Edit tour

Windows Analysis Report
1111110789_stripped.exe

Overview

General Information

Sample Name:	1111110789_stripped.exe
Analysis ID:	724751
MD5:	ba218c4db9606a955d3dd4e5aba22b7f
SHA1:	927f94547db0d01eb873807ec11950b641c207c2
SHA256:	99735bf17537e921b53f4b4f2aada8fecbf1d0627ce3139b878151d9fe3f4b9f
Tags:	exe
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected DcRat

Antivirus detection for URL or domain

Yara detected AsyncRAT

Antivirus detection for dropped file

Snort IDS alert for network traffic

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

1111110789_stripped.exe (PID: 684 cmdline: C:\Users\user\Desktop\1111110789_stripped.exe MD5: BA218C4DB9606A955D3DD4E5ABA22B7F)

RegAsm.exe (PID: 6128 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cmd.exe (PID: 5320 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5312 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5284 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5216 cmdline: cmd" /c copy "C:\Users\user\Desktop\1111110789_stripped.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

msdtc.exe (PID: 3724 cmdline: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe MD5: BA218C4DB9606A955D3DD4E5ABA22B7F)

RegAsm.exe (PID: 2044 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cmd.exe (PID: 2148 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5288 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 1744 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5208 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

msdtc.exe (PID: 1584 cmdline: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe MD5: BA218C4DB9606A955D3DD4E5ABA22B7F)

RegAsm.exe (PID: 5356 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cmd.exe (PID: 2408 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3508 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5540 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5100 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

msdtc.exe (PID: 5808 cmdline: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe MD5: BA218C4DB9606A955D3DD4E5ABA22B7F)

cleanup

Malware Configuration

Threatname: AsyncRAT

{"Server": "venom12345.duckdns.org,venomunverified.duckdns.org", "Ports": "4449", "Version": "5.0.5", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "13hY2L4QQkwZIszSJIRogZg0oshQmzWu", "Mutex": "Venom_RAT_HVNC_Mutex_Venom RAT_HVNC", "Certificate": "MIICMzCCAZygAwIBAgIVALgbuadTIXCBGx92qk2Pt658vf8pMA0GCSqGSIb3DQEBDQUAMGcxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDExMjE3MzIzNloXDTMxMTAyMjE3MzIzNlowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPLknDSnzkq9SuHSkPVyOxBFVoX/n/Y/SNOD2TO9vxmiaLG1rfOcnt7KPbQA3CJxOmVjCVDvtURayayaErAu6R280hq1HgF3iL7u8+5R9XY6JvXkaiKj2rYiEVKKWU55xGCztKNQAfUY7prw8li8QJk+J8vzitqKS1zz7G2UcGx1AgMBAAGjMjAwMB0GA1UdDgQWBBSyJslOSHG/21uHIrLBFtFJb3nJHzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAG/y6mnqPy3k1abtSAqAnm79siuBJ99b4uxdaTRVNIjATBtYUb3stSpQGefhnzNh4YS6w3SvTZk/BwuWyC0MKvHEbQhbk4JyoIcF4s2wzd5/mcTYK/kwPzAGUp+b93Fp38f3TRgFz+fWVZGheqUlWxzMzV1boXz2JX4pGQTypJBM", "ServerSignature": "NCg54PLd2n8AEDSHQSmNfMcGUM+NFZObzWko+AQswKpLMJ6ybKRb5J/+Cq0oCg903QfMlcKBN23ZkC2YZqHpY/w9FmT+MXpUrkZjZV9+O1vXR+LeUfqiH27cAqfZ+RK8uYYKf4G1fwan7KMM8u0MSEoMlv8ggcZoyyPmsFd4SMk=", "BDOS": "null", "Startup_Delay": "1", "Group": "Venom Clients"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x19c89:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.402891320.0000000000F75000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x28ecf:$b2: DcRat By qwqdanchun1
0000001C.00000002.403928683.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x6b:$b2: DcRat By qwqdanchun1
00000001.00000002.509335673.00000000015E5000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2327:$b2: DcRat By qwqdanchun1
0000000A.00000002.298467829.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1006b:$b2: DcRat By qwqdanchun1
00000001.00000002.508512430.0000000001585000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x288b7:$b2: DcRat By qwqdanchun1
00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2ffb:$b2: DcRat By qwqdanchun1 0x966b:$b2: DcRat By qwqdanchun1 0x98af:$b2: DcRat By qwqdanchun1
0000000A.00000002.303426131.0000000004968000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xa09f:$b2: DcRat By qwqdanchun1
00000001.00000000.254425551.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000002.509118659.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x18d0b:$b2: DcRat By qwqdanchun1
00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2adff:$b2: DcRat By qwqdanchun1
00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: 1111110789_stripped.exe PID: 684	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6128	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: RegAsm.exe PID: 6128	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6128	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5c297:$a1: havecamera 0x1c0d5:$b2: DcRat By qwqdanchun1 0x2595d:$b2: DcRat By qwqdanchun1 0x414f2:$b2: DcRat By qwqdanchun1 0x4de1a:$b2: DcRat By qwqdanchun1 0x657cb:$b2: DcRat By qwqdanchun1
Process Memory Space: RegAsm.exe PID: 2044	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9594:$b2: DcRat By qwqdanchun1 0x1b1e0:$b2: DcRat By qwqdanchun1
Process Memory Space: RegAsm.exe PID: 5356	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2f2c:$b2: DcRat By qwqdanchun1
Process Memory Space: msdtc.exe PID: 5808	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
38.2.msdtc.exe.26ec204.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
38.2.msdtc.exe.26ec204.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xb398:$q1: Select * from Win32_CacheMemory 0xb3d8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xb426:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xb474:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
1.0.RegAsm.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.0.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd198:$q1: Select * from Win32_CacheMemory 0xd1d8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd226:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd274:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
38.2.msdtc.exe.26ec204.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
38.2.msdtc.exe.26ec204.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xd198:$q1: Select * from Win32_CacheMemory 0xd1d8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xd226:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xd274:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) - Source IP: 185.216.71.4 - Destination IP: 192.168.2.6

Timestamp:	185.216.71.4192.168.2.64449497082850454 10/17/22-19:26:14.287650
SID:	2850454
Source Port:	4449
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) - Source IP: 185.216.71.4 - Destination IP: 192.168.2.6

Timestamp:	185.216.71.4192.168.2.64449497082848152 10/17/22-19:26:14.287650
SID:	2848152
Source Port:	4449
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1111110789_stripped.exe

Avira: detected

Antivirus detection for URL or domain

Source: venom12345.duckdns.org

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe

Avira: detection malicious, Label: HEUR/AGEN.1235903

Machine Learning detection for sample

Source: 1111110789_stripped.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe

Joe Sandbox ML: detected

Source: 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "venom12345.duckdns.org,venomunverified.duckdns.org", "Ports": "4449", "Version": "5.0.5", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "13hY2L4QQkwZIszSJIRogZg0oshQmzWu", "Mutex": "Venom_RAT_HVNC_Mutex_Venom RAT_HVNC", "Certificate": "MIICMzCCAZygAwIBAgIVALgbuadTIXCBGx92qk2Pt658vf8pMA0GCSqGSIb3DQEBDQUAMGcxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDExMjE3MzIzNloXDTMxMTAyMjE3MzIzNlowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPLknDSnzkq9SuHSkPVyOxBFVoX/n/Y/SNOD2TO9vxmiaLG1rfOcnt7KPbQA3CJxOmVjCVDvtURayayaErAu6R280hq1HgF3iL7u8+5R9XY6JvXkaiKj2rYiEVKKWU55xGCztKNQAfUY7prw8li8QJk+J8vzitqKS1zz7G2UcGx1AgMBAAGjMjAwMB0GA1UdDgQWBBSyJslOSHG/21uHIrLBFtFJb3nJHzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAG/y6mnqPy3k1abtSAqAnm79siuBJ99b4uxdaTRVNIjATBtYUb3stSpQGefhnzNh4YS6w3SvTZk/BwuWyC0MKvHEbQhbk4JyoIcF4s2wzd5/mcTYK/kwPzAGUp+b93Fp38f3TRgFz+fWVZGheqUlWxzMzV1boXz2JX4pGQTypJBM", "ServerSignature": "NCg54PLd2n8AEDSHQSmNfMcGUM+NFZObzWko+AQswKpLMJ6ybKRb5J/+Cq0oCg903QfMlcKBN23ZkC2YZqHpY/w9FmT+MXpUrkZjZV9+O1vXR+LeUfqiH27cAqfZ+RK8uYYKf4G1fwan7KMM8u0MSEoMlv8ggcZoyyPmsFd4SMk=", "BDOS": "null", "Startup_Delay": "1", "Group": "Venom Clients"}

Source: 1111110789_stripped.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1111110789_stripped.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850454 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) 185.216.71.4:4449 -> 192.168.2.6:49708
Source: Traffic	Snort IDS: 2848152 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) 185.216.71.4:4449 -> 192.168.2.6:49708

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: venom12345.duckdns.org
Source: Malware configuration extractor	URLs: venomunverified.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: venom12345.duckdns.org

Source: Joe Sandbox View

ASN Name: CLOUDCOMPUTINGDE CLOUDCOMPUTINGDE

Source: global traffic

TCP traffic: 192.168.2.6:49708 -> 185.216.71.4:4449

Source: RegAsm.exe, 00000001.00000002.509335673.00000000015E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 00000001.00000002.508512430.0000000001585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 00000001.00000002.509335673.00000000015E5000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000001.00000002.513013520.000000000324C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: unknown

