9dhLVlZBBuZuaXkS8FIhIb/Li9GpASqcMw0B9FFJnTpvqCyf5d9uEq4cXxcolxl+6eqSezvJJvHMuzM+gfXjiYdImD0Ociwpx9nBCuI3A5bf2T5K+LQkhAHDC8F+l6T7zWdiqOTNxGahwbTGpyD5r5J+n8p8bJTtK71gN5nUAMbGUwwdWTnwr4nKjNr3r2NYGYcPDjoqObo3/HWIlKmkihRE+izTwKy7Ezb81JpP8qVJ+F

Source: 250427-yfs7ca1my6.bin.exe, zgmNfXZXAQv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 250427-yfs7ca1my6.bin.exe, zgmNfXZXAQv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, zgmNfXZXAQv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, zgmNfXZXAQv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: AntiVirus.exe.0.dr, zgmNfXZXAQv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: AntiVirus.exe.0.dr, zgmNfXZXAQv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/5@22/0

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

File created: C:\Users\user\AppData\Roaming\AntiVirus.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Mutant created: \Sessions\1\BaseNamedObjects\tbqoxBC1WYZB
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3096:120:WilError_03

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF95D.tmp

Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat""

Source: 250427-yfs7ca1my6.bin.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 250427-yfs7ca1my6.bin.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 250427-yfs7ca1my6.bin.exe	Virustotal: Detection: 72%
Source: 250427-yfs7ca1my6.bin.exe	ReversingLabs: Detection: 83%

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

File read: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe "C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe"
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\AntiVirus.exe "C:\Users\user\AppData\Roaming\AntiVirus.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\AntiVirus.exe C:\Users\user\AppData\Roaming\AntiVirus.exe
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\AntiVirus.exe "C:\Users\user\AppData\Roaming\AntiVirus.exe"	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 250427-yfs7ca1my6.bin.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 250427-yfs7ca1my6.bin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 250427-yfs7ca1my6.bin.exe, IhlZcjEPoLlU.cs	High entropy of concatenated method names: 'VmFmWkFQPPwAJ', 'nOKiOeYKaZHsAZG', 'WgQMRCOpQGxQPtB', 'hNMUDfIEcBjVZBK', 'pUOzQpyfZjnBaX', 'RlbkOhRYKFtLpf', 'onORxKzPpjdv', 'TqnXRhpkqaAQ', 'qVreUAauxUa', 'jZlQOGrsDbMhublb'
Source: AntiVirus.exe.0.dr, IhlZcjEPoLlU.cs	High entropy of concatenated method names: 'VmFmWkFQPPwAJ', 'nOKiOeYKaZHsAZG', 'WgQMRCOpQGxQPtB', 'hNMUDfIEcBjVZBK', 'pUOzQpyfZjnBaX', 'RlbkOhRYKFtLpf', 'onORxKzPpjdv', 'TqnXRhpkqaAQ', 'qVreUAauxUa', 'jZlQOGrsDbMhublb'
Source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, IhlZcjEPoLlU.cs	High entropy of concatenated method names: 'VmFmWkFQPPwAJ', 'nOKiOeYKaZHsAZG', 'WgQMRCOpQGxQPtB', 'hNMUDfIEcBjVZBK', 'pUOzQpyfZjnBaX', 'RlbkOhRYKFtLpf', 'onORxKzPpjdv', 'TqnXRhpkqaAQ', 'qVreUAauxUa', 'jZlQOGrsDbMhublb'

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

File created: C:\Users\user\AppData\Roaming\AntiVirus.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE
Source: Yara match	File source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AntiVirus.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"'

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE
Source: Yara match	File source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AntiVirus.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 250427-yfs7ca1my6.bin.exe, AntiVirus.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Memory allocated: CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Memory allocated: C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Memory allocated: 29F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Memory allocated: 4CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\AntiVirus.exe

Window / User API: threadDelayed 861

Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe TID: 7260	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe TID: 704	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: AntiVirus.exe.0.dr	Binary or memory string: vmware
Source: AntiVirus.exe, 0000000C.00000002.2504784889.0000000004CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Code function: 0_2_00CB2D4C CheckRemoteDebuggerPresent,

