Edit tour

Windows Analysis Report
xwuh6EHyYm.exe

Overview

General Information

Sample name:	xwuh6EHyYm.exe renamed because original name is a hash value
Original sample name:	3B5A9930C02E7E42AC52627179137656.exe
Analysis ID:	1431456
MD5:	3b5a9930c02e7e42ac52627179137656
SHA1:	c7c8753c5ff727097fdf8b02b457d34e6f88ac18
SHA256:	5d6a67ab649ed8610da623191e8925e4804c9d0eb424b8f50be64b20c098a890
Tags:	AsyncRATexeRAT
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AsyncRAT

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

xwuh6EHyYm.exe (PID: 5064 cmdline: "C:\Users\user\Desktop\xwuh6EHyYm.exe" MD5: 3B5A9930C02E7E42AC52627179137656)

RegAsm.exe (PID: 7152 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5352 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6352 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6312 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Ports": ["7654"], "Server": ["172.160.240.225"], "Mutex": "J9GKTh1eD4ee", "Certificate": "MIIE8jCCAtqgAwIBAgIQALFTXP9pxztw7ybT+benGTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwMzIyMTA0MDE0WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK9unb26jV+8WjRx2wi06Ti2h+PRxc4EDH40tvi/P/A40fcZTX8CgCQWyghbIxODmcB9mzQATFhkhWGnmnRV2wcSgP8EqfqpQTv94RGpGWyxR1WZtm328HVpNHsKUEczS9OE6EcSKmLjoV5u76DAUjkwGFcsjxpWMYWq1nqLJMQbP+CT8US29KRjlZWLNbMe2Zmf2HHLIT5VrFG3+o1IYgsJXghf+dM3oE+l2TYpPQiBYVr2HItV0aRAMW3XXS3tp8wtzHm6MBlrhJFvHfjZ7mfhqY+ZVBl4Cwv08z1fy8FaFgFvIHFmJLX+0W1Uz1fk9Mgyfnq35+HFEJglK6ldicExTQvndSQCl1OifbcFkRNupVfyIP605S0J16QJwxx1tzatZ/GOpOhWZvoIQHqaQAIFonTdoVgr5dZgesvB5pGlqJtWQ1r86wW3Due7exzb1+TvT47ywbVvuOFTXAXOb3OPIv9/7p0qXpzxeFnucLGz9dMWOIOGTJ/YSmPxhbM2Eb4MDg+LZot4oFV2R2ivHitNWZ1dkoxYPwfpHsjL8KJBUsxP7yi+0Yg3MK0ee52aRAq/w9vBadQrSvJGpY5deh5GBTsi9jhf86ZxMzFFBqzkjPWoFSeWgvmnbQb/bYcdPVXvKIU/KxLr7mopxxle3KiCKvFsuoP+lZIGQn9zNsoHAgMBAAGjMjAwMB0GA1UdDgQWBBQylJN6i02YXx9B2gX2CgYC6GWn7TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAY9B9YL8vKs6b9UqrSx2nPhbZCM4N8m0vByVqv+8W2RPtCimnMnWP56RmDSBMOG6Q+0+OPkAXL7kE7DLfEos8/6xb3WcEdSs7QjoVsH4bIWTtPdNOqexHvnrwJQdfo3KLLBcV54zZRijOpiEp5sG7Dmt6ELGe2Ki0lLMgweu/nyNA0RS1c4yMFKC1IC14FBXau5+JKfi+RzIazlJilwJ7CmMU6JAOI9i5XENELxFFPC2mi6LtsEKBSd4rmIXJRfoQDU+lC8UZ3eq4uZmOyKwZVf8lO0VmCuCH5ztN0VAV4qFe2KJEBl9HsDCk6gAgHq2lnZrCnbAjOu769DwQZsTBSVxRLF6J9nCyCYpQxdCpd2H3wPcx5S3vvgZP+NDuUdnlaOimS01DRQPA/Q6zNlsGctEAGLF8FQIasJ/73irn3LBrBFIVN+gONPWOlmiQR8xP7KTOZY6lJcOGNjLrBOeUzcsjZjBUX5EdZ9cDE/KmrsOfx3oW9q4PEkpVYpM4maEeyTeppn9nIKux7voOAGzcYZWWR6YbGwVgjOLZP+EGFR6gL5e2SoPS8yqvreFeYmgSkAxPNJPaYIVu8ZBx91h4xc88nB4yOuzucBrkJoPZw2TFfLXwAJYH/Z61LsEsk/40qcJ0p2HSbkB28vfUd/2vWfL9nnK9rjXSEuVLyDNFbHQ==", "Server Signature": "dln0d26m7j9pvozKWneKRbwcweOPZcXpuh13ma7W8EcxihvJqv6k7Ln/vJ5azG9Ie5ah1foF/2VBYekoCzer5TGAsFhnXX48BKlhRIkazq+I60CW7pn2JHlyXinbxW3cTt2BKICg8L56PCg7K2PHy+jnJ/HBgciompMHfBAmj1haIQG36d99GvgiZ+o8hW1bFAtXsZAJ1OhGRyaIWZT42+WOk9qJawTbJaaytPccgjbFyWdWJvxDDgq9C/n5xF6htbsWQulvbqeGcdY5KVOMzIhRJMuGOxMownjW7MK7gZNjsHbJHtGhrOJoIxDwvGYWXyqZ7wcwy34cHKA0S5O/JZ/Mcoot0F4vkQIwYzZYB/j42SGoPIAcr0Rdor82dp0ip3EG/Im+nq7XM/+H2AYjATNdaG7Lgq26kJW1eQsU+NQXzGx6ecsxc7dSBpqKz/TKbg/7x/gYEMHDF/bYTdDk7hogyTp/IfcySUAeRvuKRZSKe6EbX+sIVl4GV4NpBJYDnGXxHELD5qN2ENYI6hNdwVwUahbZO1j5h6BwVe5Rjo4hybcfO4Czovxj5DNxleffV8mbRapGsDaA5H+rqGhL7030Gc8XVtbRZ/wKnkLBcgnk/we7yUEOz49/64WAEzchCEzDXqHPd0g/wwaO2KygQG700MyNjY7XXOEYbipiD3U="}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x32a:$x1: AsyncRAT 0x368:$x1: AsyncRAT