DNS traffic detected: queries for: venom12345.duckdns.org

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.254425551.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1111110789_stripped.exe PID: 684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msdtc.exe PID: 5808, type: MEMORYSTR

Source: msdtc.exe, 00000009.00000002.291676626.00000000014F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 38.2.msdtc.exe.26ec204.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 38.2.msdtc.exe.26ec204.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0000001C.00000002.402891320.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000001C.00000002.403928683.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000001.00000002.509335673.00000000015E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000A.00000002.298467829.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000001.00000002.508512430.0000000001585000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000A.00000002.303426131.0000000004968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000001.00000002.509118659.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 2044, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 5356, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Source: 1111110789_stripped.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 38.2.msdtc.exe.26ec204.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 38.2.msdtc.exe.26ec204.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0000001C.00000002.402891320.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000001C.00000002.403928683.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000001.00000002.509335673.00000000015E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000A.00000002.298467829.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000001.00000002.508512430.0000000001585000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000A.00000002.303426131.0000000004968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000001.00000002.509118659.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: RegAsm.exe PID: 2044, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: RegAsm.exe PID: 5356, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F2118	1_2_017F2118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017FE960	1_2_017FE960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017FACC0	1_2_017FACC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F9FE8	1_2_017F9FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F2109	1_2_017F2109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F1590	1_2_017F1590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F1580	1_2_017F1580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F9CA0	1_2_017F9CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_02C41580	28_2_02C41580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_02C41590	28_2_02C41590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_02C42109	28_2_02C42109

Source: C:\Users\user\Desktop\1111110789_stripped.exe

Code function: 0_2_01743C80 CreateProcessAsUserA,

0_2_01743C80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F2118 NtProtectVirtualMemory,	1_2_017F2118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_017F2558 NtProtectVirtualMemory,	1_2_017F2558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_02C42560 NtProtectVirtualMemory,	28_2_02C42560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_02C42109 NtProtectVirtualMemory,	28_2_02C42109

Source: 1111110789_stripped.exe, 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameClient.exe, vs 1111110789_stripped.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior

Source: 1111110789_stripped.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: msdtc.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1111110789_stripped.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1111110789_stripped.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1111110789_stripped.exe C:\Users\user\Desktop\1111110789_stripped.exe
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\1111110789_stripped.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\1111110789_stripped.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\1111110789_stripped.exe

File created: C:\Users\user\AppData\Roaming\msdtc

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@43/7@1/1

Source: 1111110789_stripped.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: 1.0.RegAsm.exe.400000.0.unpack, Client/Settings.cs

Base64 encoded string: 'OMwDkO6HclIV0E7U/cv1LfRWNry4Hw4R1EWfn0aEa7NWZ+Rx9CC/veUI3F2uHnoZZ1g7W9FSNiGdKXnwVl+Ywg==', 'oprpUz+oBUaZ7oEBwMb9CXJSB0U9k/OE9MxGxyFzS1pdDz+EtEc7/CodE8tw0iRpsFmACBC4OSWXkrREwv8ZTNHHUqhFOr1j/vNmMqSiHCvV3G8Zc46zyeW4JZpLCQeikNi0lbG8cGG7PeIx4JvlUg==', 'gI0TnYLSVAmlBOWcNM+Gqj0HsCC1jskE3G01V+az8qWk51YowIWtk6UAoWehiS9JT+EkC7XygIx3+E5QgvuOpN7HmD9BZ5DYBtTqpREpNJGgAREGxfmtaFgEn+5iilWg', 'KVCbAPtHg2sOkxbeg1in+MAxh8F+hPmtiq/QBb8CuSEFpWR/YZ/EvN0CrNGo12dLeOfRAAXIVw6+gm7+57YCRzIVLqh1SSFv1AAi/uzXTFP7CiyLGVzKZtPf+LVsYfnzkXCxiHbGPtk9zmYaXwIy0zjP6PrfN7TWsmial7GObg5pIHddVkRXbhO9qbTH3P8Co1s2d/5C4b8TtSv4Jlrx21jT0LNqBJ9BW5tyrLWWujAM7NmE0nGEgpM0zGiDc78L1C+BNBf0mG5pTCU9e2X6qkLDpxRyNJeI3WtUzovh+uKmjph/Mr/isZA5QT+ipu1usf5J3fAZjV5k1hMBihb0Syd20Oi3mArpD9cRusx8adoLI5Dovy8LiktRyoNbTafCInCkxwxACE/E2AAathN1BTjoZFZ1cYrLef8uzGO6qpRX+UjvAlg9y/bfxUVUd3KKPB6VU7uf0hczUJN8R6R/EvfCPWCekaDoS0hjGM1IuXl2A4Idj3ERoUoD2lT3C6dhlhJzYvljFfUvNAwCHoTKqbQKQNt+D/ifxPGNUY9mYeYKs3cji0D4ul8vwTgTnWm1F+Ddn72s9POMPLGjS79xxwGJfIc+6jwtqcH93YzUTxbffYcSOtA3NdgjQsgYLNv6DdhmEmvfeWIPZnaOJtMlEx8I2Q9chT4Hd1P884J6j1Af7rFI8XSeFx8E7UmVo8+c92vnn28gxRGFi4LlACfiWVlwBoZ+2+x8Sb3cfxTALkkJhoUh7oXWCXdRJZn76hVj4YzFyc3SA8BAI6cMn4MxWN4YxD/C1mupxxKVfcu/CE9Ujjr2XfY8qWu7Gar6lrwQt0/AQ+Ejh0qkgkBFFj8VIIwlcU9GGc4OqyIDo5bAp+IsngrxaUIGg68YdkaNPIm4SF/4afSZRqUSksKd4GeUxZ7zLwrEgzCBd8GHgb7G+mI5DkOOMLYWL9XLKgY3U6GcnSJNUO99oBoHMEiLpTUioyXbeO8TwItalBQ5Wz2gRCzqvaXCsQagj4T+oaXI0jmyH4QpGPH6sltIwCiMyk+1Ix5nhuC3RAIL7MTacOr/sQaO/P8euGiAVeALY9Sbgm73', 'S2IIVU59OjzYZzgY8kcEo77Cg84OEGr7EIFm7yXFgRDeRYl9ZfMIDSkLfkOPUh4ksbdkueJJu4KnEi5WliJgvw==', 'oLDIdGnpEIhZtrM8g88wkQWg2d7WFud2S2VEtySk8xBsmM3znR8cDFDQkEVL5futxTIaGFtfbLlpAYc15Tcn+w==', 'vx30jPb7ahrviKPj/jXnE4qn2cNJhxOcpxsnGn/1ZPXCj/ygm12WmvrxfUByDGYMiH+019dPCrD9Xz6R/pWY8w==', 'gYCVnswLcxNczg3GNNpeA5GAIjf+I57q1lz9fjG6PhHRcLFUbmHan6tEaTuIe0Ztq6HRkNEz4dBHYjMDcpUAqg==', 'mel0Ev5fhSJFPyjA23mR8ylCK2rYlOCC9gGu8FIkeMiSkX4fW45YDG/fp/YMpUKh7Gp1NJLdEVY1HpnujK6Q8Q=='

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5200:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5148:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3476:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4768:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3508:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\1111110789_stripped.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 1111110789_stripped.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1111110789_stripped.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 1.0.RegAsm.exe.400000.0.unpack, Client/Connection/ClientSocket.cs

.Net Code: Invoke System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: initial sample	Static PE information: section name: .text entropy: 7.674793845031527
Source: initial sample	Static PE information: section name: .text entropy: 7.674793845031527

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.254425551.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1111110789_stripped.exe PID: 684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msdtc.exe PID: 5808, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.254425551.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1111110789_stripped.exe PID: 684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msdtc.exe PID: 5808, type: MEMORYSTR

Source: C:\Users\user\Desktop\1111110789_stripped.exe TID: 6136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1100	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1100	Thread sleep count: 99 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5012	Thread sleep count: 9790 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe TID: 4692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe TID: 5144	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 9790

Jump to behavior

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: RegAsm.exe, 00000001.00000003.267309500.000000000564E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.509118659.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000003.303655193.000000000565D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000003.273114833.000000000565D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1111110789_stripped.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 412000	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 414000	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1172008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 412000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 414000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 2C8008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 412000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 414000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DE8008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\1111110789_stripped.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\1111110789_stripped.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f

Source: RegAsm.exe, 00000001.00000002.511051788.000000000314A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000003.273153814.0000000005605000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.513309501.000000000328F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000001.00000002.522542242.0000000005618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managera

Source: C:\Users\user\Desktop\1111110789_stripped.exe	Queries volume information: C:\Users\user\Desktop\1111110789_stripped.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Queries volume information: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Queries volume information: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	Queries volume information: C:\Users\user\AppData\Roaming\msdtc\msdtc.exe VolumeInformation

