Edit tour

Windows Analysis Report
xXQ39a5f9EJP.exe

Overview

General Information

Sample name:	xXQ39a5f9EJP.exe
Analysis ID:	1428454
MD5:	b385264019d78c7225e7e088d5ad6042
SHA1:	544ef98e04e0218af42302970199dd1f66182118
SHA256:	4eb22bcde9c1f6978506647ab39e9e4245cb4bde3a359c0348e37ec3f9c12116
Tags:	DcRatexe
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected AsyncRAT

Yara detected DcRat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

xXQ39a5f9EJP.exe (PID: 6860 cmdline: "C:\Users\user\Desktop\xXQ39a5f9EJP.exe" MD5: B385264019D78C7225E7E088D5AD6042)

cmd.exe (PID: 3164 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6032 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/ https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Ports": ["7094"], "Server": ["liverpool777.duckdns.org"], "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAMaBeR9P3Ul+SdXWCbf4dEVfPoRFMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMDIwNDE1MDcxN1oXDTMzMTExMzE1MDcxN1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKc8o3jPsEuo8oWGV/dKkjetOpEe003VLgZvyH72e4hhVOKpVhCoXfNzypj62QwbJzZNiJEjKbHcMIBTj6FXTcN0crxDt9y9Zkqcv5bHQt7qEhSGlQDWusiPiFi/ZUm5aABL1L3ZDlEq0EomTSE+zogqLxeR4JBAsV0AR4buL7SRAgMBAAGjMjAwMB0GA1UdDgQWBBQmwIernSRvdh/MqJJVki/p4G9lwDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAIQGk5vP6qdN4EaKNY/YrbRS91Tu9QPKlufTNOzSlJxuxr062vtdFPTQylkVTc+MeL3xUB8gBMAixsOc/vHhhjk6N+XsPz/AvA0eRze9Tje1kzVx/fH+uv1/dBFR0/I8hyBB6C1MxQ5E4tNT4z0yGxYsRw0P9j2sVHbmQKMh1R2n", "Server Signature": "SEbLPMahs9JeJC0j5v4/FMTverhEsUQlMFhAvhUdfeRa6auTTJ/otpfbZiZfWEuXgBArX1bR9yS1pN9NEsBwBkkPOvTRwmm8puXW45QjxRW2+dfh2iaylWKUfQAfbeVT73kMNtF5SZh2AwPOl40y8sslWQkiHCmlNWGjYoKVW+s="}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
xXQ39a5f9EJP.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
xXQ39a5f9EJP.exe	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9ae8:$a2: timeout 3 > NUL 0x9b08:$a3: START "" " 0x9993:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a48:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
xXQ39a5f9EJP.exe	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a48:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x9993:$s2: L2Mgc2NodGFza3MgL2 0x9912:$s3: QW1zaVNjYW5CdWZmZXI 0x9960:$s4: VmlydHVhbFByb3RlY3Q
xXQ39a5f9EJP.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cca:$q1: Select * from Win32_CacheMemory 0x9d0a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d58:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9da6:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
xXQ39a5f9EJP.exe	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa142:$s1: DcRatBy

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x433:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2722186865.000000000292B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x49c4:$b2: DcRat By qwqdanchun1 0x4c14:$b2: DcRat By qwqdanchun1
00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63f7:$a1: havecamera 0x98e8:$a2: timeout 3 > NUL 0x9908:$a3: START "" " 0x9793:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9848:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x7750:$b2: DcRat By qwqdanchun1 0xf16c:$b2: DcRat By qwqdanchun1 0xf3bc:$b2: DcRat By qwqdanchun1
00000000.00000002.2724541084.000000001B1C3000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x12190:$b2: DcRat By qwqdanchun1
00000000.00000002.2724197817.000000001B054000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x7dc:$b2: DcRat By qwqdanchun1
00000000.00000002.2721545621.0000000000BB0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x30885:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x307d4:$s2: L2Mgc2NodGFza3MgL2
00000000.00000002.2721166545.0000000000963000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4a31c:$b2: DcRat By qwqdanchun1 0x6b070:$b2: DcRat By qwqdanchun1
00000000.00000002.2722186865.00000000027AA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5b154:$b2: DcRat By qwqdanchun1
00000000.00000002.2722186865.00000000029C8000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2702c:$b2: DcRat By qwqdanchun1
00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5348:$b1: DcRatByqwqdanchun 0x3f4cc:$b2: DcRat By qwqdanchun1
Process Memory Space: xXQ39a5f9EJP.exe PID: 6860	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: xXQ39a5f9EJP.exe PID: 6860	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: xXQ39a5f9EJP.exe PID: 6860	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1fd22:$a1: havecamera 0x24908:$b1: DcRatByqwqdanchun 0x66bf0:$b1: DcRatByqwqdanchun 0x7faa:$b2: DcRat By qwqdanchun1 0x128fe:$b2: DcRat By qwqdanchun1 0x24d99:$b2: DcRat By qwqdanchun1 0x25b30:$b2: DcRat By qwqdanchun1 0x305a3:$b2: DcRat By qwqdanchun1 0x380c5:$b2: DcRat By qwqdanchun1 0x64c04:$b2: DcRat By qwqdanchun1 0x726e2:$b2: DcRat By qwqdanchun1
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.xXQ39a5f9EJP.exe.470000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.xXQ39a5f9EJP.exe.470000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9ae8:$a2: timeout 3 > NUL 0x9b08:$a3: START "" " 0x9993:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a48:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.0.xXQ39a5f9EJP.exe.470000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a48:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x9993:$s2: L2Mgc2NodGFza3MgL2 0x9912:$s3: QW1zaVNjYW5CdWZmZXI 0x9960:$s4: VmlydHVhbFByb3RlY3Q
0.0.xXQ39a5f9EJP.exe.470000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cca:$q1: Select * from Win32_CacheMemory 0x9d0a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d58:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9da6:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.0.xXQ39a5f9EJP.exe.470000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa142:$s1: DcRatBy
0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x30885:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x307d4:$s2: L2Mgc2NodGFza3MgL2
0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x30885:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x307d4:$s2: L2Mgc2NodGFza3MgL2
0.2.xXQ39a5f9EJP.exe.1281bd50.2.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x2ea85:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x2e9d4:$s2: L2Mgc2NodGFza3MgL2
0.2.xXQ39a5f9EJP.exe.bb0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x2ea85:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x2e9d4:$s2: L2Mgc2NodGFza3MgL2
Click to see the 4 entries