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2876939091.0000000004F18000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe50b:$x1: AsyncRAT 0xe549:$x1: AsyncRAT
00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa0e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.2876856313.0000000004E5B000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x90b:$x1: AsyncRAT 0x949:$x1: AsyncRAT 0x1e27:$x1: AsyncRAT 0x1e65:$x1: AsyncRAT
00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2b653:$x1: AsyncRAT 0x2b691:$x1: AsyncRAT
00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x91631:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9d475:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xa92d1:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb7e6d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x92a18:$a2: Stub.exe 0x92aa8:$a2: Stub.exe 0x9e85c:$a2: Stub.exe 0x9e8ec:$a2: Stub.exe 0xaa6b8:$a2: Stub.exe 0xaa748:$a2: Stub.exe 0xb9260:$a2: Stub.exe 0xb92f0:$a2: Stub.exe 0x8e2e7:$a3: get_ActivatePong 0x9a12b:$a3: get_ActivatePong 0xa5f87:$a3: get_ActivatePong 0xb4b23:$a3: get_ActivatePong 0x91849:$a4: vmware 0x9d68d:$a4: vmware 0xa94e9:$a4: vmware 0xb8085:$a4: vmware 0x916c1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x916c3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x9d507:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0xa9363:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0xb7eff:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: xwuh6EHyYm.exe PID: 5064	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: xwuh6EHyYm.exe PID: 5064	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x12611:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: RegAsm.exe PID: 6312	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6312	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2ccca:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: RegAsm.exe PID: 6312	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x20dec:$x1: AsyncRAT 0x20e1e:$x1: AsyncRAT 0x2d7c7:$x1: AsyncRAT 0x2d7f9:$x1: AsyncRAT 0x44c59:$x1: AsyncRAT 0x44c8b:$x1: AsyncRAT 0x44cb5:$x1: AsyncRAT 0x2cd90:$s6: VirtualBox 0x22da5:$s8: Win32_ComputerSystem 0x22e7a:$s8: Win32_ComputerSystem 0x2cd43:$s8: Win32_ComputerSystem
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.xwuh6EHyYm.exe.2ad0080.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.xwuh6EHyYm.exe.2ad0080.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8451:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x5107:$a3: get_ActivatePong 0x8669:$a4: vmware 0x84e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e8f:$a6: get_SslClient
0.2.xwuh6EHyYm.exe.2ad0080.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x84e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa251:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6f07:$a3: get_ActivatePong 0xa469:$a4: vmware 0xa2e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c8f:$a6: get_SslClient
4.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.xwuh6EHyYm.exe.2ac4224.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.xwuh6EHyYm.exe.2ac4224.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8451:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x5107:$a3: get_ActivatePong 0x8669:$a4: vmware 0x84e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e8f:$a6: get_SslClient
0.2.xwuh6EHyYm.exe.2ac4224.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x84e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8451:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x5107:$a3: get_ActivatePong 0x8669:$a4: vmware 0x84e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e8f:$a6: get_SslClient
0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x84e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa251:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x18ded:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x1a1e0:$a2: Stub.exe 0x1a270:$a2: Stub.exe 0x6f07:$a3: get_ActivatePong 0x15aa3:$a3: get_ActivatePong 0xa469:$a4: vmware 0x19005:$a4: vmware 0xa2e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x18e7d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c8f:$a6: get_SslClient 0x1682b:$a6: get_SslClient
0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x18e7f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa251:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x16095:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x21ef1:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x30a8d:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x1747c:$a2: Stub.exe 0x1750c:$a2: Stub.exe 0x232d8:$a2: Stub.exe 0x23368:$a2: Stub.exe 0x31e80:$a2: Stub.exe 0x31f10:$a2: Stub.exe 0x6f07:$a3: get_ActivatePong 0x12d4b:$a3: get_ActivatePong 0x1eba7:$a3: get_ActivatePong 0x2d743:$a3: get_ActivatePong 0xa469:$a4: vmware 0x162ad:$a4: vmware 0x22109:$a4: vmware 0x30ca5:$a4: vmware 0xa2e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x16127:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x21f83:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x30b1f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa251:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x160ad:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x24c49:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x17494:$a2: Stub.exe 0x17524:$a2: Stub.exe 0x2603c:$a2: Stub.exe 0x260cc:$a2: Stub.exe 0x6f07:$a3: get_ActivatePong 0x12d63:$a3: get_ActivatePong 0x218ff:$a3: get_ActivatePong 0xa469:$a4: vmware 0x162c5:$a4: vmware 0x24e61:$a4: vmware 0xa2e1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1613d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x24cd9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c8f:$a6: get_SslClient 0x13aeb:$a6: get_SslClient 0x22687:$a6: get_SslClient
0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1613f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x24cdb:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 19 entries

Snort Signatures

ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) - Source IP: 172.160.240.225 - Destination IP: 192.168.2.4

Timestamp:	04/25/24-07:42:00.418689
SID:	2030673
Source Port:	7654
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 172.160.240.225 - Destination IP: 192.168.2.4

Timestamp:	04/25/24-07:42:00.418689
SID:	2035595
Source Port:	7654
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xwuh6EHyYm.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Ports": ["7654"], "Server": ["172.160.240.225"], "Mutex": "J9GKTh1eD4ee", "Certificate": "MIIE8jCCAtqgAwIBAgIQALFTXP9pxztw7ybT+benGTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwMzIyMTA0MDE0WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK9unb26jV+8WjRx2wi06Ti2h+PRxc4EDH40tvi/P/A40fcZTX8CgCQWyghbIxODmcB9mzQATFhkhWGnmnRV2wcSgP8EqfqpQTv94RGpGWyxR1WZtm328HVpNHsKUEczS9OE6EcSKmLjoV5u76DAUjkwGFcsjxpWMYWq1nqLJMQbP+CT8US29KRjlZWLNbMe2Zmf2HHLIT5VrFG3+o1IYgsJXghf+dM3oE+l2TYpPQiBYVr2HItV0aRAMW3XXS3tp8wtzHm6MBlrhJFvHfjZ7mfhqY+ZVBl4Cwv08z1fy8FaFgFvIHFmJLX+0W1Uz1fk9Mgyfnq35+HFEJglK6ldicExTQvndSQCl1OifbcFkRNupVfyIP605S0J16QJwxx1tzatZ/GOpOhWZvoIQHqaQAIFonTdoVgr5dZgesvB5pGlqJtWQ1r86wW3Due7exzb1+TvT47ywbVvuOFTXAXOb3OPIv9/7p0qXpzxeFnucLGz9dMWOIOGTJ/YSmPxhbM2Eb4MDg+LZot4oFV2R2ivHitNWZ1dkoxYPwfpHsjL8KJBUsxP7yi+0Yg3MK0ee52aRAq/w9vBadQrSvJGpY5deh5GBTsi9jhf86ZxMzFFBqzkjPWoFSeWgvmnbQb/bYcdPVXvKIU/KxLr7mopxxle3KiCKvFsuoP+lZIGQn9zNsoHAgMBAAGjMjAwMB0GA1UdDgQWBBQylJN6i02YXx9B2gX2CgYC6GWn7TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAY9B9YL8vKs6b9UqrSx2nPhbZCM4N8m0vByVqv+8W2RPtCimnMnWP56RmDSBMOG6Q+0+OPkAXL7kE7DLfEos8/6xb3WcEdSs7QjoVsH4bIWTtPdNOqexHvnrwJQdfo3KLLBcV54zZRijOpiEp5sG7Dmt6ELGe2Ki0lLMgweu/nyNA0RS1c4yMFKC1IC14FBXau5+JKfi+RzIazlJilwJ7CmMU6JAOI9i5XENELxFFPC2mi6LtsEKBSd4rmIXJRfoQDU+lC8UZ3eq4uZmOyKwZVf8lO0VmCuCH5ztN0VAV4qFe2KJEBl9HsDCk6gAgHq2lnZrCnbAjOu769DwQZsTBSVxRLF6J9nCyCYpQxdCpd2H3wPcx5S3vvgZP+NDuUdnlaOimS01DRQPA/Q6zNlsGctEAGLF8FQIasJ/73irn3LBrBFIVN+gONPWOlmiQR8xP7KTOZY6lJcOGNjLrBOeUzcsjZjBUX5EdZ9cDE/KmrsOfx3oW9q4PEkpVYpM4maEeyTeppn9nIKux7voOAGzcYZWWR6YbGwVgjOLZP+EGFR6gL5e2SoPS8yqvreFeYmgSkAxPNJPaYIVu8ZBx91h4xc88nB4yOuzucBrkJoPZw2TFfLXwAJYH/Z61LsEsk/40qcJ0p2HSbkB28vfUd/2vWfL9nnK9rjXSEuVLyDNFbHQ==", "Server Signature": "dln0d26m7j9pvozKWneKRbwcweOPZcXpuh13ma7W8EcxihvJqv6k7Ln/vJ5azG9Ie5ah1foF/2VBYekoCzer5TGAsFhnXX48BKlhRIkazq+I60CW7pn2JHlyXinbxW3cTt2BKICg8L56PCg7K2PHy+jnJ/HBgciompMHfBAmj1haIQG36d99GvgiZ+o8hW1bFAtXsZAJ1OhGRyaIWZT42+WOk9qJawTbJaaytPccgjbFyWdWJvxDDgq9C/n5xF6htbsWQulvbqeGcdY5KVOMzIhRJMuGOxMownjW7MK7gZNjsHbJHtGhrOJoIxDwvGYWXyqZ7wcwy34cHKA0S5O/JZ/Mcoot0F4vkQIwYzZYB/j42SGoPIAcr0Rdor82dp0ip3EG/Im+nq7XM/+H2AYjATNdaG7Lgq26kJW1eQsU+NQXzGx6ecsxc7dSBpqKz/TKbg/7x/gYEMHDF/bYTdDk7hogyTp/IfcySUAeRvuKRZSKe6EbX+sIVl4GV4NpBJYDnGXxHELD5qN2ENYI6hNdwVwUahbZO1j5h6BwVe5Rjo4hybcfO4Czovxj5DNxleffV8mbRapGsDaA5H+rqGhL7030Gc8XVtbRZ/wKnkLBcgnk/we7yUEOz49/64WAEzchCEzDXqHPd0g/wwaO2KygQG700MyNjY7XXOEYbipiD3U="}