0_2_00CB2D4C

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\AntiVirus.exe "C:\Users\user\AppData\Roaming\AntiVirus.exe"	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Queries volume information: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Queries volume information: C:\Users\user\AppData\Roaming\AntiVirus.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AntiVirus.exe	Queries volume information: C:\Users\user\AppData\Roaming\AntiVirus.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 250427-yfs7ca1my6.bin.exe, type: SAMPLE
Source: Yara match	File source: 0.0.250427-yfs7ca1my6.bin.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.250427-yfs7ca1my6.bin.exe.29c1d38.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 250427-yfs7ca1my6.bin.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AntiVirus.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\AntiVirus.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	2 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Scheduled Task/Job	1 Scripting	2 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
250427-yfs7ca1my6.bin.exe	72%	Virustotal		Browse
250427-yfs7ca1my6.bin.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
250427-yfs7ca1my6.bin.exe	100%	Avira	TR/Dropper.Gen
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\AntiVirus.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\AntiVirus.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat

Name	IP	Active	Malicious	Antivirus Detection	Reputation
Alex3143-23501.portmap.io	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	250427-yfs7ca1my6.bin.exe, 00000000.00000002.1297211381.00000000029BD000.00000004.00000800.00020000.00000000.sdmp, AntiVirus.exe, 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1675615
Start date and time:	2025-04-27 21:49:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	250427-yfs7ca1my6.bin.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/5@22/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 4.245.163.56
Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AntiVirus.exe, PID 7568 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:50:21	Task Scheduler	Run new task: AntiVirus path: "C:\Users\user\AppData\Roaming\AntiVirus.exe"

Process:	C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	739
Entropy (8bit):	5.348505694476449
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaWzAbDLI4MNldKZat92n4M6:ML9E4KlKDE4KhKiKhBsXE4qdK284j
MD5:	A65F13C4355387C4645D260206AE915F
SHA1:	F8857636BB3B50E634E96E7B0ECE6AD77656BA5F
SHA-256:	DB8CA2E253F03395ABECD812505666B3BD5CE699B798E3F624D22EE605FB290E
SHA-512:	0584E8911FD08CC0BB833C6373AE5D161D00CF40FB4533B5DD0D31F38CF1783BB25E34084995A2D116AFB01ABAD14005D62EE51A1D9B79E262EF28775B878AB6
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AntiVirus.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\AntiVirus.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat

Download File

Process:	C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.0616051699443485
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oUkh4EaKC5SMjMACIvmqRDUkh4E2J5xAInTRIJha1ZPy:hWKqTtT69aZ5/jMABvmq1923fTpk
MD5:	EBDAB7A41AECC4A4AE94E7687BF49131
SHA1:	A2D11DEA970BC495767DD22D3587B1399C0AE633
SHA-256:	F17D0B50873615709359621F3402478DB66C08F332123492C670A33027E5F4B8
SHA-512:	D07C85D5779D540404A670C8FA3C4FDBCA974F09349104D1FD4FFF80C7186FC09E8D59B4F48E4F608A7C04A71AFA77F5970B67CDB2D8E0BB2FB2DCEA17602319
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\AntiVirus.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpF95D.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\AntiVirus.exe

Download File

Process:	C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	5.562278871196844
Encrypted:	false
SSDEEP:	768:Ium8n1TQwtPtWUNt1nmo2qzV2mTuOmlJxGPIwxgv3E0bXdv7Fm7UgRBDZox:Ium81TQq72FOmlzvwGv3nbXdjg/dox
MD5:	618432B575574E0A4C43EB072FDAD14C
SHA1:	5E6B5C7DCC1CA567348FACC468906E7C35A7FFD6
SHA-256:	605EAAF66354B3D579E6D4C4ABF886B6DA88C1982B3AE096BB27CEC15B959E05
SHA-512:	6D46F2B9842D9E86D2B69F9437E3887D15D38F6D595059ACA8BD86346624AA6BDB00EF80139A557BD53D0752411C50376C9145D73E885E30DF7FA9192874DAA1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-e............................~.... ........@.. ....................... ............@.................................(...S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H........Y..4v.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...Vrz%.p~....(o....#....s...

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.562278871196844
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	250427-yfs7ca1my6.bin.exe
File size:	48'640 bytes
MD5:	618432b575574e0a4c43eb072fdad14c
SHA1:	5e6b5c7dcc1ca567348facc468906e7c35a7ffd6
SHA256:	605eaaf66354b3d579e6d4c4abf886b6da88c1982b3ae096bb27cec15b959e05
SHA512:	6d46f2b9842d9e86d2b69f9437e3887d15d38f6d595059aca8bd86346624aa6bdb00ef80139a557bd53d0752411c50376c9145d73e885e30df7fa9192874daa1
SSDEEP:	768:Ium8n1TQwtPtWUNt1nmo2qzV2mTuOmlJxGPIwxgv3E0bXdv7Fm7UgRBDZox:Ium81TQq72FOmlzvwGv3nbXdjg/dox
TLSH:	A1232C003BE9C13BF2BE5F78A8F22245857AF6637A02D5491CD441D75623BC29A426FE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....-e............................~.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40d07e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x652DADE5 [Mon Oct 16 21:40:53 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd028	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x7ff	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb084	0xb200	b05ccc3748ccb986b1e025a1a63894a9	False	0.5425517907303371	data	5.6197754357145495	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x7ff	0x800	0f68ce4dd77ed0bb9c1e6b31f6995d94	False	0.41748046875	data	4.88506844918463	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	4cabfef58a4e8716ddd98e1c6e729d0d	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0a0	0x2cc	data			0.43575418994413406
RT_MANIFEST	0xe36c	0x493	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.43381725021349277