Snort Signatures

ET TROJAN Observed Malicious SSL Cert (AsyncRAT) - Source IP: 179.13.0.175 - Destination IP: 192.168.2.4

Timestamp:	04/19/24-00:20:55.692486
SID:	2034847
Source Port:	7094
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) - Source IP: 179.13.0.175 - Destination IP: 192.168.2.4

Timestamp:	04/19/24-00:20:55.692486
SID:	2848152
Source Port:	7094
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xXQ39a5f9EJP.exe

Avira: detected

Found malware configuration

Source: xXQ39a5f9EJP.exe

Malware Configuration Extractor: AsyncRAT {"Ports": ["7094"], "Server": ["liverpool777.duckdns.org"], "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAMaBeR9P3Ul+SdXWCbf4dEVfPoRFMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMDIwNDE1MDcxN1oXDTMzMTExMzE1MDcxN1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKc8o3jPsEuo8oWGV/dKkjetOpEe003VLgZvyH72e4hhVOKpVhCoXfNzypj62QwbJzZNiJEjKbHcMIBTj6FXTcN0crxDt9y9Zkqcv5bHQt7qEhSGlQDWusiPiFi/ZUm5aABL1L3ZDlEq0EomTSE+zogqLxeR4JBAsV0AR4buL7SRAgMBAAGjMjAwMB0GA1UdDgQWBBQmwIernSRvdh/MqJJVki/p4G9lwDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAIQGk5vP6qdN4EaKNY/YrbRS91Tu9QPKlufTNOzSlJxuxr062vtdFPTQylkVTc+MeL3xUB8gBMAixsOc/vHhhjk6N+XsPz/AvA0eRze9Tje1kzVx/fH+uv1/dBFR0/I8hyBB6C1MxQ5E4tNT4z0yGxYsRw0P9j2sVHbmQKMh1R2n", "Server Signature": "SEbLPMahs9JeJC0j5v4/FMTverhEsUQlMFhAvhUdfeRa6auTTJ/otpfbZiZfWEuXgBArX1bR9yS1pN9NEsBwBkkPOvTRwmm8puXW45QjxRW2+dfh2iaylWKUfQAfbeVT73kMNtF5SZh2AwPOl40y8sslWQkiHCmlNWGjYoKVW+s="}

Machine Learning detection for sample

Source: xXQ39a5f9EJP.exe

Joe Sandbox ML: detected

Source: xXQ39a5f9EJP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2034847 ET TROJAN Observed Malicious SSL Cert (AsyncRAT) 179.13.0.175:7094 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2848152 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant) 179.13.0.175:7094 -> 192.168.2.4:49730

Uses dynamic DNS services

Source: unknown

DNS query: name: liverpool777.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 179.13.0.175:7094

Source: Joe Sandbox View

IP Address: 179.13.0.175 179.13.0.175

Source: Joe Sandbox View

ASN Name: ColombiaMovilCO ColombiaMovilCO

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: liverpool777.duckdns.org

Source: xXQ39a5f9EJP.exe, 00000000.00000002.2721166545.0000000000963000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: xXQ39a5f9EJP.exe, 00000000.00000002.2721166545.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabRead
Source: xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: xXQ39a5f9EJP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000000.00000002.2722186865.000000000292B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2724541084.000000001B1C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2724197817.000000001B054000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2721545621.0000000000BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000000.00000002.2721166545.0000000000963000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2722186865.00000000027AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2722186865.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B888346	0_2_00007FFD9B888346
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B8890F2	0_2_00007FFD9B8890F2
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B8830E2	0_2_00007FFD9B8830E2
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B88FFE0	0_2_00007FFD9B88FFE0
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B88FF58	0_2_00007FFD9B88FF58
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B88DE0D	0_2_00007FFD9B88DE0D
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B88C56F	0_2_00007FFD9B88C56F
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B89DD00	0_2_00007FFD9B89DD00
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B88FBFA	0_2_00007FFD9B88FBFA
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B88F460	0_2_00007FFD9B88F460

Source: xXQ39a5f9EJP.exe, 00000000.00000002.2721545621.0000000000BB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOptions.dll" vs xXQ39a5f9EJP.exe
Source: xXQ39a5f9EJP.exe, 00000000.00000002.2723423960.0000000012761000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOptions.dll" vs xXQ39a5f9EJP.exe
Source: xXQ39a5f9EJP.exe, 00000000.00000000.1613534341.000000000047E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs xXQ39a5f9EJP.exe
Source: xXQ39a5f9EJP.exe	Binary or memory string: OriginalFilenameClient.exe" vs xXQ39a5f9EJP.exe

Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: xXQ39a5f9EJP.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000000.00000002.2722186865.000000000292B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2724541084.000000001B1C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2724197817.000000001B054000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2721545621.0000000000BB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000000.00000002.2721166545.0000000000963000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2722186865.00000000027AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2722186865.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: xXQ39a5f9EJP.exe, Settings.cs	Base64 encoded string: 'quD89VklbLlWuXA8KTZXqzNYbW24Nfz7n7hOk1vOwu0lCUiDSdtLexUBAYLjNYlz6c7Mcx77B5oFBswiOvcoMQ==', 'ZOqRNr8kUQheezl6G9UcGpZEVSIvoRdQZQ0sCNk9a7W5exAmHcP6VkDgMa3Q5wxLpXge1eCVQ1BOI1J62syVbXaEmfbLREe9lwsi0Lmh95k=', 'ndWrB5bSaroCSX8InKS8uc1A/8TUgGdRwEBU7FU+BR5SjDDc7V6u+Dz5WmDKkdrrLSL/H2wm/+RXiC7riMX4/QT1SPs6OrIoLDZdhWMhjcU=', 'kZCc6gfvNQEpzD5mm0BTPaiSspTLCbLSSWsxDbXLcGVftSVwr1UXxQqu9+o1JcaHXqwrwnzHla18HC1lSluswfSmURjA12xKX0iBq3mHasg4ES2JQNFYo62LQSVvJXdsrmLXAEzd60YM7hZcGo5+y241zOLhA7o6B0J8A2aQj/T/r3j9APZQqEZhgBKKrMVoZCzGoymj+bu600yCV7fMQprFRzn15FfnJx5D1ilp7JTEN11hAvdWlo3KPpRZVIAlRX8cG56sLe9hxQsy9S8o0xSJvg8rVY9xnMqpox+cxL64aj205EWlepJE0O9+1gISnlJybcSBjs8o7QWKp4UWwaZxd2OyvhrpfXkqZdTn1SFwwLO3f7ElC45JrhvMUVLBkAQytJvsutiHwAMcWtryDdBVu1qNLtge9Nl90yk6uTzRQTUciNukVuHe+a37BPTOM+dmXTLPEriAvnAjgW80U1sht90u+zegLOWnqxAEClyUlmg5pbp69VIf/ZANInQcGgUZ53UU5l8R6iFZoETksZQQeMZhe8j9gYMlrUrcKFE6Y/dd9KSCi1xWCp5Pb8S2RHehawNZZbDZALwXR8XUFxSxjJzplyV9e3BOWhSs34waWctzcgQ22tjcHuwD86XCS5+GEq9jcg5RtXLUl3tcwE5/kRoq75FxKymEsGcFr/zkTwYHj1Vd/pOtxKzK882tp/QY2xwwLwZL8/3k/MyD+vfTJn/+LJY21kMMfcFOiYeoNtjJSECwIsiMUGPOuU8yeWY7hUxXRaKGMtaDLl4x7AL/BqaJt56D4gncB1Br0/A0TJcWIbcRToCCHNtHjIk5Vcg5MzVxoN7culJ7i2oKnHkxvWeZ8DnhvGTq8IbUZXCr09lsrIwqIMaOSoO4jIg5j9Y4EhM0Vndv+MsZgG8gersJ0bdvkLWKyquiYxIa1OAgHwkUc1YNxDO24f1ipNxVnHE+p6ajRZs8jyCZyVGN5aCc2pF9gOX3NZq1ElTMm6N3OldLX7blrnRjTPFk3nUY7iq7RXEPIaNYw/p94tKut8jUr7sSwOkAgistCc3uGIUONtZ1HBGnTCXR7w1bEjdy', 'SobhorC+zh6T8g0QmTis74cZUXzTGv8Kr0KaTC0Bhil75w9UtQyIeyxINAlF+0JJpYCqWqH23bPNer+4phR4ilPHWHsajjGNb3KIIm8fUU0aCNcfMuzsQKBiCvqJ7pfPno5sMuEFggMmMe+9SKv2UD+vacOPRJ9/3ExnTEH9J5woy1zO/5dOTGns/SYsIHI3BTTiiXuyGHKCCwtQDeBOyUd/JTYYEMpmiFT+XICJbXkrECAVQ5EESwFI6g3guC8AMIZMN0FuIJ9XJQkn3fM8vJKLB4gMT5g2pgYcOcHUJWU=', 'nU2RVe+a+JNyRZ0kkgA0JG/VT0ga++Ax+UocVa2vDw/L36A0eoQcjjAocH9Pgquq9oXyFg/3Ci6hQuPDnORoaA==', 'nvp3ctvHs3A7rxsqSx8wu1sCh6h356TtfKXGnuMB5d5rbYiPP/Y/PB3egTFwEVsHYKirpv98e/Yw3JzIH29Y3w==', '/1b94d2H3dUD/r15ceCDjsrNq/uvRsU1puTernUezQuuc9JdKzLiQtrTfDbXltq3SvvfnM1itQd8Ef7fVHO37A==', 'Q9qWR8GyJqWiHaI0t1nxnix+r+YHfGzrqDGuAVv9mTJxCrtLtmEynSs3Hs/Bu/PJ/3zxkSwdymgUwbmRhr3IOQ=='
Source: xXQ39a5f9EJP.exe, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, HandleNormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, HandleNormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: xXQ39a5f9EJP.exe, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: xXQ39a5f9EJP.exe, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/5@1/1