Multi AV Scanner detection for submitted file

Source: xwuh6EHyYm.exe	ReversingLabs: Detection: 79%
Source: xwuh6EHyYm.exe	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for sample

Source: xwuh6EHyYm.exe

Joe Sandbox ML: detected

Source: xwuh6EHyYm.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xwuh6EHyYm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 172.160.240.225:7654 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 172.160.240.225:7654 -> 192.168.2.4:49730

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE

Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.240.225

Source: RegAsm.exe, 00000004.00000002.2874269924.0000000000B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000004.00000002.2876856313.0000000004E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabo
Source: RegAsm.exe, 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xwuh6EHyYm.exe PID: 5064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.2876939091.0000000004F18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.2876856313.0000000004E5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: xwuh6EHyYm.exe PID: 5064, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00DB65C0	4_2_00DB65C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00DB5CF0	4_2_00DB5CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00DBA7A8	4_2_00DBA7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00DB59A8	4_2_00DB59A8

Source: xwuh6EHyYm.exe, 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs xwuh6EHyYm.exe
Source: xwuh6EHyYm.exe, 00000000.00000002.1622526598.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xwuh6EHyYm.exe
Source: xwuh6EHyYm.exe, 00000000.00000000.1620185116.0000000000702000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameaitstatic.exeL vs xwuh6EHyYm.exe
Source: xwuh6EHyYm.exe	Binary or memory string: OriginalFilenameaitstatic.exeL vs xwuh6EHyYm.exe