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription
FileVersion	1.0.0.0
InternalName	Stub.exe
LegalCopyright
LegalTrademarks
OriginalFilename	Stub.exe
ProductName
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2025 21:50:26.498182058 CEST	49363	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:26.682944059 CEST	53	49363	1.1.1.1	192.168.2.5
Apr 27, 2025 21:50:31.701700926 CEST	56687	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:31.915025949 CEST	53	56687	1.1.1.1	192.168.2.5
Apr 27, 2025 21:50:36.920412064 CEST	50849	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:37.077639103 CEST	53	50849	1.1.1.1	192.168.2.5
Apr 27, 2025 21:50:42.092394114 CEST	54204	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:42.234819889 CEST	53	54204	1.1.1.1	192.168.2.5
Apr 27, 2025 21:50:47.248467922 CEST	63346	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:47.399053097 CEST	53	63346	1.1.1.1	192.168.2.5
Apr 27, 2025 21:50:52.439734936 CEST	65409	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:52.589397907 CEST	53	65409	1.1.1.1	192.168.2.5
Apr 27, 2025 21:50:57.593291998 CEST	57992	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:50:57.776076078 CEST	53	57992	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:02.779861927 CEST	62405	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:02.920922041 CEST	53	62405	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:07.936240911 CEST	51290	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:08.076731920 CEST	53	51290	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:13.092545033 CEST	61046	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:13.270643950 CEST	53	61046	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:18.292428017 CEST	50182	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:18.462033987 CEST	53	50182	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:23.498712063 CEST	55062	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:23.666800976 CEST	53	55062	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:28.670778990 CEST	62560	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:28.845813036 CEST	53	62560	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:33.858114958 CEST	63035	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:34.038547993 CEST	53	63035	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:39.046180964 CEST	55525	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:39.232065916 CEST	53	55525	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:44.248634100 CEST	57859	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:44.407032013 CEST	53	57859	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:49.421730995 CEST	61127	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:49.564543962 CEST	53	61127	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:54.577936888 CEST	59560	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:54.725156069 CEST	53	59560	1.1.1.1	192.168.2.5
Apr 27, 2025 21:51:59.733138084 CEST	53362	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:51:59.908301115 CEST	53	53362	1.1.1.1	192.168.2.5
Apr 27, 2025 21:52:04.922336102 CEST	55288	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:52:05.077188015 CEST	53	55288	1.1.1.1	192.168.2.5
Apr 27, 2025 21:52:10.093205929 CEST	64754	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:52:10.275656939 CEST	53	64754	1.1.1.1	192.168.2.5
Apr 27, 2025 21:52:15.452011108 CEST	62235	53	192.168.2.5	1.1.1.1
Apr 27, 2025 21:52:15.594821930 CEST	53	62235	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 27, 2025 21:50:26.498182058 CEST	192.168.2.5	1.1.1.1	0x21d3	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:31.701700926 CEST	192.168.2.5	1.1.1.1	0x344	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:36.920412064 CEST	192.168.2.5	1.1.1.1	0xcb7	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:42.092394114 CEST	192.168.2.5	1.1.1.1	0xfb65	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:47.248467922 CEST	192.168.2.5	1.1.1.1	0x8f26	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:52.439734936 CEST	192.168.2.5	1.1.1.1	0xdf06	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:57.593291998 CEST	192.168.2.5	1.1.1.1	0x8252	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:02.779861927 CEST	192.168.2.5	1.1.1.1	0x38b0	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:07.936240911 CEST	192.168.2.5	1.1.1.1	0x1291	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:13.092545033 CEST	192.168.2.5	1.1.1.1	0x593a	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:18.292428017 CEST	192.168.2.5	1.1.1.1	0xfc3b	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:23.498712063 CEST	192.168.2.5	1.1.1.1	0xbcfc	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:28.670778990 CEST	192.168.2.5	1.1.1.1	0x797e	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:33.858114958 CEST	192.168.2.5	1.1.1.1	0xf500	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:39.046180964 CEST	192.168.2.5	1.1.1.1	0x1b6b	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:44.248634100 CEST	192.168.2.5	1.1.1.1	0xfe69	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:49.421730995 CEST	192.168.2.5	1.1.1.1	0x684a	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:54.577936888 CEST	192.168.2.5	1.1.1.1	0x577e	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:59.733138084 CEST	192.168.2.5	1.1.1.1	0x17fb	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:52:04.922336102 CEST	192.168.2.5	1.1.1.1	0x1917	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:52:10.093205929 CEST	192.168.2.5	1.1.1.1	0xd08	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:52:15.452011108 CEST	192.168.2.5	1.1.1.1	0x50b8	Standard query (0)	Alex3143-23501.portmap.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 27, 2025 21:50:26.682944059 CEST	1.1.1.1	192.168.2.5	0x21d3	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:31.915025949 CEST	1.1.1.1	192.168.2.5	0x344	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:37.077639103 CEST	1.1.1.1	192.168.2.5	0xcb7	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:42.234819889 CEST	1.1.1.1	192.168.2.5	0xfb65	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:47.399053097 CEST	1.1.1.1	192.168.2.5	0x8f26	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:52.589397907 CEST	1.1.1.1	192.168.2.5	0xdf06	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:50:57.776076078 CEST	1.1.1.1	192.168.2.5	0x8252	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:02.920922041 CEST	1.1.1.1	192.168.2.5	0x38b0	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:08.076731920 CEST	1.1.1.1	192.168.2.5	0x1291	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:13.270643950 CEST	1.1.1.1	192.168.2.5	0x593a	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:18.462033987 CEST	1.1.1.1	192.168.2.5	0xfc3b	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:23.666800976 CEST	1.1.1.1	192.168.2.5	0xbcfc	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:28.845813036 CEST	1.1.1.1	192.168.2.5	0x797e	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:34.038547993 CEST	1.1.1.1	192.168.2.5	0xf500	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:39.232065916 CEST	1.1.1.1	192.168.2.5	0x1b6b	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:44.407032013 CEST	1.1.1.1	192.168.2.5	0xfe69	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:49.564543962 CEST	1.1.1.1	192.168.2.5	0x684a	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:54.725156069 CEST	1.1.1.1	192.168.2.5	0x577e	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:51:59.908301115 CEST	1.1.1.1	192.168.2.5	0x17fb	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:52:05.077188015 CEST	1.1.1.1	192.168.2.5	0x1917	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:52:10.275656939 CEST	1.1.1.1	192.168.2.5	0xd08	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false
Apr 27, 2025 21:52:15.594821930 CEST	1.1.1.1	192.168.2.5	0x50b8	Name error (3)	Alex3143-23501.portmap.io	none	none	A (IP address)	IN (0x0001)	false