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xXQ39a5f9EJP.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_03
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcRatMutex_qwqdanchun

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

File created: C:\Users\user\AppData\Local\Temp\tmp679F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat""

Source: xXQ39a5f9EJP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xXQ39a5f9EJP.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xXQ39a5f9EJP.exe "C:\Users\user\Desktop\xXQ39a5f9EJP.exe"
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: xXQ39a5f9EJP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xXQ39a5f9EJP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.xXQ39a5f9EJP.exe.1281bd50.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.xXQ39a5f9EJP.exe.bb0000.1.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B895A5F push ebp; retf 5F4Dh	0_2_00007FFD9B895AD8
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B895963 push edx; retf	0_2_00007FFD9B8959DB
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B898167 push ebx; ret	0_2_00007FFD9B89816A
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Code function: 0_2_00007FFD9B8800BD pushad ; iretd	0_2_00007FFD9B8800C1

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: xXQ39a5f9EJP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\F723E1B88FDFE54EEC0E F7A2CF016280A5E7A24A46D6E81A704BFCCD6486B35AFEFC4601A8330895F85F

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: xXQ39a5f9EJP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: xXQ39a5f9EJP.exe

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Memory allocated: CC0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Memory allocated: 1A750000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Window / User API: threadDelayed 9810

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe TID: 6540	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe TID: 4500	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe TID: 6092	Thread sleep count: 9810 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe TID: 6092	Thread sleep count: 49 > 30	Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: xXQ39a5f9EJP.exe, 00000000.00000002.2724197817.000000001B054000.00000004.00000020.00020000.00000000.sdmp, xXQ39a5f9EJP.exe, 00000000.00000002.2724541084.000000001B1C3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: xXQ39a5f9EJP.exe, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: xXQ39a5f9EJP.exe, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: xXQ39a5f9EJP.exe, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: xXQ39a5f9EJP.exe, Amsi.cs	Reference to suspicious API methods: Win32.VirtualAllocEx(procAddress, (UIntPtr)(ulong)patch.Length, 64u, out var _)

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat""			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3			Jump to behavior

Source: xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.00000000029BC000.00000004.00000800.00020000.00000000.sdmp, xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.00000000029BC000.00000004.00000800.00020000.00000000.sdmp, xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Queries volume information: C:\Users\user\Desktop\xXQ39a5f9EJP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: xXQ39a5f9EJP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xXQ39a5f9EJP.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR

Source: xXQ39a5f9EJP.exe, 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: MSASCui.exe
Source: xXQ39a5f9EJP.exe, 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: procexp.exe
Source: xXQ39a5f9EJP.exe, 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\xXQ39a5f9EJP.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXQ39a5f9EJP.exe PID: 6860, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	11 Scheduled Task/Job	1 Modify Registry	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Virtualization/Sandbox Evasion	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xXQ39a5f9EJP.exe	100%	Avira	HEUR/AGEN.1307404
xXQ39a5f9EJP.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
liverpool777.duckdns.org	179.13.0.175	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, xXQ39a5f9EJP.exe, 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
179.13.0.175	liverpool777.duckdns.org	Colombia		27831	ColombiaMovilCO	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428454
Start date and time:	2024-04-19 00:20:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xXQ39a5f9EJP.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 58% Number of executed functions: 10 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: xXQ39a5f9EJP.exe

Simulations

Behavior and APIs

Time	Type	Description
00:20:55	API Interceptor	2x Sleep call for process: xXQ39a5f9EJP.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
179.13.0.175	xmrhZ7VhlJjD.exe	Get hash	malicious	Quasar	Browse
	xBoD1uCJo8Dc.exe	Get hash	malicious	XWorm	Browse
	xffRCvQIkXWb.exe	Get hash	malicious	XWorm	Browse
	xApyUPoAYp9c.exe	Get hash	malicious	AsyncRAT	Browse
	xVDnoXtgbTMW.exe	Get hash	malicious	AsyncRAT	Browse
	xApyUPoAYp9c.exe	Get hash	malicious	AsyncRAT	Browse
	xVDnoXtgbTMW.exe	Get hash	malicious	AsyncRAT	Browse
	x1h52dJdta0O.exe	Get hash	malicious	Njrat	Browse
	xH9gjpK4z9CH.exe	Get hash	malicious	Njrat	Browse
	xf9obZbyKks2.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
liverpool777.duckdns.org	x1h52dJdta0O.exe	Get hash	malicious	Njrat	Browse	179.13.0.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	6VXQ3TUNZo.elf	Get hash	malicious	Mirai	Browse	181.207.246.71
	wFtZih4nN9.elf	Get hash	malicious	Mirai	Browse	191.90.223.182
	tu.exe	Get hash	malicious	Remcos	Browse	179.14.10.110
	xmrhZ7VhlJjD.exe	Get hash	malicious	Quasar	Browse	179.13.0.175
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	181.207.212.107
	Ns1xkTsDQO.elf	Get hash	malicious	Mirai	Browse	181.68.139.5
	7t5zI3LtK8.elf	Get hash	malicious	Mirai	Browse	181.207.212.113
	MYb7GhRJl7.elf	Get hash	malicious	Mirai	Browse	181.69.231.0
	xBoD1uCJo8Dc.exe	Get hash	malicious	XWorm	Browse	179.13.0.175
	xffRCvQIkXWb.exe	Get hash	malicious	XWorm	Browse	179.13.0.175