Source: C:\Users\user\Desktop\1111110789_stripped.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.msdtc.exe.26ec204.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.254425551.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1111110789_stripped.exe PID: 684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msdtc.exe PID: 5808, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Source: 1111110789_stripped.exe, 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, msdtc.exe, 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: 1111110789_stripped.exe, 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, msdtc.exe, 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: 1111110789_stripped.exe, 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, msdtc.exe, 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	1 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Masquerading	1 Input Capture	21 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Side-Loading	312 Process Injection	1 Access Token Manipulation	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	2 Scheduled Task/Job	1 Disable or Modify Tools	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	21 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	312 Process Injection	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1111110789_stripped.exe	100%	Avira	HEUR/AGEN.1235903
1111110789_stripped.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	100%	Avira	HEUR/AGEN.1235903
C:\Users\user\AppData\Roaming\msdtc\msdtc.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.RegAsm.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1202835		Download File
0.0.1111110789_stripped.exe.ee0000.0.unpack	100%	Avira	HEUR/AGEN.1235903		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
venomunverified.duckdns.org	0%	Avira URL Cloud	safe
venom12345.duckdns.org	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
venom12345.duckdns.org	185.216.71.4	true	true		unknown
windowsupdatebg.s.llnwi.net	178.79.225.128	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
venomunverified.duckdns.org	true	Avira URL Cloud: safe	unknown
venom12345.duckdns.org	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.513013520.000000000324C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.216.71.4	venom12345.duckdns.org	Germany		43659	CLOUDCOMPUTINGDE	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	724751
Start date and time:	2022-10-17 19:25:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	1111110789_stripped.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@43/7@1/1
EGA Information:	Successful, ratio: 71.4%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 178.79.225.128
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
Execution Graph export aborted for target RegAsm.exe, PID 2044 because it is empty
Execution Graph export aborted for target msdtc.exe, PID 5808 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:26:11	Task Scheduler	Run new task: Nafifas path: "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe"
19:26:14	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.216.71.4	Scanned_V11230111111PDF-clean.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
venom12345.duckdns.org	Scanned_V11230111111PDF-clean.exe	Get hash	malicious	Browse	185.216.71.4
windowsupdatebg.s.llnwi.net	Brevaabneres.vbs	Get hash	malicious	Browse	178.79.242.0
	file.exe	Get hash	malicious	Browse	41.63.96.0
	file.exe	Get hash	malicious	Browse	95.140.230.128
	uCsyXFwI3z.exe	Get hash	malicious	Browse	95.140.230.192
	rundll32.exe	Get hash	malicious	Browse	41.63.96.128
	SecuriteInfo.com.Win64.PWSX-gen.29205.30420.exe	Get hash	malicious	Browse	178.79.225.128
	Rechnungszahlung,png.exe	Get hash	malicious	Browse	95.140.236.128
	olS4EmgVH6.exe	Get hash	malicious	Browse	178.79.242.0
	TT COPY.exe	Get hash	malicious	Browse	95.140.236.128
	CONTRACT.exe	Get hash	malicious	Browse	95.140.230.128
	iNs33x9LKJ.exe	Get hash	malicious	Browse	95.140.236.128
	payment copy.exe	Get hash	malicious	Browse	95.140.230.128
	Urgent RFQ No.6554342.vbs	Get hash	malicious	Browse	41.63.96.0
	SecuriteInfo.com.Variant.Lazy.253499.16416.9758.exe	Get hash	malicious	Browse	178.79.242.128
	adNYd44zMI.exe	Get hash	malicious	Browse	178.79.225.128
	swift copy.exe	Get hash	malicious	Browse	178.79.242.0
	Vamse.exe	Get hash	malicious	Browse	178.79.225.128
	Confirmaci#U00f3n de transferencia-687900.exe	Get hash	malicious	Browse	178.79.225.128
	Contrato 52000051-NDE--SIP-002.vbs	Get hash	malicious	Browse	178.79.242.0
	SecuriteInfo.com.Win32.PWSX-gen.10999.3561.exe	Get hash	malicious	Browse	178.79.242.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDCOMPUTINGDE	file.exe	Get hash	malicious	Browse	80.76.51.172
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	80.76.51.172
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	AD1-2001028L.exe	Get hash	malicious	Browse	185.216.71.120
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	Order10-2022.exe	Get hash	malicious	Browse	185.216.71.242
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	file.exe	Get hash	malicious	Browse	85.31.46.167
	PaidInvoice2763.exe	Get hash	malicious	Browse	185.216.71.242
	SecuriteInfo.com.Win32.TrojanX-gen.24965.9713.exe	Get hash	malicious	Browse	185.216.71.120
	Quote_05102022161754.exe	Get hash	malicious	Browse	185.216.71.120

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62397 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	62397
Entropy (8bit):	7.995531606726499
Encrypted:	true
SSDEEP:	1536:6VT6EGIYmIA2VKd1ZepH+41ZnDVrFyv+7XAZa7pAn:A6JI5IjOcTZDGvYXAZhn
MD5:	D15AAA7C9BE910A9898260767E2490E1
SHA1:	2090C53F8D9FC3FBDBAFD3A1E4DC25520EB74388
SHA-256:	F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
SHA-512:	7E1C1A683914B961B5CC2FE5E4AE288B60BAB43BFAA21CE4972772AA0589615C19F57E672E1D93E50A7ED7B76FBD2F1B421089DCAED277120B93F8E91B18AF94
Malicious:	false
Preview:	MSCF............,...................I.................-UIh .authroot.stl......5..CK..<Tk...c_.d......F...,Y.d...!......$E.KB..D..%J..}f...grs..}?>...s..<...=g.h.=W..W....b.i.....L......1:..c.0......1t.2t......w..........i,#.#..V..r...7.....W.)++.lF..he.4\|.../F.0:0...].#..I(.#.-... ...(.J....2{..`.hO..Gl+.be7y.j....)........<...........s.W..../\./...){n...s.........V..}.K.Wv3Y...A.9w9.Ea.x.W........\.;.i..d^...[..f.p..B..s.....60.<!.(.........!s0.#..!7.....J..........F...0...C..8..8.....4...<.X...!U.%.GN.!....G........F<..0.1..ZZz,....X.U.L..S......9.)..fy0Z.(.VS.{...{.=.h..a'.>U...AG....pu=.P}.......s.`@t((..JVdN.....!_@...\|.,..'0..3.`.DU...%0.Gi.4sv.#..5.U.?.......p.."........9.\|..j.<....b`.,...~..I.T.{..cY..X>....Z/..._.K>..>.3.#>X.%..b...5.YG.E.V._\?.....EpF}.....jz...,.f "h.{........U......k......U...3v....G.l[..x.{...=...r.....$.I....>.1..~.\k.W..[....X...@xp..,.qf.B..<yN:fL~ <............>.#...F...z....yw...N.o..,.c../.:..Ql...y.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	modified
Size (bytes):	290
Entropy (8bit):	2.991807164658857
Encrypted:	false
SSDEEP:	6:kKoDXiN+SkQlPlEGYRMY9z+4KlDA3RUe/:wDXJkPlE99SNxAhUe/
MD5:	B573724F28B1E471C72AFAC39D55E762
SHA1:	9897B4E38611848D5C0BD54C687A09B910D80F43
SHA-256:	9633FAA4EDAE3480D69D748ADC3F2B15700104A93F242B006AFDB0A3FD1D2F56
SHA-512:	345DF296293053B5F04B65E10CFB8C35864EF521398E8E4C16E059B4742CEC6A607F02E3D876071D960487D2AE43A6532F5E2F1A50EC072103DEA048FCF0EFE2
Malicious:	false
Preview:	p...... ...............(....................................................... ........K..........................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1111110789_stripped.exe.log

Download File

Process:	C:\Users\user\Desktop\1111110789_stripped.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\msdtc.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Roaming\msdtc\msdtc.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	318976
Entropy (8bit):	6.980537711280132
Encrypted:	false
SSDEEP:	6144:3baECFP6mYUjRMcvrKS6wPYZt/ZiGbG3FiP6Dz0tMneI4WQL2felwfZI/y:bmY+jKSfYdZrwu/
MD5:	BA218C4DB9606A955D3DD4E5ABA22B7F
SHA1:	927F94547DB0D01EB873807EC11950B641C207C2
SHA-256:	99735BF17537E921B53F4B4F2AADA8FECBF1D0627CE3139B878151D9FE3F4B9F
SHA-512:	3623F7624EDA9E6EAA4FBD835CF20B20D2EAB1A1DB5350CA61F6488944FAB4D3F7D80809488C80F1F3C7271E6F8327C9D62E83882D1FC8A43E18EDBE892F0D5A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Mc.................b...z......R.... ........@.. .......................@............@.....................................J........w................... ....................................................... ............... ..H............text...X`... ...b.................. ..`.rsrc....w.......x...d..............@..@.reloc....... ......................@..B................8.......H.......H=..H=...........z..x.............................................(H....0..........~4...~2...~/...~,...8u...8z...8.... ....8....8....,S~5...8.... ....8....8.....-.~6... ....8\|...(\|...,!~9.....(....&.-..9....~:...(....&.,..,.(m...8....(p...8\|...(s...8w...(f...8w...(v...8r.....8w...(f...8w...(y...8r...(f...8z........(H....0..........+O8P....8P...+~<...+M+N+O+W+[.0%,.2.+X.-..91.......-..X..~>....(.....,.2..%,...8.....8.....8.....+..+.(....8.....8.....8.....+....0..