Statistics

Click to jump to process

Memory Usage

• 250427-yfs7ca1my6.bin.exe
• cmd.exe
• conhost.exe
• cmd.exe
• conhost.exe
• timeout.exe
• schtasks.exe
• AntiVirus.exe
• AntiVirus.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• 250427-yfs7ca1my6.bin.exe
• cmd.exe
• conhost.exe
• cmd.exe
• conhost.exe
• timeout.exe
• schtasks.exe
• AntiVirus.exe
• AntiVirus.exe

Click to jump to process

Target ID:	0
Start time:	15:50:13
Start date:	27/04/2025
Path:	C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\250427-yfs7ca1my6.bin.exe"
Imagebase:	0x480000
File size:	48'640 bytes
MD5 hash:	618432B575574E0A4C43EB072FDAD14C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.1250333388.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.1297211381.0000000002861000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.1297211381.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:50:18
Start date:	27/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"' & exit
Imagebase:	0x220000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:50:18
Start date:	27/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:50:18
Start date:	27/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat""
Imagebase:	0x220000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:50:18
Start date:	27/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:50:18
Start date:	27/04/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 3
Imagebase:	0x7c0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:50:18
Start date:	27/04/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "AntiVirus" /tr '"C:\Users\user\AppData\Roaming\AntiVirus.exe"'
Imagebase:	0xe40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:50:21
Start date:	27/04/2025
Path:	C:\Users\user\AppData\Roaming\AntiVirus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\AntiVirus.exe"
Imagebase:	0x3d0000
File size:	48'640 bytes
MD5 hash:	618432B575574E0A4C43EB072FDAD14C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000C.00000002.2502581438.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: unknown Rule: rat_win_asyncrat, Description: Detect AsyncRAT based on specific strings, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\AntiVirus.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:50:21
Start date:	27/04/2025
Path:	C:\Users\user\AppData\Roaming\AntiVirus.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\AntiVirus.exe
Imagebase:	0x9e0000
File size:	48'640 bytes
MD5 hash:	618432B575574E0A4C43EB072FDAD14C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.7%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 00CB2D4C Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 00CB532F