Process:	C:\Users\user\Desktop\xXQ39a5f9EJP.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\xXQ39a5f9EJP.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.141494007698779
Encrypted:	false
SSDEEP:	6:kK9ZlDN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:zlMkPlE99SNxAhUeVLVt
MD5:	F8434D5CFA720139E31894AB43807D4B
SHA1:	5902936B530151D272E09D013FB09C6A5105A3DC
SHA-256:	C6087B5954A1233D0C21D33E32C87F58C4E244E3D0A428CA47F26178B64DD22C
SHA-512:	9B0BB6FE03056CA4D8F709CCEF69E1F0C8B04076F66799B72CA75EF90539E2B4FA77ED8F31A235B57A4378386F6B41A9F1A4AABE1510025167C90B8A577C2B25
Malicious:	false
Reputation:	low
Preview:	p...... ........U.C....(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xXQ39a5f9EJP.exe.log

Download File

Process:	C:\Users\user\Desktop\xXQ39a5f9EJP.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.375380268342155
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkl+vxp3/ell1qHGIs0HKJHNptLHqHj:iqbYqGSI6oPtzHeqKksZp/ellwmj0qJi
MD5:	4CEAC8E156C9A1D90AB03AF9133D7A38
SHA1:	39ACAE4267BF940B8995DD12CC797DE497B4D73E
SHA-256:	7BB4ADB915FC1C1076B35CC3D69402A22EB89878D6269FAF5826FF06958ED0D6
SHA-512:	597A202013C9E046449D71BF4C816E98BC7203EDBEB17F3D181400590C36E9E545B6FD7449635719EEF595B8730C066313912B1DA1A7F87AC818082B2C330A7B
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V

C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat

Download File

Process:	C:\Users\user\Desktop\xXQ39a5f9EJP.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	5.139737252440667
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtv3Dt+WfHvhs9d9E5Dcq10d9DwU1hGDt+kiE2J5xAInTRI5iL1ZPy:hWKqTtLwQO9/iDc5DNewkn23fT1k
MD5:	2A715442718477F4ACE5FC6E7DB52688
SHA1:	E9BA28439F9294F1B0CEBF3BF6D23DBF57A55487
SHA-256:	7A9920C759A7347D896D900ABBD0EF53CCAB6BE841DF6BE674AC233EEA9E2289
SHA-512:	AC1B08A077050295B15B2B20A1B8C620BCF81E447FEAE5485071B05C7BBC84CCD8910E108CA0B1D2EE8F73FE209B1B2090D1F30828A960B561C9043DDAEFE70C
Malicious:	false
Reputation:	low
Preview:	@echo off..timeout 3 > NUL..CD C:\Users\user\Desktop..DEL "xXQ39a5f9EJP.exe" /f /q..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp679F.tmp.bat" /f /q..

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.643906340459884
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt04hovn:hYFqGaNZK4Qn
MD5:	A95BB132FBBAD82B9DC8D474497E4B61
SHA1:	EFF67571370682301B518C7DC6F6BF09BBA7C940
SHA-256:	4CBE1DA45AB844939D9E506733ED61E0FF3641B779AC057FA35749E5C9CDA453
SHA-512:	A37FAECFFEB9ACC03861D96520FFE4BDBC91DDF12078CEEF35523A0EC9BFF43C25344C37251BBFEBCE8B3477512B5A75B360B48BA1DCFDD1B24C0172B23A62E1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.4294967295..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.615876081246294
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	xXQ39a5f9EJP.exe
File size:	48'640 bytes
MD5:	b385264019d78c7225e7e088d5ad6042
SHA1:	544ef98e04e0218af42302970199dd1f66182118
SHA256:	4eb22bcde9c1f6978506647ab39e9e4245cb4bde3a359c0348e37ec3f9c12116
SHA512:	2a7b118a8c7c9e38884d884891c9342fafa80ec65a6f54c1ac7daefd23c33aada89250e2fbaa3507e802440c9bcbc9288bf0fd8391dabd3587e140330d7e1587
SSDEEP:	768:4q+s3pUtDILNCCa+DiptelDSN+iV08YbygeiOOW1tWtirvEgK/JvZVc6KN:4q+AGtQOptKDs4zb13OOW1tWErnkJvZI
TLSH:	96235D4037D88136F2BD4BB4ACF2E14586B5D2676903CA9D6CC814EA1F13BC59A136FE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40cbbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x60930A0B [Wed May 5 21:11:39 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcb64	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0xdf7	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xabc4	0xac00	21c919d4bb2022b37b2a380177fe0763	False	0.5020439680232558	data	5.640623955928705	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0xdf7	0xe00	2083376922615c09cdda9acfd9305376	False	0.4017857142857143	data	5.110607648061562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	82148d01c3935cf90ef81a3dd1fad607	False	0.044921875	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0a0	0x2d4	data			0.4350828729281768
RT_MANIFEST	0xe374	0xa83	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.40245261984392416