C:\Users\user\AppData\Roaming\msdtc\msdtc.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.980537711280132
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	1111110789_stripped.exe
File size:	318976
MD5:	ba218c4db9606a955d3dd4e5aba22b7f
SHA1:	927f94547db0d01eb873807ec11950b641c207c2
SHA256:	99735bf17537e921b53f4b4f2aada8fecbf1d0627ce3139b878151d9fe3f4b9f
SHA512:	3623f7624eda9e6eaa4fbd835cf20b20d2eab1a1db5350ca61f6488944fab4d3f7d80809488c80f1f3c7271e6f8327c9d62e83882d1fc8a43e18edbe892f0d5a
SSDEEP:	6144:3baECFP6mYUjRMcvrKS6wPYZt/ZiGbG3FiP6Dz0tMneI4WQL2felwfZI/y:bmY+jKSfYdZrwu/
TLSH:	F4641A80FF63A3D9FC7BA9F6C722D9C1B2D4007D4346EBE2A594E233A2C8F614915516
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Mc.................b...z......R.... ........@.. .......................@............@................................

File Icon


Icon Hash:	cc8e9aab978ecef0

Static PE Info

General

Entrypoint:	0x418052
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x634D80B5 [Mon Oct 17 16:20:05 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18008	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x3779c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16058	0x16200	False	0.8509335275423728	data	7.674793845031527	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x3779c	0x37800	False	0.4026560740427928	data	6.519534167834536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1a0b4	0x90c2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x2319a	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584
RT_ICON	0x339e6	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016
RT_ICON	0x3ceb2	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560
RT_ICON	0x436be	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600
RT_ICON	0x48b6a	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896
RT_ICON	0x4cdb6	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600
RT_ICON	0x4f382	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224
RT_ICON	0x5044e	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400
RT_ICON	0x50dfa	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088
RT_GROUP_ICON	0x512b0	0x92	data
RT_VERSION	0x5137e	0x1f8	data	English	United States
RT_MANIFEST	0x515b2	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
185.216.71.4192.168.2.64449497082850454 10/17/22-19:26:14.287650	TCP	2850454	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT)	4449	49708	185.216.71.4	192.168.2.6
185.216.71.4192.168.2.64449497082848152 10/17/22-19:26:14.287650	TCP	2848152	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant)	4449	49708	185.216.71.4	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2022 19:26:14.180452108 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:14.207990885 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:14.208194971 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:14.258270979 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:14.287650108 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:14.296108007 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:14.328061104 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:14.375261068 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:18.068361998 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:18.159940004 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:18.160151005 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:18.236957073 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:31.758995056 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:31.830468893 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:31.830615044 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:31.869983912 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:32.001682043 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:32.029357910 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:32.189263105 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:32.285136938 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:32.361548901 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:32.361661911 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:32.439697981 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:37.400727987 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:37.455310106 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:37.483242989 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:37.533427954 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:45.392302036 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:45.471163034 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:45.471259117 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:45.500664949 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:45.549720049 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:45.577044010 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:45.627728939 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:45.705456018 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:45.705698013 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:45.783905029 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:59.033934116 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:59.111629963 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:59.111871004 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:59.141598940 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:59.200535059 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:59.228404999 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:59.265110016 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:59.338965893 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:26:59.343031883 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:26:59.424489021 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:07.374116898 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:07.426497936 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:07.454493999 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:07.504662991 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:12.690960884 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:12.783730984 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:12.786045074 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:12.815052032 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:12.880060911 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:12.907335997 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:12.935312033 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:13.018196106 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:13.018280983 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:13.096438885 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:26.460711002 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:26.771841049 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:26.800388098 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:27.084400892 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:27.111946106 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:27.115540981 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:27.162571907 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:27.191417933 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:27.235999107 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:27.314799070 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:27.317301035 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:27.392792940 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:37.375632048 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:37.429115057 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:37.673985004 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:37.674204111 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:38.283269882 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:38.283468962 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:39.970848083 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.064481020 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:40.068316936 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.097883940 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:40.148102999 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.176939964 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:40.193207026 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.470922947 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:40.472343922 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.507425070 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.820053101 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:40.908703089 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:53.621748924 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:53.704973936 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:53.705471992 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:53.735721111 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:53.789747000 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:54.645523071 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:54.645714998 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:55.648703098 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:55.721060038 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:27:55.721240997 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:27:55.814783096 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:28:07.229804993 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:07.315232992 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:28:07.315313101 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:07.347503901 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:28:07.400213003 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:07.428755045 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:28:07.429702997 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:07.728368998 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:07.736260891 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:28:07.736337900 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:07.756598949 CEST	4449	49708	185.216.71.4	192.168.2.6
Oct 17, 2022 19:28:08.040884972 CEST	49708	4449	192.168.2.6	185.216.71.4
Oct 17, 2022 19:28:08.068406105 CEST	4449	49708	185.216.71.4	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2022 19:26:14.062417984 CEST	58595	53	192.168.2.6	8.8.8.8
Oct 17, 2022 19:26:14.171480894 CEST	53	58595	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2022 19:26:14.062417984 CEST	192.168.2.6	8.8.8.8	0x3e01	Standard query (0)	venom12345.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 17, 2022 19:26:14.171480894 CEST	8.8.8.8	192.168.2.6	0x3e01	No error (0)	venom12345.duckdns.org	185.216.71.4	A (IP address)	IN (0x0001)	false
Oct 17, 2022 19:26:14.833364964 CEST	8.8.8.8	192.168.2.6	0xd1c4	No error (0)	windowsupdatebg.s.llnwi.net	178.79.225.128	A (IP address)	IN (0x0001)	false
Oct 17, 2022 19:26:14.833364964 CEST	8.8.8.8	192.168.2.6	0xd1c4	No error (0)	windowsupdatebg.s.llnwi.net	178.79.225.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	19:26:01
Start date:	17/10/2022
Path:	C:\Users\user\Desktop\1111110789_stripped.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\1111110789_stripped.exe
Imagebase:	0xee0000
File size:	318976 bytes
MD5 hash:	BA218C4DB9606A955D3DD4E5ABA22B7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.258791467.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	19:26:08
Start date:	17/10/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0xe20000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000001.00000002.509335673.00000000015E5000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000001.00000002.508512430.0000000001585000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000001.00000002.513229580.000000000327E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000000.254425551.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000001.00000002.509118659.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000001.00000002.510434732.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	19:26:09
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	19:26:09
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	19:26:09
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	19:26:09
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	19:26:09
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\Desktop\1111110789_stripped.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	19:26:10
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Imagebase:	0x80000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	19:26:10
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	19:26:11
Start date:	17/10/2022
Path:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Imagebase:	0xe20000
File size:	318976 bytes
MD5 hash:	BA218C4DB9606A955D3DD4E5ABA22B7F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Show Windows behavior

Target ID:	10
Start time:	19:26:22
Start date:	17/10/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0x20000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000A.00000002.298467829.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000A.00000002.303426131.0000000004968000.00000004.00000800.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Target ID:	14
Start time:	19:26:23
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5200, Parent PID: 2148

General

Target ID:	17
Start time:	19:26:24
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	18
Start time:	19:26:24
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 4768, Parent PID: 5288

General

Target ID:	20
Start time:	19:26:24
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	21
Start time:	19:26:24
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	22
Start time:	19:26:24
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Imagebase:	0x80000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	24
Start time:	19:26:25
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	27
Start time:	19:27:01
Start date:	17/10/2022
Path:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Imagebase:	0x390000
File size:	318976 bytes
MD5 hash:	BA218C4DB9606A955D3DD4E5ABA22B7F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	28
Start time:	19:27:09
Start date:	17/10/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0xad0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000001C.00000002.402891320.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000001C.00000002.403928683.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Target ID:	29
Start time:	19:27:09
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Roaming\msdtc
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5352, Parent PID: 2408

General

Target ID:	30
Start time:	19:27:10
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	31
Start time:	19:27:10
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 3476, Parent PID: 3508

General

Target ID:	32
Start time:	19:27:10
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	19:27:10
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe" "C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Imagebase:	0x7ff603c50000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exePID: 5540, Parent PID: 3508

General

Target ID:	34
Start time:	19:27:10
Start date:	17/10/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\msdtc\msdtc.exe'" /f
Imagebase:	0x80000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	19:27:11
Start date:	17/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	38
Start time:	19:28:00
Start date:	17/10/2022
Path:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\msdtc\msdtc.exe
Imagebase:	0x230000
File size:	318976 bytes
MD5 hash:	BA218C4DB9606A955D3DD4E5ABA22B7F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000026.00000002.509598735.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	36.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.8%
Total number of Nodes:	52
Total number of Limit Nodes:	2

Executed Functions

Function 01743C80 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 01743F10

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: d4eaefc28dac2f7ec1014992a404fb8d21c79e821676d23d8f00ea4a5d9fadd0
Instruction ID: 71dd5695fcbb79da40ffacb3dc2e833a79b35d0eebc08da23be941b25458bd83
Opcode Fuzzy Hash: d4eaefc28dac2f7ec1014992a404fb8d21c79e821676d23d8f00ea4a5d9fadd0
Instruction Fuzzy Hash: D3A15971E002299FDB24CFA9C8857DDBBB2FF48304F0481A9E959A7391DB749985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01744070 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01744127

Strings

X, xrefs: 01744084

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: ContextThread
String ID: X
API String ID: 1591575202-3081909835
Opcode ID: f6ba3cd12a107de0f0521cfeaecbd01bbc664663f981b1558884b406b61c4513
Instruction ID: de61e184ae5177ca56ba4041d31b7b38dab2e6ae2e98ca237a2297a8c35279bf
Opcode Fuzzy Hash: f6ba3cd12a107de0f0521cfeaecbd01bbc664663f981b1558884b406b61c4513
Instruction Fuzzy Hash: E82168B1E042198FDB00CFA9D8457EEFBF0FF49214F04829AD418E7251D7349A149BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01744500 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0174449F