Source: xwuh6EHyYm.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.2876939091.0000000004F18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.2876856313.0000000004E5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: xwuh6EHyYm.exe PID: 5064, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: xwuh6EHyYm.exe, by-unknown-------------------------.cs	Base64 encoded string: 'QzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XFJlZ0FzbS5leGU='
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, fVEKWDwyIlvXu.cs	Base64 encoded string: 'Ma/HTJfcuEOMulbHuMGIi1ERMIuJi6UIAcB/NLgBgFGNzSjR+ovhKXPk2tTnaD5WpDBF90D+XuESeNDyD1AfbA==', 'SjTLrhmW4S8Bbi1m518AErS2y2qn8RL0+1/Rj5ACBOV1P1ISP6EajNFoWfsn0ZXqSkiRE5ovR3YLypHzmdkW9g==', '/r/OrEukxjD1fLjwEg2Q/gkhStgSPutr3n9oYhHNORliQioYAZbERtPt15R+Ltg167iIDkG8dpL4eWB/1rULqg==', 'NHK/4XwMNlre5+OLb0vgSN9FK/sgK/gIqAJ5SZcPIWJ+gbyWco3pariobp8hTMR+W9mbvVhNpXU/3FniQt2i25SrQpiathI7/GLN5kQq1gxB5YyqIXGpfStdf9Ee2UXHWJTCGANExu9GtTRRnyow1JbYI+spcRzXDlZ4rIIo6b37dHaFvDSrqOChNS2hjEOhAEcQ2AJREp7YmVOsrmluLsGoC0FzQ38+hYP9lQlyMGUrQC1FsfAjj+M7fl4Tq5DDLhQRYnlHCPoj2izZrNIQDIg6FVu+Xni6RDUEWtAC55TKroQwuVUVpUFtMknkfnYC+RCTDci54OWNwp9eStQF+l/bTZS6FgHk+P2+LELDcpZRbCNA5TND9dbyOoAz3pZ+2pwZY37pt1tV7Ip9D4nBnYt8+/MvBwB12UT+R6/EFXbuqbPSTu0epL4lFjGsJ06GkzTNnf3eVXjtKjFFaPDGIk9TvmaRRgI4+v1ab0BXc6mcyYGDPxh0ZmsJK68rhGdayp6sA0OvKFAVGbml6q718ymZe7RH6gTm+bJ9Io+xW3IWLHNVQOGG3ffhIrisbM3FBCRZmPD0aoXzbfJ2dqhYabWqWeOu3QrMiwQwwiEhL0p7LE+/j+Khc+VfHnIjgfXwAj6X3Ery8bEzoKQsIzykx7bH/DDdoQqasPeD5GAuGzy1ZxXTn8giasOyossE5v1J+REqAqUaJ2JOfVDmc+hXSOdFj7M621hQ+TZ+bJeSte1r97/Vv/C95st0G8g6sLibEgPZheJ8jnRYLjSucZ/XcH6lCK20lnxor6e/IQoWzsjj+CMzb+3nXg4c3eeEUz4CD188jx3J92AiFkfU4dor8kOpO9n1mNUEmMCyEknEpWJpRdKmTNvlOA4aOkoZrZvrsKQ3xg6NrS9XelQaxHcqvsfOIYNidP47i7E5Y6APjy9zKwio78UScmRBTKufnjFeIvZVXgPEqsaiQ7EMV+WZRNdLq5e4jf02L6Xe7Pu3n9NzBRcicB8MjLp3fs0CvmqBb7I/roU2zQfBa7pPcwSsFdIl9kyGLniAXiGQ5BOs0HhnnmIw9Kox4WlfD80iydC5vLRIztqfPBB2KKm7+4ycseFY59J/75SlAYeYDsdMjKObNou7m65hTn7OPrmRMut+astMyP/EFrnXAJppwCHy8KmoIxYVfj23g++k4U1aJ6OFd0cKgEWbmuqmlisUbq2xt0FJPAU/39g8TqfXQ+LM6A2cG8fZqnYr02qFixnypYiEOBMXfgnOWgq1HgTix5UV/B6M6cgbvHxP6szP5icOVUsITAPgmsI8F1xXYS68GWT40RpL/cX2WyMkRsZNyzWzgA+SAf8CI6mp0A/3gfuKTploab0n3hJEhp9YUAkIxge/kwGhpS9+s3LPuzdY3kE8AYoTxGK71c4zEGuy4DZESQdxNuL3duZbaFaLP8D8YKYghOuXmnpi12B3OzclMWzYO0DiulCkuKYd2sJC/4xGntsra7GqW0W2F3daZqFSgq8znjyQ9aptCLib8gDXXbPJmANuNjsxR0oYhUoffMaTgnxCR3ic5MLk6XZkULs696YCd60bS62HfCbaDtmwwA7iExNrw1MXUllQ1NyyYgGB5wrXQuPVzldzSqAWCNPSaxka5Abbb+jLD/L2r1fnMEt/tp3eKVFP9SvATz7lM2h6365+gqG/33S54F5w1FPxPl2RWzks3+xEVnSwJZhD9YSUJvmMLYaAsoQVYRhLQjZMEgfQZW9z5d9/H8eq5NONNWHjQBYCS+UC6ig3r6BhpQ6r0nhFLkYvudZ4PcWPL5e5+SksVV4djf1MtOBSFMKaz1nW3AOIv5Zgvo6sL1G+HRkcOY3GAUdjoJp/tYDxM1qXjuPYEDy1yLv2v+PcLN2MCGA2Ee0LE96dgUhXNd/l45xLKWElQe2PmZM4QXLNABpDFIM/wd7xoBPkla1qGFAxjFo4kbWr2HFoWr+WHUirS6UTTiSvMVe+OFUX4QLS7TNjW4hRLurIiCGs15MY7r/nuMrMPle+Re5vK/2lXF2vtE9Xt/yVgu/e7TI5Fz2uEaCM+VoHkT1wzbFD0KkjikXhYr8KdFFJUbfwhWu/4JNTSd/GTGvEWdCUwfCFSceK+fWy4S3rkf491k8hBkup7RPwt9IHdUPYrzFKdjaBqDOw4NN88Gd3InJLq4oakmz27O+L4IkTHZQIOwwmWZyGEhS5s36ZeuFxhy2YPm+T7kvmxqS5pLgFNIPQ1Xn9un0DQi1Pu85yrIM4tNiqYF7sxSYJ0Ac3FgeTh2kGgFTlIoZilZLbPfb9QwUESCvOMyIHVqOMBcJp7h9+GfznypEwsv58NX4=', '+j+Izp4/xoZKcHC4I7fKRIsa/eP7z7Wd4UG/R+USk6STGNoii/uBVj35roTrQSxFGYIqIk38GlHeopbhzZBCpDmGusjIlL5UK79DWQm0bHvey7lxTbC6tTN5ViDZ1tWXmRdcsaFpAEPMkNy4Fh4rKgGFjTfPYz6Zc42tCYi5QTLy0e+1gA+ipCje00MX07GChLjfF6ltylkS2YpV8JxMtcuTuikmfC4w8XQE4gGOaXFxCunPUWZuMzd5ZRGm2p+tHLHMS5KhAq5T6OrqcMrp7Ikx4YEntqyMyAVyRPQ3CdtaBfA2h905Bv0KDPmG1qWDPVEiCFYLVo7XJ7lGodYK66NRVmpDpbFY1akXWYmwfCikQev0oX6
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, fVEKWDwyIlvXu.cs	Base64 encoded string: 'Ma/HTJfcuEOMulbHuMGIi1ERMIuJi6UIAcB/NLgBgFGNzSjR+ovhKXPk2tTnaD5WpDBF90D+XuESeNDyD1AfbA==', 'SjTLrhmW4S8Bbi1m518AErS2y2qn8RL0+1/Rj5ACBOV1P1ISP6EajNFoWfsn0ZXqSkiRE5ovR3YLypHzmdkW9g==', '/r/OrEukxjD1fLjwEg2Q/gkhStgSPutr3n9oYhHNORliQioYAZbERtPt15R+Ltg167iIDkG8dpL4eWB/1rULqg==', 'NHK/4XwMNlre5+OLb0vgSN9FK/sgK/gIqAJ5SZcPIWJ+gbyWco3pariobp8hTMR+W9mbvVhNpXU/3FniQt2i25SrQpiathI7/GLN5kQq1gxB5YyqIXGpfStdf9Ee2UXHWJTCGANExu9GtTRRnyow1JbYI+spcRzXDlZ4rIIo6b37dHaFvDSrqOChNS2hjEOhAEcQ2AJREp7YmVOsrmluLsGoC0FzQ38+hYP9lQlyMGUrQC1FsfAjj+M7fl4Tq5DDLhQRYnlHCPoj2izZrNIQDIg6FVu+Xni6RDUEWtAC55TKroQwuVUVpUFtMknkfnYC+RCTDci54OWNwp9eStQF+l/bTZS6FgHk+P2+LELDcpZRbCNA5TND9dbyOoAz3pZ+2pwZY37pt1tV7Ip9D4nBnYt8+/MvBwB12UT+R6/EFXbuqbPSTu0epL4lFjGsJ06GkzTNnf3eVXjtKjFFaPDGIk9TvmaRRgI4+v1ab0BXc6mcyYGDPxh0ZmsJK68rhGdayp6sA0OvKFAVGbml6q718ymZe7RH6gTm+bJ9Io+xW3IWLHNVQOGG3ffhIrisbM3FBCRZmPD0aoXzbfJ2dqhYabWqWeOu3QrMiwQwwiEhL0p7LE+/j+Khc+VfHnIjgfXwAj6X3Ery8bEzoKQsIzykx7bH/DDdoQqasPeD5GAuGzy1ZxXTn8giasOyossE5v1J+REqAqUaJ2JOfVDmc+hXSOdFj7M621hQ+TZ+bJeSte1r97/Vv/C95st0G8g6sLibEgPZheJ8jnRYLjSucZ/XcH6lCK20lnxor6e/IQoWzsjj+CMzb+3nXg4c3eeEUz4CD188jx3J92AiFkfU4dor8kOpO9n1mNUEmMCyEknEpWJpRdKmTNvlOA4aOkoZrZvrsKQ3xg6NrS9XelQaxHcqvsfOIYNidP47i7E5Y6APjy9zKwio78