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-00:20:55.692486	TCP	2034847	ET TROJAN Observed Malicious SSL Cert (AsyncRAT)	7094	49730	179.13.0.175	192.168.2.4
04/19/24-00:20:55.692486	TCP	2848152	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT Variant)	7094	49730	179.13.0.175	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 00:20:55.283459902 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:55.457745075 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:20:55.457851887 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:55.490252018 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:55.692486048 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:20:55.698606968 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:55.878040075 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:20:55.932013988 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:56.664951086 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:56.889107943 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:20:56.889175892 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:20:57.112657070 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:08.278161049 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:08.508018970 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:08.508344889 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:08.693154097 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:08.744586945 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:08.916750908 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:08.963236094 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:10.207216978 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:10.433042049 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:10.433162928 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:10.663716078 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:19.901542902 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:20.123373985 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:20.123606920 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:20.337183952 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:20.337266922 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:20.703603029 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:20.703694105 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:20.706836939 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:20.918540955 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:20.918626070 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:21.141761065 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:31.526016951 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:31.742800951 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:31.742872000 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:31.926377058 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:31.978816986 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:32.162178993 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:32.164033890 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:32.387516975 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:32.387603045 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:32.632879972 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:43.151360035 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:43.393104076 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:43.393234015 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:43.572755098 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:43.619420052 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:43.801678896 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:43.803864956 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:44.022526026 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:44.022664070 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:44.237818003 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:50.448080063 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:50.494509935 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:50.842600107 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:50.885149956 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:54.776056051 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:55.010835886 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:55.010988951 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:55.191595078 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:55.244380951 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:55.420875072 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:55.422667980 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:55.647516012 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:21:55.647655964 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:21:55.877212048 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:06.569555044 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:06.797266006 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:06.797379017 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:06.982219934 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:07.025610924 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:07.211014986 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:07.213219881 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:07.453299046 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:07.453408957 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:07.686240911 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:18.182667971 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:18.413059950 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:18.413155079 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:18.593055964 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:18.635226965 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:18.822474003 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:18.824476957 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:19.046228886 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:19.046307087 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:19.268564939 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:20.324033976 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:20.369339943 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:20.857744932 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:20.857912064 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:20.877545118 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:20.877785921 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:21.171648026 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:21.171789885 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:29.807471991 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:30.032625914 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:30.032705069 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:30.213116884 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:30.260160923 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:30.428096056 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:30.432220936 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:30.663058996 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:30.663122892 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:30.892462969 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:36.863116026 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:36.916351080 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:37.098105907 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.100912094 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:37.336452007 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.336561918 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:37.576682091 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.607085943 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.607209921 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.607270002 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:37.786994934 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.787395954 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.787471056 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:37.962282896 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.962753057 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.962769985 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.962820053 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:37.963109016 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:37.963145018 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.144299984 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144319057 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144335985 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144377947 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.144618034 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144661903 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.144758940 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144777060 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144794941 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.144834042 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.145088911 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.145132065 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.321271896 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.322248936 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.322299004 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.323216915 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.323932886 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.323985100 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.326297045 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.326771975 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.326878071 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.327236891 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.327733994 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.327775955 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.496309996 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.496855021 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.497023106 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.497322083 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.497865915 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.497915983 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.497920036 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.501682997 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.501740932 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.502062082 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.502545118 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.502589941 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.502840996 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.556843042 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.676426888 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.676945925 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.676999092 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.681396961 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.681411028 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.681449890 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.681880951 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.682370901 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.682424068 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.690737009 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.742762089 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.742847919 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.856441021 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.857023954 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.857042074 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.857088089 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.857450962 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.857465982 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.857503891 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.857683897 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.857727051 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:38.926980972 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.927362919 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:38.927428961 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.039211988 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.039401054 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.039485931 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.039659023 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.039875984 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.039913893 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.039946079 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.040399075 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.040453911 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.101763964 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.102047920 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.102121115 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.228363991 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.228975058 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.229043007 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.229165077 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.229202032 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.229252100 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.230305910 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.236952066 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.237164974 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.280946016 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.280986071 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.281024933 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.281059027 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.322551966 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.414624929 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.415080070 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.415158033 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.415735006 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.416058064 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.416163921 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.425213099 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.425472975 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.425540924 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.459374905 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.468544960 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.468671083 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.504611969 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.556772947 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.605256081 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.605535030 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.605587006 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.606276035 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.614144087 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.614167929 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.614192009 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.614665031 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.614710093 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.647620916 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.648016930 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.648087978 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.736454964 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.791207075 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.792207956 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.793437958 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.793479919 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.793495893 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.793596983 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.793643951 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.794631004 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.794673920 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.794714928 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.805620909 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.827332973 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.827392101 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.831423044 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.884936094 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.971425056 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.971851110 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.971935034 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.972418070 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.972836018 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.972899914 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.973320007 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.973800898 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:39.973850012 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:39.974265099 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.012115955 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.012289047 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.012478113 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.056802034 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.072472095 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.081553936 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.081624985 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.157094002 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.157557964 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.157604933 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.158005953 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.158509970 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.158554077 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.159015894 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.167150021 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.167207003 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.197082043 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.197480917 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.197537899 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.236984015 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.257036924 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.257148981 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.257925987 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.306782961 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.341109037 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.341608047 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.341670036 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.342107058 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.342564106 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.342607021 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.351155043 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.351615906 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:40.351677895 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.950201035 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:40.951529026 CEST	49739	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.133196115 CEST	7094	49739	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.133320093 CEST	49739	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.133678913 CEST	49739	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.171084881 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.171330929 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.327919006 CEST	7094	49739	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.328609943 CEST	49739	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.406184912 CEST	7094	49730	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.430273056 CEST	49739	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.437047005 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.445925951 CEST	49730	7094	192.168.2.4	179.13.0.175
Apr 19, 2024 00:22:41.563982010 CEST	7094	49739	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.603636026 CEST	7094	49739	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.623239994 CEST	7094	49739	179.13.0.175	192.168.2.4
Apr 19, 2024 00:22:41.623290062 CEST	49739	7094	192.168.2.4	179.13.0.175