Strings

=, xrefs: 01744514

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: ResumeThread
String ID: =
API String ID: 947044025-2322244508
Opcode ID: 176809b7f5dd145b4bd203cccff9f1ccc2101845bbfaa91527deb5fbce743099
Instruction ID: 76fe914498c9048c9afba3612e6fa6227b140d4c53ff317ea0db8e1145992a16
Opcode Fuzzy Hash: 176809b7f5dd145b4bd203cccff9f1ccc2101845bbfaa91527deb5fbce743099
Instruction Fuzzy Hash: A0F0CD718082448FDB51DBA8E4143EAFBF0AB82218F20818BD84AD2A51C3790A09DB92

Uniqueness

Uniqueness Score: -1.00%

Function 017438F0 Relevance: 2.2, APIs: 1, Instructions: 705
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 01743F10

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 297605c0c85654d5fcde341be0b374c2d60ed77fb86877e64877510af2b0928c
Instruction ID: d5ee577160667d0bd0f8e78d55f4faecee827cfdc22875c2e15a34a45488635f
Opcode Fuzzy Hash: 297605c0c85654d5fcde341be0b374c2d60ed77fb86877e64877510af2b0928c
Instruction Fuzzy Hash: BDB18971E002298FDB11CFA8D8817DDBBB2FF49304F0481AAE959A7281DB349985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01744300 Relevance: 1.6, APIs: 1, Instructions: 68
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01744395

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 57e24c7f53b8cd3c78eb12cfad5bf19aca5a6d027e46154f276a0d6c3d658af6
Instruction ID: d6c013eb05c290e65399e7129f7776f289fb5eed91e9ce542e8b6c430e11d26a
Opcode Fuzzy Hash: 57e24c7f53b8cd3c78eb12cfad5bf19aca5a6d027e46154f276a0d6c3d658af6
Instruction Fuzzy Hash: 6F21F4B1900259DFDB10CFA9D885BDEFBF4FB48314F04852AE519A7240D374A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01744308 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01744395

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8ff9a06a327eb9f0cabb6319016b1d98b06354559dbc4c687879d8c33baf29a0
Instruction ID: b24401163a151412e6346bae1789b2ccc939258f89468bc69e09810bc3db3f1d
Opcode Fuzzy Hash: 8ff9a06a327eb9f0cabb6319016b1d98b06354559dbc4c687879d8c33baf29a0
Instruction Fuzzy Hash: 1D21E2B1900259DFDB10CF9AD885BDEFBF4FB48324F04842AE919A3240D778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017440B0 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01744127

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 90515d84494842c58a7e11b3a12cd27372353fb19244903a51c1fc3389250dd0
Instruction ID: da552da514bef14c08222bfae00705c32201fe5a3fefc273bc3bf89433e251da
Opcode Fuzzy Hash: 90515d84494842c58a7e11b3a12cd27372353fb19244903a51c1fc3389250dd0
Instruction Fuzzy Hash: 612117B1E006199FDB00CF9AD885BDEFBF4BB48224F14812AD418F3640D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 017440AE Relevance: 1.6, APIs: 1, Instructions: 57
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01744127

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e25c943b8fe849ba041ba39701ed6d58494ce90ec63244f6704fc0080cebe669
Instruction ID: 02b86311e999257f18eb49f4b1bae2b6bfe898b64708a60a66e949b02c1f1064
Opcode Fuzzy Hash: e25c943b8fe849ba041ba39701ed6d58494ce90ec63244f6704fc0080cebe669
Instruction Fuzzy Hash: 6B1117B1E106199FDB00CF9AD985BDEFBF4BB48224F14812AD418F3640D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 01744170 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 017441E6

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: df4264e1fdd0a84f3a16eacfa6917172eb34790b1f9de31bef8dfb664d0e9e7b
Instruction ID: 48b11206dc340609fb114bcc6b552e756ac88b07dab3e3121e773729fc9d3baf
Opcode Fuzzy Hash: df4264e1fdd0a84f3a16eacfa6917172eb34790b1f9de31bef8dfb664d0e9e7b
Instruction Fuzzy Hash: FB2106B59002499FDB10CF9AC884BDEFBF4FB48320F148429E558A3250D374A545DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0174416E Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 017441E6

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 885dc9c408431b71514aacf5aad79d6b0aef5b82ad43b01a9a62db085637fea2
Instruction ID: 85fd43f2a8c761500e7b3bc341aee131247d38a139c96ba30a60131d24459c51
Opcode Fuzzy Hash: 885dc9c408431b71514aacf5aad79d6b0aef5b82ad43b01a9a62db085637fea2
Instruction Fuzzy Hash: AA2114B5900249DFDB10CF9AC984BDEFBF4FB48320F14842AE558A3250D378A645DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01744258 Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 017442CB

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b126101fa451416178350a743a40d755037e9688979779a557111cd122dd5b0f
Instruction ID: 1b56aafd7f3dd10c8170d71d27b71e8fdfe1036c568ccc5f299a3c89d00b2236
Opcode Fuzzy Hash: b126101fa451416178350a743a40d755037e9688979779a557111cd122dd5b0f
Instruction Fuzzy Hash: E6110FB6800248DFDB10CF99D988BDEBBF4FB88324F14841AE529A7250C335A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01744260 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 017442CB

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0741564f63dccef1ccaaf4b32182d398eeac80294c3dd2671fe69e80edf4b0de
Instruction ID: b4e386b85ab3bf14683f5bc1c242afa7eef21b5a9f5400c5f98dd1356c6a6899
Opcode Fuzzy Hash: 0741564f63dccef1ccaaf4b32182d398eeac80294c3dd2671fe69e80edf4b0de
Instruction Fuzzy Hash: CB1110B58002489FCB10CF9AC888BDEFFF4FB88324F148429E529A7250C375A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01744440 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0174449F

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: de4155be671fbf1208ac83d43e94ca2d30fea0f7ac17c40d8bdc0e64f37fcd6a
Instruction ID: 5751456fba980058dcdadaf85ad2b7b909ff8898fd833d659ab336c6013b5dde
Opcode Fuzzy Hash: de4155be671fbf1208ac83d43e94ca2d30fea0f7ac17c40d8bdc0e64f37fcd6a
Instruction Fuzzy Hash: EA1123B18002588FDB10CF9AD489BDEFFF8FB88324F14841AD519A3240C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0174443E Relevance: 1.5, APIs: 1, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0174449F

Memory Dump Source

Source File: 00000000.00000002.258316466.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_1111110789_stripped.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 70d48547425470b8891469b15a9b82e57e9c4b68724541443d7bd3db0ea71913
Instruction ID: d3f0591564de54824933ecd698882aed24a958007719721038faa6740d08fb35
Opcode Fuzzy Hash: 70d48547425470b8891469b15a9b82e57e9c4b68724541443d7bd3db0ea71913
Instruction Fuzzy Hash: 3B11EEB58002598FDB10CF99D589BDEFBF4AB88324F14845AD559B7640C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016ED3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258206438.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16ed000_1111110789_stripped.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c8c10f644a08a01272611c58db9e61be84c9b0f31b781551da6d1eb07b5dc4
Instruction ID: 8e07b3e23d4083d73f88e18e1dec40165c38f16950f158a45615aa4a96e76f2f
Opcode Fuzzy Hash: c6c8c10f644a08a01272611c58db9e61be84c9b0f31b781551da6d1eb07b5dc4
Instruction Fuzzy Hash: 052145B1505200DFDB11DF54DDC8B6ABBA5FB98324F24C668E9090B307C336E806C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 016ED4B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258206438.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16ed000_1111110789_stripped.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5e371d1f986dc84d6084466d082b5c3efdf03e3034917b38626bccc501293d
Instruction ID: ce4fdbaee8bbdb8693b411febab32581ffe109125dec01c862a9518cc1b044c5
Opcode Fuzzy Hash: 0a5e371d1f986dc84d6084466d082b5c3efdf03e3034917b38626bccc501293d
Instruction Fuzzy Hash: 172106B1505240DFDB15DF54DCC8B26BBA5FB88328F248669E9094B207C336D856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 016ED4AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258206438.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16ed000_1111110789_stripped.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction ID: d847ab721f6be274538aa48b518cdf3779dcb915774f56b8f2ae29759a40d50f
Opcode Fuzzy Hash: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction Fuzzy Hash: 5211AFB6504280DFDB12CF54D9C4B16BFB1FB84324F24C6A9D8050B656C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 016ED3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258206438.00000000016ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 016ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16ed000_1111110789_stripped.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction ID: 0fdd26c4905cc6a343c139b2c2789c8433541c6646e834c318bdf876997838aa
Opcode Fuzzy Hash: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction Fuzzy Hash: 9211DF76405280CFDB12CF14D9C8B5ABFB2FB94320F24C6A9D8090B617C336E45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6128, Parent PID: 684COMMON

Execution Graph

Execution Coverage:	19.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 017F2118 Relevance: 1.9, APIs: 1, Instructions: 449
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 017F25E9

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 27d55c67460ce2f57e8f81512b4d939d69d56be3f4720ad2e0a4171a6c3b3982
Instruction ID: 7fd4e06403e789412569ccfe1213196f38e12f76e3f1ba0ab0b5306da3d088b6
Opcode Fuzzy Hash: 27d55c67460ce2f57e8f81512b4d939d69d56be3f4720ad2e0a4171a6c3b3982
Instruction Fuzzy Hash: 4AE19E71F002158BDB15CAAD8C903AFB6A3AFC8224F19822DDB25DB7D6EB74DC015791