UScmRBTKufnjFeIvZVXgPEqsaiQ7EMV+WZRNdLq5e4jf02L6Xe7Pu3n9NzBRcicB8MjLp3fs0CvmqBb7I/roU2zQfBa7pPcwSsFdIl9kyGLniAXiGQ5BOs0HhnnmIw9Kox4WlfD80iydC5vLRIztqfPBB2KKm7+4ycseFY59J/75SlAYeYDsdMjKObNou7m65hTn7OPrmRMut+astMyP/EFrnXAJppwCHy8KmoIxYVfj23g++k4U1aJ6OFd0cKgEWbmuqmlisUbq2xt0FJPAU/39g8TqfXQ+LM6A2cG8fZqnYr02qFixnypYiEOBMXfgnOWgq1HgTix5UV/B6M6cgbvHxP6szP5icOVUsITAPgmsI8F1xXYS68GWT40RpL/cX2WyMkRsZNyzWzgA+SAf8CI6mp0A/3gfuKTploab0n3hJEhp9YUAkIxge/kwGhpS9+s3LPuzdY3kE8AYoTxGK71c4zEGuy4DZESQdxNuL3duZbaFaLP8D8YKYghOuXmnpi12B3OzclMWzYO0DiulCkuKYd2sJC/4xGntsra7GqW0W2F3daZqFSgq8znjyQ9aptCLib8gDXXbPJmANuNjsxR0oYhUoffMaTgnxCR3ic5MLk6XZkULs696YCd60bS62HfCbaDtmwwA7iExNrw1MXUllQ1NyyYgGB5wrXQuPVzldzSqAWCNPSaxka5Abbb+jLD/L2r1fnMEt/tp3eKVFP9SvATz7lM2h6365+gqG/33S54F5w1FPxPl2RWzks3+xEVnSwJZhD9YSUJvmMLYaAsoQVYRhLQjZMEgfQZW9z5d9/H8eq5NONNWHjQBYCS+UC6ig3r6BhpQ6r0nhFLkYvudZ4PcWPL5e5+SksVV4djf1MtOBSFMKaz1nW3AOIv5Zgvo6sL1G+HRkcOY3GAUdjoJp/tYDxM1qXjuPYEDy1yLv2v+PcLN2MCGA2Ee0LE96dgUhXNd/l45xLKWElQe2PmZM4QXLNABpDFIM/wd7xoBPkla1qGFAxjFo4kbWr2HFoWr+WHUirS6UTTiSvMVe+OFUX4QLS7TNjW4hRLurIiCGs15MY7r/nuMrMPle+Re5vK/2lXF2vtE9Xt/yVgu/e7TI5Fz2uEaCM+VoHkT1wzbFD0KkjikXhYr8KdFFJUbfwhWu/4JNTSd/GTGvEWdCUwfCFSceK+fWy4S3rkf491k8hBkup7RPwt9IHdUPYrzFKdjaBqDOw4NN88Gd3InJLq4oakmz27O+L4IkTHZQIOwwmWZyGEhS5s36ZeuFxhy2YPm+T7kvmxqS5pLgFNIPQ1Xn9un0DQi1Pu85yrIM4tNiqYF7sxSYJ0Ac3FgeTh2kGgFTlIoZilZLbPfb9QwUESCvOMyIHVqOMBcJp7h9+GfznypEwsv58NX4=', '+j+Izp4/xoZKcHC4I7fKRIsa/eP7z7Wd4UG/R+USk6STGNoii/uBVj35roTrQSxFGYIqIk38GlHeopbhzZBCpDmGusjIlL5UK79DWQm0bHvey7lxTbC6tTN5ViDZ1tWXmRdcsaFpAEPMkNy4Fh4rKgGFjTfPYz6Zc42tCYi5QTLy0e+1gA+ipCje00MX07GChLjfF6ltylkS2YpV8JxMtcuTuikmfC4w8XQE4gGOaXFxCunPUWZuMzd5ZRGm2p+tHLHMS5KhAq5T6OrqcMrp7Ikx4YEntqyMyAVyRPQ3CdtaBfA2h905Bv0KDPmG1qWDPVEiCFYLVo7XJ7lGodYK66NRVmpDpbFY1akXWYmwfCikQev0oX6
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, fVEKWDwyIlvXu.cs	Base64 encoded string: 'Ma/HTJfcuEOMulbHuMGIi1ERMIuJi6UIAcB/NLgBgFGNzSjR+ovhKXPk2tTnaD5WpDBF90D+XuESeNDyD1AfbA==', 'SjTLrhmW4S8Bbi1m518AErS2y2qn8RL0+1/Rj5ACBOV1P1ISP6EajNFoWfsn0ZXqSkiRE5ovR3YLypHzmdkW9g==', '/r/OrEukxjD1fLjwEg2Q/gkhStgSPutr3n9oYhHNORliQioYAZbERtPt15R+Ltg167iIDkG8dpL4eWB/1rULqg==', 'NHK/4XwMNlre5+OLb0vgSN9FK/sgK/gIqAJ5SZcPIWJ+gbyWco3pariobp8hTMR+W9mbvVhNpXU/3FniQt2i25SrQpiathI7/GLN5kQq1gxB5YyqIXGpfStdf9Ee2UXHWJTCGANExu9GtTRRnyow1JbYI+spcRzXDlZ4rIIo6b37dHaFvDSrqOChNS2hjEOhAEcQ2AJREp7YmVOsrmluLsGoC0FzQ38+hYP9lQlyMGUrQC1FsfAjj+M7fl4Tq5DDLhQRYnlHCPoj2izZrNIQDIg6FVu+Xni6RDUEWtAC55TKroQwuVUVpUFtMknkfnYC+RCTDci54OWNwp9eStQF+l/bTZS6FgHk+P2+LELDcpZRbCNA5TND9dbyOoAz3pZ+2pwZY37pt1tV7Ip9D4nBnYt8+/MvBwB12UT+R6/EFXbuqbPSTu0epL4lFjGsJ06GkzTNnf3eVXjtKjFFaPDGIk9TvmaRRgI4+v1ab0BXc6mcyYGDPxh0ZmsJK68rhGdayp6sA0OvKFAVGbml6q718ymZe7RH6gTm+bJ9Io+xW3IWLHNVQOGG3ffhIrisbM3FBCRZmPD0aoXzbfJ2dqhYabWqWeOu3QrMiwQwwiEhL0p7LE+/j+Khc+VfHnIjgfXwAj6X3Ery8bEzoKQsIzykx7bH/DDdoQqasPeD5GAuGzy1ZxXTn8giasOyossE5v1J+REqAqUaJ2JOfVDmc+hXSOdFj7M621hQ+TZ+bJeSte1r97/Vv/C95st0G8g6sLibEgPZheJ8jnRYLjSucZ/XcH6lCK20lnxor6e/IQoWzsjj+CMzb+3nXg4c3eeEUz4CD188jx3J92AiFkfU4dor8kOpO9n1mNUEmMCyEknEpWJpRdKmTNvlOA4aOkoZrZvrsKQ3xg6NrS9XelQaxHcqvsfOIYNidP47i7E5Y6APjy9zKwio78UScmRBTKufnjFeIvZVXgPEqsaiQ7EMV+WZRNdLq5e4jf02L6Xe7Pu3n9NzBRcicB8MjLp3fs0CvmqBb7I/roU2zQfBa7pPcwSsFdIl9kyGLniAXiGQ5BOs0HhnnmIw9Kox4WlfD80iydC5vLRIztqfPBB2KKm7+4ycseFY59J/75SlAYeYDsdMjKObNou7m65hTn7OPrmRMut+astMyP/EFrnXAJppwCHy8KmoIxYVfj23g++k4U1aJ6OFd0cKgEWbmuqmlisUbq2xt0FJPAU/39g8TqfXQ+LM6A2cG8fZqnYr02qFixnypYiEOBMXfgnOWgq1HgTix5UV/B6M6cgbvHxP6szP5icOVUsITAPgmsI8F1xXYS68GWT40RpL/cX2WyMkRsZNyzWzgA+SAf8CI6mp0A/3gfuKTploab0n3hJEhp9YUAkIxge/kwGhpS9+s3LPuzdY3kE8AYoTxGK71c4zEGuy4DZESQdxNuL3duZbaFaLP8D8YKYghOuXmnpi12B3OzclMWzYO0DiulCkuKYd2sJC/4xGntsra7GqW0W2F3daZqFSgq8znjyQ9aptCLib8gDXXbPJmANuNjsxR0oYhUoffMaTgnxCR3ic5MLk6XZkULs696YCd60bS62HfCbaDtmwwA7iExNrw1MXUllQ1NyyYgGB5wrXQuPVzldzSqAWCNPSaxka5Abbb+jLD/L2r1fnMEt/tp3eKVFP9SvATz7lM2h6365+gqG/33S54F5w1FPxPl2RWzks3+xEVnSwJZhD9YSUJvmMLYaAsoQVYRhLQjZMEgfQZW9z5d9/H8eq5NONNWHjQBYCS+UC6ig3r6BhpQ6r0nhFLkYvudZ4PcWPL5e5+SksVV4djf1MtOBSFMKaz1nW3AOIv5Zgvo6sL1G+HRkcOY3GAUdjoJp/tYDxM1qXjuPYEDy1yLv2v+PcLN2MCGA2Ee0LE96dgUhXNd/l45xLKWElQe2PmZM4QXLNABpDFIM/wd7xoBPkla1qGFAxjFo4kbWr2HFoWr+WHUirS6UTTiSvMVe+OFUX4QLS7TNjW4hRLurIiCGs15MY7r/nuMrMPle+Re5vK/2lXF2vtE9Xt/yVgu/e7TI5Fz2uEaCM+VoHkT1wzbFD0KkjikXhYr8KdFFJUbfwhWu/4JNTSd/GTGvEWdCUwfCFSceK+fWy4S3rkf491k8hBkup7RPwt9IHdUPYrzFKdjaBqDOw4NN88Gd3InJLq4oakmz27O+L4IkTHZQIOwwmWZyGEhS5s36ZeuFxhy2YPm+T7kvmxqS5pLgFNIPQ1Xn9un0DQi1Pu85yrIM4tNiqYF7sxSYJ0Ac3FgeTh2kGgFTlIoZilZLbPfb9QwUESCvOMyIHVqOMBcJp7h9+GfznypEwsv58NX4=', '+j+Izp4/xoZKcHC4I7fKRIsa/eP7z7Wd4UG/R+USk6STGNoii/uBVj35roTrQSxFGYIqIk38GlHeopbhzZBCpDmGusjIlL5UK79DWQm0bHvey7lxTbC6tTN5ViDZ1tWXmRdcsaFpAEPMkNy4Fh4rKgGFjTfPYz6Zc42tCYi5QTLy0e+1gA+ipCje00MX07GChLjfF6ltylkS2YpV8JxMtcuTuikmfC4w8XQE4gGOaXFxCunPUWZuMzd5ZRGm2p+tHLHMS5KhAq5T6OrqcMrp7Ikx4YEntqyMyAVyRPQ3CdtaBfA2h905Bv0KDPmG1qWDPVEiCFYLVo7XJ7lGodYK66NRVmpDpbFY1akXWYmwfCikQev0oX6

Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, bxSTaWOWczO.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, bxSTaWOWczO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, bxSTaWOWczO.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, bxSTaWOWczO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, bxSTaWOWczO.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, bxSTaWOWczO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/3@0/1

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xwuh6EHyYm.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\J9GKTh1eD4ee

Source: xwuh6EHyYm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xwuh6EHyYm.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xwuh6EHyYm.exe	ReversingLabs: Detection: 79%
Source: xwuh6EHyYm.exe	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\xwuh6EHyYm.exe "C:\Users\user\Desktop\xwuh6EHyYm.exe"
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: xwuh6EHyYm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xwuh6EHyYm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: xwuh6EHyYm.exe

Static PE information: section name: .text entropy: 7.326919094785039

Source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, tlNvpXkjsT.cs	High entropy of concatenated method names: 'ruGdfWEHww', 'RUsqqnEIkht', 'qBrhYIuNKAkQH', 'jGogMwNMHoMmG', 'iurNAevPxOI', 'OYRvaukxwvYh', 'vOIVGMnuKwA', 'HDnbBKeuPpfCR', 'GfafKEYyxU', 'TiWBBZCPmSgOl'
Source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, tlNvpXkjsT.cs	High entropy of concatenated method names: 'ruGdfWEHww', 'RUsqqnEIkht', 'qBrhYIuNKAkQH', 'jGogMwNMHoMmG', 'iurNAevPxOI', 'OYRvaukxwvYh', 'vOIVGMnuKwA', 'HDnbBKeuPpfCR', 'GfafKEYyxU', 'TiWBBZCPmSgOl'
Source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, tlNvpXkjsT.cs	High entropy of concatenated method names: 'ruGdfWEHww', 'RUsqqnEIkht', 'qBrhYIuNKAkQH', 'jGogMwNMHoMmG', 'iurNAevPxOI', 'OYRvaukxwvYh', 'vOIVGMnuKwA', 'HDnbBKeuPpfCR', 'GfafKEYyxU', 'TiWBBZCPmSgOl'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xwuh6EHyYm.exe PID: 5064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xwuh6EHyYm.exe PID: 5064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: xwuh6EHyYm.exe, 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory allocated: 4A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4960000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2880			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6966			Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe TID: 7156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4416	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5432	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6188	Thread sleep count: 2880 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6188	Thread sleep count: 6966 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 00000004.00000002.2876803447.0000000004E49000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2876939091.0000000004F18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000004.00000002.2874450047.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnS

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: xwuh6EHyYm.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: ReadProcessMemory(by_002Dunknown_FFFD_FFFD_FE0F_FE0F_FFFD_FFFD_FFFD_D83D_DFF3_D83D_DD14_D83C_DFF3_D83D_DEC1_200D_FFFD_D83D_DD35_FFFD_FFFD_FE0F_FFFD_D83D_DE35.ProcessHandle, num3 + 4 + 4, ref by_002Dunknown_FE0F_FFFD_FFFD_FFFD_200D_FFFD_D83E_DC98_FFFD_FFFD_FFFD_FFFD_FFFD_FFFD_200D_FFFD_FFFD_FFFD_D83D_DE1C_FFFD_FFFD_D83D_DF2B_26A7, 4, ref by_002Dunknown_FFFD_FFFD_FFFD_FE0F_D83D_DE3F_200D_FFFD_FFFD_FFFD_D83D_DEA0_FFFD_FE0F_FFFD_FFFD_FFFD_200D_FE0F_FFFD_200D_FFFD_FFFD_FFFD_200D)
Source: xwuh6EHyYm.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: VirtualAllocEx(by_002Dunknown_FFFD_FFFD_FE0F_FE0F_FFFD_FFFD_FFFD_D83D_DFF3_D83D_DD14_D83C_DFF3_D83D_DEC1_200D_FFFD_D83D_DD35_FFFD_FFFD_FE0F_FFFD_D83D_DE35.ProcessHandle, num2, num4, 12288, 64)
Source: xwuh6EHyYm.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: WriteProcessMemory(by_002Dunknown_FFFD_FFFD_FE0F_FE0F_FFFD_FFFD_FFFD_D83D_DFF3_D83D_DD14_D83C_DFF3_D83D_DEC1_200D_FFFD_D83D_DD35_FFFD_FFFD_FE0F_FFFD_D83D_DE35.ProcessHandle, num6, by_002Dunknown_FFFD_FFFD_FE0F_FE0F_FFFD_FFFD_FFFD_FFFD_FFFD_FE0F_FFFD_FE0F_FFFD_200D_200D_FFFD_FFFD_FFFD_FE0F_FFFD_FFFD_FFFD_FFFD_200D_FFFD, num5, ref by_002Dunknown_FFFD_FFFD_FFFD_FE0F_D83D_DE3F_200D_FFFD_FFFD_FFFD_D83D_DEA0_FFFD_FE0F_FFFD_FFFD_FFFD_200D_FE0F_FFFD_200D_FFFD_FFFD_FFFD_200D)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 972008	Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q%
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q(D
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^ql
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^qL
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029B3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q
Source: RegAsm.exe, 00000004.00000002.2875187554.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,^q

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe	Queries volume information: C:\Users\user\Desktop\xwuh6EHyYm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xwuh6EHyYm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ad0080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ab83e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwuh6EHyYm.exe.2ac4224.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xwuh6EHyYm.exe PID: 5064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6312, type: MEMORYSTR