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 00:20:55.139539003 CEST	50290	53	192.168.2.4	1.1.1.1
Apr 19, 2024 00:20:55.278522015 CEST	53	50290	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 00:20:55.139539003 CEST	192.168.2.4	1.1.1.1	0xa8fa	Standard query (0)	liverpool777.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 00:20:55.278522015 CEST	1.1.1.1	192.168.2.4	0xa8fa	No error (0)	liverpool777.duckdns.org		179.13.0.175	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	00:20:51
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\xXQ39a5f9EJP.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\xXQ39a5f9EJP.exe"
Imagebase:	0x470000
File size:	48'640 bytes
MD5 hash:	B385264019D78C7225E7E088D5AD6042
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2722186865.000000000292B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000000.1613517269.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2722186865.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2724541084.000000001B1C3000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2724197817.000000001B054000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: 00000000.00000002.2721545621.0000000000BB0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2721166545.0000000000963000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2722186865.00000000027AA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2722186865.00000000029C8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000000.00000002.2722186865.0000000002751000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:22:40
Start date:	19/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat""
Imagebase:	0x7ff7a4100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:22:40
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:22:40
Start date:	19/04/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff7291b0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B88FFE0 Relevance: 3.5, Instructions: 3486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f02bdd8a9133f25de6cfe3afdf24028cdd7f46784e29ad0ad55ed2f22796bbc
Instruction ID: fb3cd227eb01c150b0deb76697f832196f9900622c50442b4957809c913c7a28
Opcode Fuzzy Hash: 5f02bdd8a9133f25de6cfe3afdf24028cdd7f46784e29ad0ad55ed2f22796bbc
Instruction Fuzzy Hash: 1743613062DB498FD7B8DB58C495AAAB3E1FF98700F11457DD48DC32A5DE34A942CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89DD00 Relevance: 3.3, Strings: 2, Instructions: 837
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BM_H, xrefs: 00007FFD9B89E271
]M_H, xrefs: 00007FFD9B89DF3F

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID: BM_H$]M_H
API String ID: 0-2720215389
Opcode ID: 3121f1e061e7d8e659d5ee35a3ed0f99fd141db1c12996544c84b75931756f89
Instruction ID: f749902c5de96ee12998b5d15660adb329d677ba94dd7cc9478c48224d8ff3e2
Opcode Fuzzy Hash: 3121f1e061e7d8e659d5ee35a3ed0f99fd141db1c12996544c84b75931756f89
Instruction Fuzzy Hash: 8A42A231B19A0D8FEBA4EB5CD8A5A697BE1FF98340F1501B9E44DC32A6DE24EC418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8830E2 Relevance: 2.0, Strings: 1, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 00007FFD9B88321A

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 8b21fe4f055db928f031156a79bcd98766e53a1dc58ff6674c503b06834d5758
Instruction ID: 9fb5f07c1f9897bd679920289c39ea21a8aa60046fb49e4a6adfbb63a68b27cf
Opcode Fuzzy Hash: 8b21fe4f055db928f031156a79bcd98766e53a1dc58ff6674c503b06834d5758
Instruction Fuzzy Hash: 1432C331B19D0A4FEBA8EB689465679B3D2EF9C310F55057DE02EC32D6DE38A8428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C56F Relevance: 1.7, Instructions: 1722
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b667bdb26f323d7407a6436b1a32d46ee6d02e1ac07145e7960b9126f2942c
Instruction ID: fcd54d14e5c4ccfe33bbbc10cb85cc52d12d8cb4475b2d5782898241009444b4
Opcode Fuzzy Hash: 74b667bdb26f323d7407a6436b1a32d46ee6d02e1ac07145e7960b9126f2942c
Instruction Fuzzy Hash: 6AB20821B1DD0E4BEB6CEB6894A5A7573D2EFA8310F5541BAD02EC31EBDD38B8424741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88DE0D Relevance: 1.6, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DN_L, xrefs: 00007FFD9B88E072