Uniqueness

Uniqueness Score: -1.00%

Function 017FE960 Relevance: 1.6, Strings: 1, Instructions: 345
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<sl, xrefs: 017FEBBD

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID: <sl
API String ID: 0-3960564624
Opcode ID: ac735890b9ab1e8a89468ac908579f2b702d28aaf850ab8a4b2bf43c1573163b
Instruction ID: f280736ef47793c721b690a5bf1dbecfa7da9e3ceac046202e11d25af97ee978
Opcode Fuzzy Hash: ac735890b9ab1e8a89468ac908579f2b702d28aaf850ab8a4b2bf43c1573163b
Instruction Fuzzy Hash: 2FD18070E00209CFCB15DFA8C484AAEFBF2FF88314F15855AE655AB361DB34A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017F2558 Relevance: 1.6, APIs: 1, Instructions: 66
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 017F25E9

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 63b63fe8cbaf1169312d44fbffca700bd0aa200ea8aebfade6d743c4b87eca92
Instruction ID: 6396a3aea023abf20a8538c77d3dcf9cade339b59affc2918d998f97e73d46dc
Opcode Fuzzy Hash: 63b63fe8cbaf1169312d44fbffca700bd0aa200ea8aebfade6d743c4b87eca92
Instruction Fuzzy Hash: 042122B1D042499FCB10CFA9D884AEEFBF1FF48314F20842AE569A7250C7359905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017F9FE8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622066199a1f970493174c3b14a94762b9cb808a5c838c35cd01ef614c6431ff
Instruction ID: 3d8a8205bb62deef5b945c17dbf41a741e25f8a255e64bfb0843ac9b320dc09c
Opcode Fuzzy Hash: 622066199a1f970493174c3b14a94762b9cb808a5c838c35cd01ef614c6431ff
Instruction Fuzzy Hash: 2DB14770E042198FDB10CFA9C8857EEFBF2AF88358F15812DD919A7394EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017FACC0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a330e3a1575a7fcffec48b775274003c5d1f02b2042c68e76fb5603d1da8baac
Instruction ID: 2e1713e9969be467298ea594eeb75d53163c1a143da59914e3e90ba0f3423cac
Opcode Fuzzy Hash: a330e3a1575a7fcffec48b775274003c5d1f02b2042c68e76fb5603d1da8baac
Instruction Fuzzy Hash: 71B12B70E002098FDB14CFA9D8857DEFBF2AF88754F14812DE519AB394EB749885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017F7504 Relevance: 1.6, APIs: 1, Instructions: 91
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 017F75DA

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5f535105a1fa8bb952dfba5ef93c8d2aca1cff4522f91bd3e56cf13dd42b357f
Instruction ID: cda80ba4a4ab0b496b154818b1a32413c2dddd5115463d19264aefbed359fb8c
Opcode Fuzzy Hash: 5f535105a1fa8bb952dfba5ef93c8d2aca1cff4522f91bd3e56cf13dd42b357f
Instruction Fuzzy Hash: E63102B0D142998FDB18CFA8D88979EFFB1AB08314F14852EE915AB381E7749445CF91

Uniqueness

Uniqueness Score: -1.00%

Function 017F55CC Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 017F75DA

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1247f0f3c2280c715445c4d4f4b56ed3dc78b48c5f7bed296c64ad33e2039001
Instruction ID: 117b23a6d5cc61f9f5495ca40996b44aeb44d8e8c9117ef27f4f2cf642733089
Opcode Fuzzy Hash: 1247f0f3c2280c715445c4d4f4b56ed3dc78b48c5f7bed296c64ad33e2039001
Instruction Fuzzy Hash: 773125B0D042998FDB18CFA8C88979EFBF1BB08314F14852DE915AB380E7749845CF95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 017F1590 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def2b079c617530c271c8185f4e69d442deb27283245e4b0b1ff847ce19eebd8
Instruction ID: 2df838c1d06aa5f835a1a2744c1a356d13507cf08ea99397a42c19250179a2e2
Opcode Fuzzy Hash: def2b079c617530c271c8185f4e69d442deb27283245e4b0b1ff847ce19eebd8
Instruction Fuzzy Hash: 8CC17E31F00255C7DB15CA7D8C903AFA1975BC4224F9D823DEB66DBBCAEE7499016381

Uniqueness

Uniqueness Score: -1.00%

Function 017F1580 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3010695c3dd636c1519d857be99f388c10d3c964d1b0869e629bd93d69111492
Instruction ID: be0770a220274c59411b7e5f55fbc6f98a5d96a7c4e97706c46bf820e458b0a8
Opcode Fuzzy Hash: 3010695c3dd636c1519d857be99f388c10d3c964d1b0869e629bd93d69111492
Instruction Fuzzy Hash: C7916D32F0035587EB18C9AD8C903AFA5975BC4225F8D813DAB46DBB86EE74D9066380

Uniqueness

Uniqueness Score: -1.00%

Function 017F2109 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89eeeb0d2c669c8cb9dcfc3f79bd900fc882490b298ea68942c5e08d169c5d6
Instruction ID: 3533930b5697df9b2b64ff9a0989ffea73559648b46b37b9b9e7572eb9397b9b
Opcode Fuzzy Hash: e89eeeb0d2c669c8cb9dcfc3f79bd900fc882490b298ea68942c5e08d169c5d6
Instruction Fuzzy Hash: 3B916B36F0421547EB09C9AD8C903AFA5A3AFC4215F4DC13D9B46DBB8BEEB4DD055284

Uniqueness

Uniqueness Score: -1.00%

Function 017F9CA0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.509902637.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69032ca617be8987d22843bee07d43b9d7745dbeec7ea4776cb78cd4c64c1b8f
Instruction ID: 895f9b3fd327e18e30899718103625642d9cf7b6c74045563bfe3f9d67aa6896
Opcode Fuzzy Hash: 69032ca617be8987d22843bee07d43b9d7745dbeec7ea4776cb78cd4c64c1b8f
Instruction Fuzzy Hash: 1F915C70E002099FDB14CFA9C9857DEFBF2AF88318F14812DE619A7394DB749885CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: msdtc.exePID: 3724, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	40.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	2

Executed Functions

Function 014D4070 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 014D4127

Strings

X, xrefs: 014D4084

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: ContextThread
String ID: X
API String ID: 1591575202-3081909835
Opcode ID: 23a86e7d1a552b5aa48e1b2a92b6640822667fa4fd6607a0e3f97a5d9d887a27
Instruction ID: cd349bb36f40c77a2a1b1c2d983a15390f1425516033026f768ad96b782e7513
Opcode Fuzzy Hash: 23a86e7d1a552b5aa48e1b2a92b6640822667fa4fd6607a0e3f97a5d9d887a27
Instruction Fuzzy Hash: 29215C71A0425A9FDB00CFA9D8597EEFFF4EF09314F08829AD518E7651C77469048FA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D4500 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 014D449F

Strings

=, xrefs: 014D4514

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: ResumeThread
String ID: =
API String ID: 947044025-2322244508
Opcode ID: 5ab182d1d32f8cd7edfc2428232cc6ae49bef3faa6330dea614aed61738991b1
Instruction ID: 94ecc38c1dfab0580a89cb43292254777b00558a1d2c64d08d880ab508ae0de7
Opcode Fuzzy Hash: 5ab182d1d32f8cd7edfc2428232cc6ae49bef3faa6330dea614aed61738991b1
Instruction Fuzzy Hash: D8F0C231804344CFDF21DFA8E4A83DABBF0EB82318F24419BC449D3A61C3795945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 014D3C74 Relevance: 1.8, APIs: 1, Instructions: 267
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 014D3F10

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 9c76d2c0fc0ccc0c0e602c1c9938fb2d44392439c23b23985bfa16634c50d2ef
Instruction ID: 2982753a561c13aa7be9dc830d5e7e3c3dab57b1bd68d615ca02db99c206580e
Opcode Fuzzy Hash: 9c76d2c0fc0ccc0c0e602c1c9938fb2d44392439c23b23985bfa16634c50d2ef
Instruction Fuzzy Hash: D6A15C71E002199FDF10CF69C9557DEBBB2FB48314F0481AAE958A73A0DB749985CF82

Uniqueness

Uniqueness Score: -1.00%

Function 014D3C80 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 014D3F10

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: f585cb05cb60075b59a8875d586cb74920fb893f95621e25770e07332d9a1a80
Instruction ID: 626a54585e83d4f577f7cc775a7ec4e6df80403c2f54a4c0a865d429bd1e122f
Opcode Fuzzy Hash: f585cb05cb60075b59a8875d586cb74920fb893f95621e25770e07332d9a1a80
Instruction Fuzzy Hash: 93A14B71E002198FDF14CF69C9517DEBBB2FB48314F0481AAE958A73A0DB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 014D4300 Relevance: 1.6, APIs: 1, Instructions: 68
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 014D4395

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 617e6ffe1b8e64c8364137b93a5473b51073e3d65565eb6f41d90b8f1169493f
Instruction ID: 8edf5c2de1f056f148ed829c7e79bf9003ccb47af56ea53c69212fd2de2111dd
Opcode Fuzzy Hash: 617e6ffe1b8e64c8364137b93a5473b51073e3d65565eb6f41d90b8f1169493f
Instruction Fuzzy Hash: 0A21F3B1900259DFDF10CFAAD885BDEBBF4FB48310F14852AE518A7650D774A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D4308 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 014D4395