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 10ac692a9e7eac7d8e4b06ea7733d6f1281e0cd61161039a05ec56924b8a9dfe
Instruction ID: 8af67a4d3aac6e38122e02495293f9d2d6e68785226058f2496eb514a056a60b
Opcode Fuzzy Hash: 10ac692a9e7eac7d8e4b06ea7733d6f1281e0cd61161039a05ec56924b8a9dfe
Instruction Fuzzy Hash: 042166B18012598FCB10CF9AC484BEEBBF4AF48310F14842AE818A7351D778A944CFA0

Function 00CB5B20 Relevance: .3, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb9b2cb9abd8ff3810ea2fb51b1389c6cf35da4dda0319049325cbc4a166c44
Instruction ID: 49ea1f74cefc25b6ecfabf66170428ad745a7543a87543b3d0ac704d295db51d
Opcode Fuzzy Hash: 4eb9b2cb9abd8ff3810ea2fb51b1389c6cf35da4dda0319049325cbc4a166c44
Instruction Fuzzy Hash: 1CB1C834B002548BDB19AB75985437E7BB3AFC9710F14852DE406EB394DE38DD069BA2

Function 00CB4088 Relevance: .3, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a910391f9cb497acacba29729d01e0a99d84882713ad67b588442a077aaf342
Instruction ID: 08e85a36097164ebe8b4a1c1b90fc1f9638cf91ca6798315a7057e2d6bb8d460
Opcode Fuzzy Hash: 4a910391f9cb497acacba29729d01e0a99d84882713ad67b588442a077aaf342
Instruction Fuzzy Hash: 67B14C70E04209CFDF18CFA9D8857EEBBF2AF88304F148129E825A7255EB749945DF91

Function 00CB4958 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aab1b03dd2b818acc962ddae352d58a389559eb76b323dd007b917d6cdc4d60
Instruction ID: e00bd78a27cb6df36586d7836e0d5fa4561ab9930bb762aaa21384d8aa3fe690
Opcode Fuzzy Hash: 1aab1b03dd2b818acc962ddae352d58a389559eb76b323dd007b917d6cdc4d60
Instruction Fuzzy Hash: 8AB18E70E042098FDF18CFA9D8857EDBBF2AF88714F148129E825A7295EB349945DF81

Function 00CB52B0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 00CB532F

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6975f16b409271653a900b2e3e712922c7ec5fc1650b930a1c955d6021594f26
Instruction ID: 26f29793d8b0d54998284d19e5624a12c90aeec5d3079a5bad3ebc1129ed5214
Opcode Fuzzy Hash: 6975f16b409271653a900b2e3e712922c7ec5fc1650b930a1c955d6021594f26
Instruction Fuzzy Hash: A22178B29012598FCB10CFAAD484BEEBBF4AF48310F14846EE854A7350D7789A44CF60

Function 00CB6A19 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 00CB6A85

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: d5585da15d296d0d2606e4bfedbefb084e4d9de52712a2a561ea767c4154d523
Instruction ID: 34f3df936696d7007c5eb31258bb25d6c201de366130ea1f3ff58ac26d565302
Opcode Fuzzy Hash: d5585da15d296d0d2606e4bfedbefb084e4d9de52712a2a561ea767c4154d523
Instruction Fuzzy Hash: F21125B59002498FDB20CF9AC484BDEBFF4EF48314F24811AD919A7251C338A945CFA1

Function 00CB6A20 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 00CB6A85

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 1d236d32252bf4d402c74f3561fa77a39095bffaa44e9a45167a117073733da1
Instruction ID: 4b77ff474bef3cae2cb7332414c112abc26c18c4c15b282a161aae46f62ca443
Opcode Fuzzy Hash: 1d236d32252bf4d402c74f3561fa77a39095bffaa44e9a45167a117073733da1
Instruction Fuzzy Hash: 0911F2B59002498FDB20DF9AC584ADEBFF4EB48310F248419D619A7251C779A944CFA5

Function 00C5D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1296476872.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_250427-yfs7ca1my6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d738aa2c6a679403902ed81c9e3dc898a18c07be534e3ae92d0643301f72650
Instruction ID: 5752b5f58317a7ab9aa31ca909e234572885a10972f04ea23d72f6383be2a3dc
Opcode Fuzzy Hash: 6d738aa2c6a679403902ed81c9e3dc898a18c07be534e3ae92d0643301f72650
Instruction Fuzzy Hash: 492148B5500300DFDB25DF14D9C0B26BF65FB94325F60C169ED0A0B256C336D88ACBA2