Source: RegAsm.exe, 00000004.00000002.2876856313.0000000004E77000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r\MsMpeng.exe
Source: RegAsm.exe, 00000004.00000002.2876939091.0000000004E8D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2877330774.00000000054FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	312 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xwuh6EHyYm.exe	79%	ReversingLabs	Win32.Trojan.Generic
xwuh6EHyYm.exe	56%	Virustotal		Browse
xwuh6EHyYm.exe	100%	Avira	TR/Dropper.Gen
xwuh6EHyYm.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2875187554.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
172.160.240.225

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431456
Start date and time:	2024-04-25 07:41:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xwuh6EHyYm.exe renamed because original name is a hash value
Original Sample Name:	3B5A9930C02E7E42AC52627179137656.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/3@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 6312 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:42:00	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.141494007698779
Encrypted:	false
SSDEEP:	6:kK8ulDN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:UulMkPlE99SNxAhUeVLVt
MD5:	721A629016DBD1CE99A66684AE486489
SHA1:	43A5D73E28CBF6DAD58D618BE0A4EBAA2727EFB5
SHA-256:	181A187E6B0A19CB542AB703057C5C82F12F071C796569561855A933CD55BEDF
SHA-512:	2F8A1260D1666274F27025EEF3986E39C2195B02BDC137915777EAABD0A73E367462A05315580C4B626418C492D3E14F2BD0B2B4C12BB1F290D66F6385FED4A2
Malicious:	false
Reputation:	low
Preview:	p...... .........S^K...(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xwuh6EHyYm.exe.log

Download File

Process:	C:\Users\user\Desktop\xwuh6EHyYm.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.2645066527358075
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xwuh6EHyYm.exe
File size:	93'184 bytes
MD5:	3b5a9930c02e7e42ac52627179137656
SHA1:	c7c8753c5ff727097fdf8b02b457d34e6f88ac18
SHA256:	5d6a67ab649ed8610da623191e8925e4804c9d0eb424b8f50be64b20c098a890
SHA512:	191409bb3d9abf2165a04602de5ab01e305266e0f9dc035e66878d874f8906aadcad2d4a05bb388131ac2edfce7c330fea6f9b2472ce7d80fde0226c9abf8a22
SSDEEP:	1536:PM+VQ0zOFEsyFAgROmO8+hRDxP+E0hia3EGliNvnp554EO:PMyQ0z7syRqh95KiyEGliNvn35u
TLSH:	1293A34B41C0762ECA272A3B84535F809BB3BA93290DDB3460724B4D65792CFE64BD97
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%$f.................`...........~... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x417eee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x662425E7 [Sat Apr 20 20:30:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e98	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x66e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x15ef4	0x16000	46b5751598c1aed709ef07e8495728fd	False	0.6999844637784091	data	7.326919094785039	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x66e	0x800	6ef7372de6c4c16bc25c9bd13a9e209f	False	0.345703125	data	3.578062429779308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	e14bd16a2d6a2bdfc936a0504ff0a99a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x180a0	0x3e4	data			0.40562248995983935
RT_MANIFEST	0x18484	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-07:42:00.418689	TCP	2030673	ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server)	7654	49730	172.160.240.225	192.168.2.4
04/25/24-07:42:00.418689	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	7654	49730	172.160.240.225	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 07:41:59.955079079 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:00.176335096 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:00.176464081 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:00.190846920 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:00.418689013 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:00.418719053 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:00.418826103 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:00.424113989 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:00.646640062 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:00.691102982 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:01.459801912 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:01.729609013 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:01.729661942 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:01.996037006 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:08.374454021 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:08.425494909 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:08.646352053 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:08.691123009 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:12.725208998 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:12.996885061 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:12.996994019 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:13.219702959 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:13.269243956 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:13.490566969 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:13.492902994 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:13.755547047 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:13.755620956 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:14.024487019 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:23.988455057 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:24.258816957 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:24.258999109 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:24.480909109 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:24.534955978 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:24.755860090 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:24.761872053 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:25.034832001 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:25.035002947 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:25.303616047 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:35.254153013 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:35.515497923 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:35.515588999 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:35.737031937 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:35.784867048 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:36.007783890 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:36.009676933 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:36.274636984 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:36.274765968 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:36.541974068 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:38.362193108 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:38.409836054 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:38.631098986 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:38.675465107 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:46.533684969 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:46.807940006 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:46.808129072 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:47.081896067 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:47.920340061 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:47.972460985 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:48.193487883 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:48.195086002 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:48.468786001 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:48.468930960 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:48.734833002 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:57.785159111 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:58.047907114 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:58.047981977 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:58.269898891 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:58.316106081 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:58.537131071 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:58.538552999 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:58.806401014 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:42:58.806456089 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:42:59.074600935 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:08.364821911 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:08.409862995 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:08.630619049 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:08.675493956 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:09.050811052 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:09.314745903 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:09.314940929 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:09.541968107 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:09.597368956 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:09.818039894 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:09.820333004 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:10.088217020 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:10.088263035 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:10.356724024 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:20.316478968 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:20.587325096 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:20.587388039 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:20.808397055 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:20.862951040 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:21.083760977 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:21.132278919 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:21.913122892 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:22.182426929 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:22.182575941 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:22.451350927 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:31.582133055 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:31.847615957 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:31.847723007 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:32.069292068 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:32.113070011 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:32.334101915 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:32.335901976 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:32.606705904 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:32.606781960 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:32.876395941 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:36.349211931 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:36.394345999 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:36.616873980 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:36.659924030 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:42.847855091 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:43.111814022 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:43.111900091 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:43.333573103 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:43.378585100 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:43.599332094 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:43.601064920 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:43.870754957 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:43.870830059 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:44.139175892 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:54.114120960 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:54.376662970 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:54.376734972 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:54.598201036 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:54.644265890 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:54.865202904 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:54.869380951 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:55.138142109 CEST	7654	49730	172.160.240.225	192.168.2.4
Apr 25, 2024 07:43:55.138267040 CEST	49730	7654	192.168.2.4	172.160.240.225
Apr 25, 2024 07:43:55.406902075 CEST	7654	49730	172.160.240.225	192.168.2.4

Target ID:	0
Start time:	07:41:55
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\xwuh6EHyYm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xwuh6EHyYm.exe"
Imagebase:	0x700000
File size:	93'184 bytes
MD5 hash:	3B5A9930C02E7E42AC52627179137656
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.1623037702.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:41:55
Start date:	25/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#system32
Imagebase:	0x3f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:41:55
Start date:	25/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#system32
Imagebase:	0xb0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:41:55
Start date:	25/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#system32
Imagebase:	0x350000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:41:55
Start date:	25/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	#system32
Imagebase:	0x630000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.2876939091.0000000004F18000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000004.00000002.2873963186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.2876856313.0000000004E5B000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.2875187554.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	35.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	65
Total number of Limit Nodes:	4

Executed Functions

Function 028A0C88 Relevance: 3.4, APIs: 2, Instructions: 378
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028A0548: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 028A1354

Part of subcall function 028A0554: Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,028A0DCC), ref: 028A14B3

Part of subcall function 028A0560: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,028A0E0A,?,00000004,?), ref: 028A1571

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 028A0ECF
ResumeThread.KERNELBASE(?), ref: 028A0FE4

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: ProcessThread$AllocContextCreateMemoryReadResumeVirtualWow64
String ID:
API String ID: 2498194165-0
Opcode ID: 4a20c6fe150a86298f5c4f3c89753b8aa063292245a414ce784493a0048d847a
Instruction ID: f8ecb8ec74cd974d6d1fd8cc144516ce9f3ccb5e09c9c73ed9f22234feae8b90
Opcode Fuzzy Hash: 4a20c6fe150a86298f5c4f3c89753b8aa063292245a414ce784493a0048d847a
Instruction Fuzzy Hash: EFE1AE74E002198BDB15DFA9C854BAEBBF6AF84304F248169D409FB295DF30AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 028A0C78 Relevance: 3.3, APIs: 2, Instructions: 275
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028A0560: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,028A0E0A,?,00000004,?), ref: 028A1571