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3e64c829c70867892167961a8f8351f479c51c21e5d2ecb1ab4043f5d1280132
Instruction ID: 962dc9b18998be668091de02c9670e28e044493ff34e0f04a0e9d67109bac166
Opcode Fuzzy Hash: 3e64c829c70867892167961a8f8351f479c51c21e5d2ecb1ab4043f5d1280132
Instruction Fuzzy Hash: 4F21E4B1A00259DFDF10CF9AD885BDEBBF4FB48314F14842AE918A3750D774A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D40AE Relevance: 1.6, APIs: 1, Instructions: 59
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 014D4127

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 6155ab32a15f6cca315aa927b55d90597e8f70266c2910e92846e9f8a20dd3df
Instruction ID: 3f9d1c45a34d1fd5365ce8fa19f3228097387d4689fb09b84dce6ee238fb6c5c
Opcode Fuzzy Hash: 6155ab32a15f6cca315aa927b55d90597e8f70266c2910e92846e9f8a20dd3df
Instruction Fuzzy Hash: 22211AB1E006199FDB10CFAAD885BDEFBF4FB48224F54812AD518B3740D774A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D40B0 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 014D4127

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: c7630479bb1caa192e68096fd6a89eb00a3380942f9806f81b6d54b6f6ac4298
Instruction ID: a2759607659cceeb73756af84247b789a9be52360230cf4b055942a7b7852804
Opcode Fuzzy Hash: c7630479bb1caa192e68096fd6a89eb00a3380942f9806f81b6d54b6f6ac4298
Instruction Fuzzy Hash: 5A211AB1E006199FDB10CF9AD885BDEFBF4BB48224F54812AD518B3740D774A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D416E Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014D41E6

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f5566e19f2e279fb86bb428d8ebd99a22c71eca89632b235e09fffa6ed2ccc73
Instruction ID: c9ea9c710a4cd618abae9f445a3908f28cbd76b170d5e2cffef3219906dc18d5
Opcode Fuzzy Hash: f5566e19f2e279fb86bb428d8ebd99a22c71eca89632b235e09fffa6ed2ccc73
Instruction Fuzzy Hash: 0221D6B5900249DFDB10CF9AD884BDEFBF4FB48320F14842AE558A7650D774A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D4170 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014D41E6

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 24e5d397cdffb4606264b33b4158e8c4f27c1b91409801abdec0b0d79bff9b49
Instruction ID: 07d58cbf491ccedc8b055f5ce1f2784be92769705bba373bdad2e947056f499f
Opcode Fuzzy Hash: 24e5d397cdffb4606264b33b4158e8c4f27c1b91409801abdec0b0d79bff9b49
Instruction Fuzzy Hash: 3A21D6B5900249DFDB10CF9AC884BDEBBF4FB48320F14842AE558A7650D774A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D4258 Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 014D42CB

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a6eea7d64b98ae62114ec80414e79ad4c0799c3eb4ed45e8755a0a26c7641788
Instruction ID: 83629ed95c1bdb462b270ba7a947c82d1b3b1d30538f05e52ec0c0c01cb99c28
Opcode Fuzzy Hash: a6eea7d64b98ae62114ec80414e79ad4c0799c3eb4ed45e8755a0a26c7641788
Instruction Fuzzy Hash: EA1102B5800248DFDB10CF9AD888BDFBBF4FB48324F14881AE628A7650C775A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D4260 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 014D42CB

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1793b6c1e8a37e6ceb29e7be9642f519b63fe7857f5c40ceec0ddd179464ef16
Instruction ID: 508954df04f2ef3149cff8dcb662ee9bed15fa0509d5d532a09d726955170f02
Opcode Fuzzy Hash: 1793b6c1e8a37e6ceb29e7be9642f519b63fe7857f5c40ceec0ddd179464ef16
Instruction Fuzzy Hash: 7011DFB59002499FDB10CF9AD888BDEBBF4EB48324F14841AE628A7650C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D443E Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 014D449F

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9b05f2e52ba415a90ab9015524b57a39fdb06974f8af722b9a7c00add211b85d
Instruction ID: b6b27800fe7499a9ad069ab5b39767c088afad96b3d352e4c6a2ca8a6ecb9d54
Opcode Fuzzy Hash: 9b05f2e52ba415a90ab9015524b57a39fdb06974f8af722b9a7c00add211b85d
Instruction Fuzzy Hash: C31112B18002588FDB10CF9AD488BDEFBF8EB48324F14841AD518A7740C774A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D4440 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 014D449F

Memory Dump Source

Source File: 00000009.00000002.291398068.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14d0000_msdtc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4d395a867128e5f3a41b071bd05ca6c9ff0515bf29d88aefb5b929247b0f4ad2
Instruction ID: 4375b3a33f7e61d7823867c5d56aeb524b50b61d8a30b6132174727d144a4e78
Opcode Fuzzy Hash: 4d395a867128e5f3a41b071bd05ca6c9ff0515bf29d88aefb5b929247b0f4ad2
Instruction Fuzzy Hash: A01112B18002588FDB10CF9AD488BDEFBF8EB48324F14841AD518A3740C774A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 2044, Parent PID: 3724COMMON

Executed Functions

Function 0050D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.297821248.000000000050D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0050D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_50d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84f9560ba04bf36ad896846441e11fdd43fd922eb8563b0954a3d920cc5b25f
Instruction ID: d6513a1d32024ad8cfe9fa101768734bcafe6f704f982423bebe852f213aa1b9
Opcode Fuzzy Hash: c84f9560ba04bf36ad896846441e11fdd43fd922eb8563b0954a3d920cc5b25f
Instruction Fuzzy Hash: F021DEB1504240DFDF148F54D8C0B2ABF71FB98324F24C969E9094A286C376E846C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 0050D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.297821248.000000000050D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0050D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_50d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6592a2ffbec7cb030ff3a8b202f047f88511b758034c60d7b13c99de5a8e64a1
Instruction ID: c92d5e28eb764ee6e4289fd7443be2243d60e7d8802e08e7c991a15b62c554a6
Opcode Fuzzy Hash: 6592a2ffbec7cb030ff3a8b202f047f88511b758034c60d7b13c99de5a8e64a1
Instruction Fuzzy Hash: ED11E676504280DFDF11CF50D9C4B1ABF71FB94324F24C6A9D8490B656C376E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: msdtc.exePID: 1584, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	35%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	50
Total number of Limit Nodes:	2

Executed Functions

Function 00C038F0 Relevance: 2.2, APIs: 1, Instructions: 705
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00C03F10

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 5e1ec98d99e0f242c1c7b868c662d3492cdc2142858becdb420637c2010b7ea5
Instruction ID: 240932e8d46848cc6275e1a29f0cbb0b5242b6863d49b13f934d8ae0e495515e
Opcode Fuzzy Hash: 5e1ec98d99e0f242c1c7b868c662d3492cdc2142858becdb420637c2010b7ea5
Instruction Fuzzy Hash: 3EB18C71E002598FDB11CFA8D8817DDBBB6EF49304F0081AAE859E7291DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C03C80 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00C03F10

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: cc7fbab049de76ea4095ff225d45495d8f5cbbfcc867f43286cce5a6471cd0db
Instruction ID: b389a9b850c951a5c7a2141ca80d493c2e88edea4f46dcf75b6ffc9a6d9676c1
Opcode Fuzzy Hash: cc7fbab049de76ea4095ff225d45495d8f5cbbfcc867f43286cce5a6471cd0db
Instruction Fuzzy Hash: 20A13B71E002599FDB10CFA9C9817DDBBB6FB48304F0481A9E819A7291DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C04300 Relevance: 1.6, APIs: 1, Instructions: 67
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00C04395

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ae6246f6bbd80615400ee122f943c49236f3918576fb50041a30c9a30dd29eac
Instruction ID: c9cf2146c1e27b0861f22b7808bad1aa8af319dbda299469f2c15027731b445b
Opcode Fuzzy Hash: ae6246f6bbd80615400ee122f943c49236f3918576fb50041a30c9a30dd29eac
Instruction Fuzzy Hash: 9B2105B1900259DFDB10CFAAD885BDEBBF4FB48324F14842AE559A3250D778A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C04308 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00C04395

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6f872c6190f62f3374933e061484588d5fdd0faaf4bef145656228ca5ba48e8b
Instruction ID: d5996f7b780f17079a70ae3623c14d8dfdf31d6ae909550f93ae9196b18f9091
Opcode Fuzzy Hash: 6f872c6190f62f3374933e061484588d5fdd0faaf4bef145656228ca5ba48e8b
Instruction Fuzzy Hash: 4421E4B1900259DFDB14CF9AD885BDEBBF4FB48324F14842AE918A3290D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C040AE Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00C04127

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: eefde06007e96d3adc4f482f44b6b11f92e6cc057bd371983228372fd8c025c2
Instruction ID: f2f179d094714cdb12be3cc29b147f52dfed18c12054c4cf9af00fa44ab31f5f
Opcode Fuzzy Hash: eefde06007e96d3adc4f482f44b6b11f92e6cc057bd371983228372fd8c025c2
Instruction Fuzzy Hash: 032136B1D0021A9FDB00CF9AD985BDEFBF4BB48324F04812AD518A7240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C040B0 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00C04127