Function 00C5D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1296476872.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_250427-yfs7ca1my6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68199e4efcf8fe5faf796e1eb00fdac1bd40fbc6b1f5683208f03f6d852d321
Instruction ID: d03eb37f7fb0abd691b57b0cf6442889af2a7035f2c432a4e01c224d24a0e2b2
Opcode Fuzzy Hash: e68199e4efcf8fe5faf796e1eb00fdac1bd40fbc6b1f5683208f03f6d852d321
Instruction Fuzzy Hash: 3411AFB6504240CFDB16CF14D5C4B16BF61FB94324F2485A9DD0A4B256C33AD95ACBA2

Non-executed Functions

Function 00CB3D40 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1296718677.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_250427-yfs7ca1my6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02fde94828a7cb6b62c0aa9318d3c93155d81510d7229af301e6ef72e7dbad73
Instruction ID: afb6cc859df70f0b387d94115d2ac43543ef2dbf3433ba8377401445812e970c
Opcode Fuzzy Hash: 02fde94828a7cb6b62c0aa9318d3c93155d81510d7229af301e6ef72e7dbad73
Instruction Fuzzy Hash: AB918070E00249CFDF14CFA9D9857EEBBF2AF88304F248529E415A7294EB749A45CF91

Analysis Process: AntiVirus.exePID: 1488, Parent PID: 8084COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 00C02D4C Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 00C0532F

Memory Dump Source

Source File: 0000000C.00000002.2502239502.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_AntiVirus.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 89e079c6ca8219d6639cdeb4b3674dd4f1c143c19c453df1640ff6d76a3360bb
Instruction ID: f967678032e722eaca0d288d91143b9425c6831a7c846eb9ee308271734344a0
Opcode Fuzzy Hash: 89e079c6ca8219d6639cdeb4b3674dd4f1c143c19c453df1640ff6d76a3360bb
Instruction Fuzzy Hash: 7F2136B1801659CFCB10CF9AD484BEEBBF4EF49310F14846AE959A7251D778A944CFA0

Function 00C052B0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 00C0532F

Memory Dump Source

Source File: 0000000C.00000002.2502239502.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_AntiVirus.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 89572119edc3f27929dba405d38632f18557b9465dffe1005e41775bf078794b
Instruction ID: 1eaf11a34feeff1eb76c4ffa150834222355c2c2741092e091102f7baa15b550
Opcode Fuzzy Hash: 89572119edc3f27929dba405d38632f18557b9465dffe1005e41775bf078794b
Instruction Fuzzy Hash: 382166B6801659CFDB10CFA9D484BEEFBF4AF48310F14846AE458A3250D778AA44CF60

Function 00C069C0 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 00C06A2D

Memory Dump Source

Source File: 0000000C.00000002.2502239502.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_AntiVirus.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 3535c5e2c8a308c491cf25ad173a164f4d7a6cdf5e2410c31fc5c366861efd4b
Instruction ID: 3c4f2b1d0427aa84f28dc9be2467ff2a306bb438e44153c31dc559c22be3bb75
Opcode Fuzzy Hash: 3535c5e2c8a308c491cf25ad173a164f4d7a6cdf5e2410c31fc5c366861efd4b
Instruction Fuzzy Hash: B71113B5900649DFDB20DF9AC985BDEBFF4EB88310F108019D669A7250C774A944CFA1

Function 00C069C8 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL(?,?,?), ref: 00C06A2D

Memory Dump Source

Source File: 0000000C.00000002.2502239502.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c00000_AntiVirus.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 26b982a0bf33f7026f69ad238a0aec845edcbcfa10bb45bf27083acaf7cb78b4
Instruction ID: c49a5909768868492133801f196b99875df72e5c20aec83c57402e1538603b20
Opcode Fuzzy Hash: 26b982a0bf33f7026f69ad238a0aec845edcbcfa10bb45bf27083acaf7cb78b4
Instruction Fuzzy Hash: 221103B5900649CFDB20DF9AD985BDEBFF4EF88310F108019D618A7251C774A944CFA5

Function 008ED0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2501673324.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8ed000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab5b54ed9d53e817f411d462894f71bf1096e1a06780f980d8ed5d638d2299f
Instruction ID: 6290e8f82e7a81f86c8b02d56d97d59d3d6ddcf97ee1fab8560005a23df3fd5b
Opcode Fuzzy Hash: 4ab5b54ed9d53e817f411d462894f71bf1096e1a06780f980d8ed5d638d2299f
Instruction Fuzzy Hash: 64210475504384EFDB05DF15D9C0B26FB65FB85314F24C56DE8098B296C33AD80ACAA1