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID: DN_L
API String ID: 0-226491548
Opcode ID: 61e035e0fe78df6374d5ab57749b75c8321e7459ed94328a135bf7ec6ebc4513
Instruction ID: 5edc0d74d3fa180a4ade7ae6068294e39b05dab43cefe0fb13c28ed88babe125
Opcode Fuzzy Hash: 61e035e0fe78df6374d5ab57749b75c8321e7459ed94328a135bf7ec6ebc4513
Instruction Fuzzy Hash: 84B11371B19E494FE75C9B2CA869A7577D1EB9C300F1241BEE05DC32E3DE38A8028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88FF58 Relevance: .7, Instructions: 721COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59da0d1fbe6ea9a14b41ea25ce1d66763e7344b7e5c5012abaf3086c80e30aa
Instruction ID: 9e2723f8e3e3b49dffae819449d687fc8715e1e5bec68b0c0cabd76b80d29edf
Opcode Fuzzy Hash: d59da0d1fbe6ea9a14b41ea25ce1d66763e7344b7e5c5012abaf3086c80e30aa
Instruction Fuzzy Hash: 02221A31B2DA494BE76CA76894666B573C2FF9C340F45417DE04EC71E7DE28B9028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B888346 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0dee581141b03f7aba021e617dc4bad6aa7af19e8eed3adf6063ceb9884251
Instruction ID: aaf61915ddff8624f3a99dab1bbfb9ecf9c6f89318bd4d7202797602dcf0454a
Opcode Fuzzy Hash: 4d0dee581141b03f7aba021e617dc4bad6aa7af19e8eed3adf6063ceb9884251
Instruction Fuzzy Hash: B5F1A530A09E4E8FEBB8DF28C8557E937E1FF58310F04426AE85DC7295DB7499458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8890F2 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7972202716f3fb822812e806fb53ce68566fe4ff3361456876ab24966c52dd
Instruction ID: ee862f3aa4c2a94cc17ddec717ffdd8ea3e2903453f52aa4b07d8f9aeabc89d3
Opcode Fuzzy Hash: 9e7972202716f3fb822812e806fb53ce68566fe4ff3361456876ab24966c52dd
Instruction Fuzzy Hash: 42E1D730A08E4E8FEBA8DF68C8697E977D1FF58310F04426ED81DC7295DB7499418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8829E1 Relevance: 1.7, APIs: 1, Instructions: 152
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FFD9B882ABF

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 36dbbaafa046386ac166a7464bd831da8d4c8b1320bd98972d684d2332bb324c
Instruction ID: 2b0f1d770620502f0956a786060d33cd20a959132b9ea9ad5bc0a38432bf1ef7
Opcode Fuzzy Hash: 36dbbaafa046386ac166a7464bd831da8d4c8b1320bd98972d684d2332bb324c
Instruction Fuzzy Hash: EC417270A08A1C8FDB98DF98D855BEDBBF1FF59310F1041AAD00DD7296CA75A841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882D3D Relevance: 1.6, APIs: 1, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFD9B882E1A

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c6ed35651882532825955e5200c27e0fe3007fc1dadcca57c87b3fe8da3de23c
Instruction ID: 399a3642318144ce4070a6ed4ff01e8ac2c01a40ad818106ffd8ff88cb5a64c9
Opcode Fuzzy Hash: c6ed35651882532825955e5200c27e0fe3007fc1dadcca57c87b3fe8da3de23c
Instruction Fuzzy Hash: 3341263190DB884FDB199BA89C566A97FE1EF56321F0442AFD099C31A3CA746406C782

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B88F460 Relevance: 4.6, Strings: 2, Instructions: 2136COMMON

Download Yara Rule

Strings

tL_L, xrefs: 00007FFD9B8AB06D
vW_I, xrefs: 00007FFD9B8AADD4

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID: tL_L$vW_I
API String ID: 0-3115775106
Opcode ID: c1e42ecbebfe5cc87d863e0b7ea9c23d6c4fe9b613e44001fc2fa28f30288a14
Instruction ID: 5ad51d853ad3b5292e7e27a8ce1c74b6af932cf6cd9fee3fba95188a5403b2b7
Opcode Fuzzy Hash: c1e42ecbebfe5cc87d863e0b7ea9c23d6c4fe9b613e44001fc2fa28f30288a14
Instruction Fuzzy Hash: 5AD2F531B1EE0E5FEBA8DB6C946567473D1EF68310B1601BAD00EC76A2DE25FC428791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88FBFA Relevance: 3.0, Strings: 2, Instructions: 462COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9B88FF39
HN_^, xrefs: 00007FFD9B88FC01

Memory Dump Source

Source File: 00000000.00000002.2743786229.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_xXQ39a5f9EJP.jbxd

Similarity

API ID:
String ID: HN_^$_
API String ID: 0-1249541639
Opcode ID: 0f97f97f766bfd40c63061b20eb79f541a440620b123b0992ae176fbbc21eb23
Instruction ID: 750ddc4167476283e1ec669a45cdb720f03458e8eb06ac189d75763a7fccc694
Opcode Fuzzy Hash: 0f97f97f766bfd40c63061b20eb79f541a440620b123b0992ae176fbbc21eb23
Instruction Fuzzy Hash: 04C1F057B0D8B646D31A72FDBC695E96B00CF8127AB0841B7D39DCA0D7AC48208793E5

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xXQ39a5f9EJP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xXQ39a5f9EJP.exe.log

C:\Users\user\AppData\Local\Temp\tmp679F.tmp.bat

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
xXQ39a5f9EJP.exe

Function 00007FFD9B89DD00 Relevance: 3.3, Strings: 2, Instructions: 837
COMMON

Function 00007FFD9B8830E2 Relevance: 2.0, Strings: 1, Instructions: 748
COMMON

Function 00007FFD9B88C56F Relevance: 1.7, Instructions: 1722
COMMON

Function 00007FFD9B88DE0D Relevance: 1.6, Strings: 1, Instructions: 381
COMMON

Function 00007FFD9B8829E1 Relevance: 1.7, APIs: 1, Instructions: 152
libraryCOMMON

Function 00007FFD9B882D3D Relevance: 1.6, APIs: 1, Instructions: 138
memoryCOMMON