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 25047017313e7c6308d48510e7f66e87a5aa094afc5f290d6397ef61488c9c59
Instruction ID: 8ad5ced6b88aaa55e89bbf047f9452c153db66efdda35bba72398004377eac76
Opcode Fuzzy Hash: 25047017313e7c6308d48510e7f66e87a5aa094afc5f290d6397ef61488c9c59
Instruction Fuzzy Hash: 022117B1D106199FDB04CF9AD985BDEFBF8BB48324F14812AD518B3240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0416E Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00C041E6

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bf164766fbaa729f10ffee0f83459f8eda31ad06cf83ea7ded4e4c1d411f67c2
Instruction ID: c633367cc69179deec3f61dd15d3c8ea8ce68017a5d41386b747bbf3050aaee4
Opcode Fuzzy Hash: bf164766fbaa729f10ffee0f83459f8eda31ad06cf83ea7ded4e4c1d411f67c2
Instruction Fuzzy Hash: 9821F4B5900249DFDB10CF9AC884BDEBBF4FB48320F14842AE568A7250D374A685CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C04170 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00C041E6

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 446aea8d76fc16ad00e5d1a0ef645e789424a7a7c429451329e86d4b32dc5b34
Instruction ID: e9acd1073de01dfea3f3efded11e7814fda0cebcbbd838c36a4a20c5dd8a48d3
Opcode Fuzzy Hash: 446aea8d76fc16ad00e5d1a0ef645e789424a7a7c429451329e86d4b32dc5b34
Instruction Fuzzy Hash: 5421D6B5900259DFDB10DF9AC884BDFBBF4FB48320F148429E558A7250D774A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C04258 Relevance: 1.6, APIs: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00C042CB

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e4b04c8dfdb00c787a98b937301ac67b1e4cce5be9710fc26b17a3d256583ce2
Instruction ID: 1acdd9d5091b0eff46a28f5bd1655488c7c4f3afd8ed96b34b8789c69a357508
Opcode Fuzzy Hash: e4b04c8dfdb00c787a98b937301ac67b1e4cce5be9710fc26b17a3d256583ce2
Instruction Fuzzy Hash: D611EFB59002499FDB10CF9AC884BDEBFF4EB48324F14841AE668A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C04260 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00C042CB

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e6c3011c053a123f14acfba20d8b6eedad225485fdcc1a7353fd29cc30b79657
Instruction ID: 31407558b263588cd2548d176406d2dfdad37d4c10d51516f44d32faca1a10fe
Opcode Fuzzy Hash: e6c3011c053a123f14acfba20d8b6eedad225485fdcc1a7353fd29cc30b79657
Instruction Fuzzy Hash: 8011E0B5900249DFDB10CF9AD888BDFBBF8FB48324F148419E629A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C04440 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00C0449F

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 659fd614ca1d2cbb332fd15280ed614faaa6f682d81afeadde7c07cfeecf62d3
Instruction ID: fee09be722c200c3c328b85ec59fb6a883d6082eef3921def8249ecf8880123e
Opcode Fuzzy Hash: 659fd614ca1d2cbb332fd15280ed614faaa6f682d81afeadde7c07cfeecf62d3
Instruction Fuzzy Hash: A11123B1800258CFDB10CF9AD488BDFFBF8EB48324F14841AD519A3240C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0443E Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00C0449F

Memory Dump Source

Source File: 0000001B.00000002.389691356.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_c00000_msdtc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e9273f4c747aa4a5fcbaf65099aa854806d68693b124c73af15023d43382e017
Instruction ID: 87bb46d11618a6e36d738105fa451e1b19732300f300d9c27c5784a749521d65
Opcode Fuzzy Hash: e9273f4c747aa4a5fcbaf65099aa854806d68693b124c73af15023d43382e017
Instruction Fuzzy Hash: 311112B1800259CFDB10CF9AD488BDFFBF8EB88324F14841AD529A7250C774A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D4B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.389405152.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_b5d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d1f7714b7604d999c573b67bd0a9ce621d7b87a2e832f7baf9c6ddb1e76694
Instruction ID: 75b1763eeb78772d248e577af9930cbfc14f9863a16bc9864e6c85e3622641b9
Opcode Fuzzy Hash: 37d1f7714b7604d999c573b67bd0a9ce621d7b87a2e832f7baf9c6ddb1e76694
Instruction Fuzzy Hash: 51212B71504240DFDB25DF14E8C0B26BBA5FBA8319F24C6E9DD054B206D335D849C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.389405152.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_b5d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671d1e82aaf3a8a1789e2a0bc3524e1228dee01592c757c66e574efa6d7a2c85
Instruction ID: 3d2fe100d4524cf57bcd2e2d6fb9d2863dc8837cdaf44e882142db7808753ef7
Opcode Fuzzy Hash: 671d1e82aaf3a8a1789e2a0bc3524e1228dee01592c757c66e574efa6d7a2c85
Instruction Fuzzy Hash: 6E212871504240DFDB24DF10D9C4B26BBA5FB98325F24C6E9ED094B346C336E84AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.389405152.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_b5d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction ID: 40c26bdabeaebbd19d3bd6a93e45c4a74d54e1b0448763f5d94ea921ad2fc81c
Opcode Fuzzy Hash: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction Fuzzy Hash: 70119D76504280CFDB21CF10D9C4B16BFB2FB94324F24C6E9D8090B616C336E85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D4AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.389405152.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_b5d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction ID: e32e70a4b1b9c119613fc2210f13773190e10cdb57bdd0fa8885452b9d7ead7f
Opcode Fuzzy Hash: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction Fuzzy Hash: 7A11AF76504280CFDB12CF14D9C4B1ABFB1FB94324F2486E9DC050B616D336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 5356, Parent PID: 1584COMMON

Execution Graph

Execution Coverage:	30.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	0

Executed Functions

Function 02C42109 Relevance: 2.0, APIs: 1, Instructions: 453
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C425E9

Memory Dump Source

Source File: 0000001C.00000002.403674349.0000000002C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2c40000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 1bc3143b827c97531755ceb000bfecc80a46ce6bffd8b1c76f216e6252f925f5
Instruction ID: cf197b8a93105a20b3dc19d435cc5f469f89dfd5fd6c288df127f8f82a3716fc
Opcode Fuzzy Hash: 1bc3143b827c97531755ceb000bfecc80a46ce6bffd8b1c76f216e6252f925f5
Instruction Fuzzy Hash: 96E1C332F002044BDB54CABE8C913AF76A3AFC4224F598239EE15DB7C4EF7499019752

Uniqueness

Uniqueness Score: -1.00%

Function 02C42560 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 02C425E9

Memory Dump Source

Source File: 0000001C.00000002.403674349.0000000002C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2c40000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e5cec636ff0d640c54946c93f455e1a7c96adbbe88bca05fa4fd475302aec14a
Instruction ID: 5e527d36a3aceed44da21e1d2ee7c7d26b020c5a7efb83547766f94569c818ed
Opcode Fuzzy Hash: e5cec636ff0d640c54946c93f455e1a7c96adbbe88bca05fa4fd475302aec14a
Instruction Fuzzy Hash: 6721C0B1D002499FCB10DFAAD984ADEFBF5FF48314F50842AE919A7240C775A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: msdtc.exePID: 5808, Parent PID: 1064COMMON

Executed Functions

Function 0075D4B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.506857523.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_75d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642540e2c4bb6b063d1cf9a84b18b6c4bd1d6ca43ee1189ae475d04a8f6b10bf
Instruction ID: 67a4e2f377a662ade063cdc707a4d9f2a073a8179c3753b08e8e3c3c2fddcb22
Opcode Fuzzy Hash: 642540e2c4bb6b063d1cf9a84b18b6c4bd1d6ca43ee1189ae475d04a8f6b10bf
Instruction Fuzzy Hash: E52148B1504240DFDB31CF14D8C0B66BB61FB98329F24C568EC094B206D37ADC59C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0075D3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.506857523.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_75d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9427ea40f42299ac3989a84bc8084ed4ae7298d75e412ab1e8cd5783b0d2cc
Instruction ID: 33d8a335ed7ea22e3bd4ee602b813c11f9e1c463cfa153c1cb3c4b08bf54b308
Opcode Fuzzy Hash: 9d9427ea40f42299ac3989a84bc8084ed4ae7298d75e412ab1e8cd5783b0d2cc
Instruction Fuzzy Hash: F82103B1504280DFDB34DF10D9C4B66BB66FB98325F24C569ED094B246C37AEC4AC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0075D3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.506857523.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_75d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction ID: af0e28fc4d640aafc0e2bab72226759691ee8a25ed154c5b43229933b4adcf04
Opcode Fuzzy Hash: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction Fuzzy Hash: AD11B176504280CFDB21CF10D9C4B56BF72FB94324F24C6A9DC090B616C37AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0075D4AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.506857523.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_75d000_msdtc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction ID: 0fc9aec6875bbc4974c1c50d2e8712187ceb681cd9fe6264b32fda8f1558e991
Opcode Fuzzy Hash: ce7c5481ea3966c2392968f11b64ad28d0706a2f7855728c1a55e95cda521e5a
Instruction Fuzzy Hash: 8B11D376504280CFDB22CF14D9C4B56BF72FB94324F24C6A9DC050B616D37AD96ACBA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1111110789_stripped.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1111110789_stripped.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\msdtc.exe.log

C:\Users\user\AppData\Roaming\msdtc\msdtc.exe

C:\Users\user\AppData\Roaming\msdtc\msdtc.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
1111110789_stripped.exe