Function 008ED0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2501673324.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8ed000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635a0055f575a6eb21eb872a3a1e87cb2ee35c6e4d8a8db28d5e9f1465cd98cb
Instruction ID: c1c002b48d87f73a0728778efdffd7854e0db74a9c91afbb95fdd5eac57db130
Opcode Fuzzy Hash: 635a0055f575a6eb21eb872a3a1e87cb2ee35c6e4d8a8db28d5e9f1465cd98cb
Instruction Fuzzy Hash: 1E119D79504380DFDB06CF14D9C4B15FBB2FB85314F24C6A9D8498B656C33AD84ACBA1

Analysis Process: AntiVirus.exePID: 7568, Parent PID: 1028COMMON

Executed Functions

Function 029F0EBA Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14002a769daa9dd00a68fc43238e4f4e24480f2a694c8ee7856eaae74294f10
Instruction ID: 4d74609003806cce3c7e3076e42bd8b470a7875e725aa029463cf4dbfb806861
Opcode Fuzzy Hash: a14002a769daa9dd00a68fc43238e4f4e24480f2a694c8ee7856eaae74294f10
Instruction Fuzzy Hash: E9515030B101149FCB55DF79C458AAEBBF6EF88700F2581A9E905EB3A5CA71DC02CB91

Function 029F0D20 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a11d7e88f9d2e96bd852758684b5badf871541c536f3a1f3cf60e6ce101916d
Instruction ID: 1bd3e2c1fb2c4d0e08b2e57c3df9c6b85a87043e3a8cc4370348c347f55b764f
Opcode Fuzzy Hash: 2a11d7e88f9d2e96bd852758684b5badf871541c536f3a1f3cf60e6ce101916d
Instruction Fuzzy Hash: 1151DF31B042548FCB55DF7CC494AAEBBF6AF89304F1484A9E505EB3A2CB359C06CB90

Function 029F0AA0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ca7c3f10e1df2bfebe8a9b66bc9d491e87b8e6013919de3c5e9b36d1e23638
Instruction ID: ab40171447a3912b0b6e7acc31443b061a02533be3a8675d53e2eab2d2cf90a4
Opcode Fuzzy Hash: 96ca7c3f10e1df2bfebe8a9b66bc9d491e87b8e6013919de3c5e9b36d1e23638
Instruction Fuzzy Hash: B851C338665281CFC707FB34F488A697B66FB84306790CA6DD402CB25ADB799D46CF90

Function 029F11D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7a6de492dd7c569231ed28c66f470666aa7129dc54e8e9b3ca5b16463776c0
Instruction ID: 67a35932701fae85ecde1e74e661fdd5da76b037a64f74924244295fb8d0f3dc
Opcode Fuzzy Hash: 4a7a6de492dd7c569231ed28c66f470666aa7129dc54e8e9b3ca5b16463776c0
Instruction Fuzzy Hash: 9441A270F00219AFCB84DBB984546AEFBF6EFC8300F20C569D48AD7345DA349902CBA1

Function 029F1339 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec7891d273ad95e31569b54128a2313f5e926c1394b755f7a7b96bfe3c2ed8ac
Instruction ID: b7f7d34361d728b940fd44688b9bf9bf4f4bf2323f54242882b4baaf460b26bd
Opcode Fuzzy Hash: ec7891d273ad95e31569b54128a2313f5e926c1394b755f7a7b96bfe3c2ed8ac
Instruction Fuzzy Hash: 83318434F002168FCB85DB798455A6EBBF6AFC9200B144069E549EB3A1DE75DD01CBA0

Function 029F0D10 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821ed0fc576ed4e5afb4d1b93572d16bc0d38f2fdee8dbf93a5aa05ea1ac8400
Instruction ID: 52a93d9a7ba049feafe2b7ec0001b36b8984fd56d7e3a85111da6629bba7e18f
Opcode Fuzzy Hash: 821ed0fc576ed4e5afb4d1b93572d16bc0d38f2fdee8dbf93a5aa05ea1ac8400
Instruction Fuzzy Hash: D731AF35A002048FDB55DF68C498BAEBBF6BF88300F148569E505EB3A2DB75AD05CB90

Function 0295D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381630834.000000000295D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0295D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_295d000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942925a7bf7f1f3fa7955baf2a49127c2cf7a887be9e9ad3fbc08138d522fff1
Instruction ID: 61bc86109cd75143bed92989b0a9816af4806a7a4519aa50fe69d59e8c3ae0ba
Opcode Fuzzy Hash: 942925a7bf7f1f3fa7955baf2a49127c2cf7a887be9e9ad3fbc08138d522fff1
Instruction Fuzzy Hash: C0210771604240DFDB15DF14D9C0B26BF69FB88328F24C569ED0A4B25AC336D456CBB2

Function 029F0998 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767aa7ee297af5163c956aad2c0e6a51cd5304d848a8aa45a7c5c13fb90cef53
Instruction ID: 3d511b3a55fa3f4a7af5ae4dbe9bd65e5b633bfb6e3c8614097f64d6f62b3504
Opcode Fuzzy Hash: 767aa7ee297af5163c956aad2c0e6a51cd5304d848a8aa45a7c5c13fb90cef53
Instruction Fuzzy Hash: AD216A30B583428FDBE4AB74A85C73E7BECAF00205741882DDA47D214AEB24C950CB61

Function 029F09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458494a844fb4c5ab4b3b673f49827cd44fa9103faf1ea807f982920bb44dd1d
Instruction ID: a32b5d57d1c516cbcf8a034b6ae484cfad6f5c4810c042ad04130328d0d5ad65
Opcode Fuzzy Hash: 458494a844fb4c5ab4b3b673f49827cd44fa9103faf1ea807f982920bb44dd1d
Instruction Fuzzy Hash: B5213E30A583038FDBE4BB75A91C73E7AACAB00205740882DDA07D214AEF24C950CBA2

Function 029F1431 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2395688ef08971bd43f7e9796f11b725d2b533fe0529eb7f2f9b6e6e4f43540
Instruction ID: 72676b12996f7f3ab77b56d3daaa661ffdb4de421bacd3867c6a3700b1edc02f
Opcode Fuzzy Hash: c2395688ef08971bd43f7e9796f11b725d2b533fe0529eb7f2f9b6e6e4f43540
Instruction Fuzzy Hash: 1E11AC30A00251DFCB85EBB8D814AAA7BF6AFC921471448BAD409DB351EB34CC42CBD0

Function 0295D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381630834.000000000295D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0295D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_295d000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68199e4efcf8fe5faf796e1eb00fdac1bd40fbc6b1f5683208f03f6d852d321
Instruction ID: 2639f6539a6fc77e035a7fba38fbb00b7a6bcf67f5b3c54610c79be3c2aee62d
Opcode Fuzzy Hash: e68199e4efcf8fe5faf796e1eb00fdac1bd40fbc6b1f5683208f03f6d852d321
Instruction Fuzzy Hash: 2711D376504240CFDB16CF14D5C4B16BF71FB84324F24C5A9DD094B25AC33AD45ACBA2

Function 029F1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011768997a23a4af547817e717358305780e04b3665dac76ba7cc0b64912b9ab
Instruction ID: 16e96f922aab1eb56cd8ff5724b3826bd5cba56396fe115442683faf289fafa7
Opcode Fuzzy Hash: 011768997a23a4af547817e717358305780e04b3665dac76ba7cc0b64912b9ab
Instruction Fuzzy Hash: 82116D74B00205DFCB94EFB9D404A6ABBFAAFC8215720487AD50EDB315EA35DC52CB90

Function 029F0E3F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5576007eb902aa69d2cf08cb4b2409ae9932a392450e4d29302416189e1dfcae
Instruction ID: c3998ebb1a1b292bacf6694a7bce322d39a6bac5aeeb9c3c4503544e1b0fe098
Opcode Fuzzy Hash: 5576007eb902aa69d2cf08cb4b2409ae9932a392450e4d29302416189e1dfcae
Instruction Fuzzy Hash: DD01D1207082A14FC756973C54A44AE7FE79FCA25432908EAD189CB3A3DD288C078795

Function 029F0E80 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1381819711.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29f0000_AntiVirus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231d4334da7edd224d2daa89d4b6da2617b250eb7886fafd8ab6698b9df2bae2
Instruction ID: 9efd8d225c191908fe18ddac718c06c8c7012587f86ddc9ae237676fad2ebb51
Opcode Fuzzy Hash: 231d4334da7edd224d2daa89d4b6da2617b250eb7886fafd8ab6698b9df2bae2
Instruction Fuzzy Hash: 74E012367042105F8744967EE88885BB7EBEFCD6753654879F109D7321DD75DC0147A0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 250427-yfs7ca1my6.bin.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\250427-yfs7ca1my6.bin.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AntiVirus.exe.log

C:\Users\user\AppData\Local\Temp\tmpF95D.tmp.bat

C:\Users\user\AppData\Roaming\AntiVirus.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
250427-yfs7ca1my6.bin.exe