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 028A0ECF
ResumeThread.KERNELBASE(?), ref: 028A0FE4

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: AllocMemoryProcessReadResumeThreadVirtual
String ID:
API String ID: 137364078-0
Opcode ID: 2f0b4e554efb08d3f7e81fbce61fcd6e2f878bdf9a50045ad990824470ef94b1
Instruction ID: 660cf584d27a370c6d4825112261d7c9bea8544ad862825bf8f653cb02c26205
Opcode Fuzzy Hash: 2f0b4e554efb08d3f7e81fbce61fcd6e2f878bdf9a50045ad990824470ef94b1
Instruction Fuzzy Hash: DFB16C78E002198FEB24CFA9C854BDEBBB6AF48304F248169D418FB295DB749985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 028A120C Relevance: 1.6, APIs: 1, Instructions: 144
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 028A1354

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5acf9f4a4dbdf72798f9791c70a12ef25d499c07aba00b303be5cd2f867f9c84
Instruction ID: 9fe45db085e85979a2316f84956114f58cb6ed273ce97e5902925a14b94b3a86
Opcode Fuzzy Hash: 5acf9f4a4dbdf72798f9791c70a12ef25d499c07aba00b303be5cd2f867f9c84
Instruction Fuzzy Hash: AA512579900219DFEB10CFA9C954BDEBBB6BF49304F1480AAE50CA7250DB759A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 028A0548 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 028A1354

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d54316b914b78906786d3f5e834a0a8f79dcfe38db7a409749a0dafed9f09c68
Instruction ID: 54162448e3153fb5b450af9abcf9e6a189b8fbf66f83dbded9047c1ee4db009b
Opcode Fuzzy Hash: d54316b914b78906786d3f5e834a0a8f79dcfe38db7a409749a0dafed9f09c68
Instruction Fuzzy Hash: 92510575901219DFEF20CFA9C944BDEBBB6BF48304F1480AAE508B7250DB759A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 028A056C Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,028A11AD,?,?,00000000), ref: 028A163C

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 59276620261c49b5b0b7bb0b9cbda091a3a63069f9a7f4ffe155468521fa71f5
Instruction ID: e3656cfdfbe18d626425507c4825f1f8c4790f75d8d825bcb67b8010444e4b13
Opcode Fuzzy Hash: 59276620261c49b5b0b7bb0b9cbda091a3a63069f9a7f4ffe155468521fa71f5
Instruction Fuzzy Hash: CB21F5B9900309DFDB10CF99C884BDEBBF8FB08314F54842AE558E7241D378AA44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 028A15BB Relevance: 1.6, APIs: 1, Instructions: 60
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,028A11AD,?,?,00000000), ref: 028A163C

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe3f1bcdbc16002265bed7ee51631a5b67f239c6d5bc60606313ed7050c0e3da
Instruction ID: a944ae1b62c53f13d9ae989a64201ec6889d44a77f80aeb45c53376f35f47eb4
Opcode Fuzzy Hash: fe3f1bcdbc16002265bed7ee51631a5b67f239c6d5bc60606313ed7050c0e3da
Instruction Fuzzy Hash: 7A21F3B59002599FDB10CFA9D884BDEBBF4BB48324F14842AE558E7240C3789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 028A14F8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,028A0E0A,?,00000004,?), ref: 028A1571

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e238e16e396edffcfd721a43afadb8e894c01d7b189b78c5a6aabb2096ff0cb6
Instruction ID: 84283df50cb65fb7fd09c9a59571c72c693bc5ce008a90af8aed86b7a6ad2309
Opcode Fuzzy Hash: e238e16e396edffcfd721a43afadb8e894c01d7b189b78c5a6aabb2096ff0cb6
Instruction Fuzzy Hash: 982104B5800359DFDB10CF9AC885ADEFBF4FB48310F10842AE958A7251C374A644CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 028A0560 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,028A0E0A,?,00000004,?), ref: 028A1571

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b2b5bf651205b339b3763f953c7df4806d3b6df096bbdc7e8df49156b96939d7
Instruction ID: 0efc2f1f7bfa114144d289605415739a74a5f443e3d952dce53d309b63266228
Opcode Fuzzy Hash: b2b5bf651205b339b3763f953c7df4806d3b6df096bbdc7e8df49156b96939d7
Instruction Fuzzy Hash: 7421E4B5900359DFDB10CF9AD884BDEBBF4FB08314F50842AE958A7250D378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 028A0554 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,028A0DCC), ref: 028A14B3

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 709ec8781ad2163d54e6d6c38f52ac5025675736347746bcdc1317b6b875d12b
Instruction ID: d56aa1b3d7e5d65311c314ffb775a3207a13b2bd1a5a27424ba29930123b3a7f
Opcode Fuzzy Hash: 709ec8781ad2163d54e6d6c38f52ac5025675736347746bcdc1317b6b875d12b
Instruction Fuzzy Hash: 861112BAD002498FDB10CF9AC848BDEBBF5EB88324F14C469E558A7240D778A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028A0578 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,028A0DCC), ref: 028A14B3

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 27d978bb5a1badff95ad2d80217f593fe68663ae628345f359c9bf6f94902368
Instruction ID: 406b9fa7ce718e1694ddfc1add4e8158deca912766752cb7b5a0ceb7ac23dbae
Opcode Fuzzy Hash: 27d978bb5a1badff95ad2d80217f593fe68663ae628345f359c9bf6f94902368
Instruction Fuzzy Hash: 471112BA9002498FDB10CF9AC848BDEBBF5EB88324F14C029E558B7240D778A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028A1443 Relevance: 1.6, APIs: 1, Instructions: 55
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,028A0DCC), ref: 028A14B3

Memory Dump Source

Source File: 00000000.00000002.1622972634.00000000028A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a0000_xwuh6EHyYm.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 34258d034e2b06217848a255e1fdf3e3c40435ccf2510c8f13a6b9c9e6966e5e
Instruction ID: 7a149ce957f71576dfd2969cef299059f77f63d693005062de894c035f8e6670
Opcode Fuzzy Hash: 34258d034e2b06217848a255e1fdf3e3c40435ccf2510c8f13a6b9c9e6966e5e
Instruction Fuzzy Hash: 5E1126B5D002498FDB20CFAAD844BEEFBF5EB88324F14C069D458A3241D7789545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 027BD3B4 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1622787058.00000000027BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27bd000_xwuh6EHyYm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3e69f2bf5a55bc7ef92b085d6453feb7462e7b6f0bf3b94fe46b9275a672bb
Instruction ID: 42cdb79037b60409d267260c23a294d7f60f60ccfc939648f2ce6f91e18fb432
Opcode Fuzzy Hash: 7c3e69f2bf5a55bc7ef92b085d6453feb7462e7b6f0bf3b94fe46b9275a672bb
Instruction Fuzzy Hash: 1C2122B1500200DFDB2ADF14D9C4B67BF65FF88324F24C5A9EC094B256C336E456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 027BD3AF Relevance: .1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1622787058.00000000027BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27bd000_xwuh6EHyYm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: b2fda74e05cc2213831eb4b6f1d989e48a0c3dc1e7b3a9dca022a495621912fd
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 6511AF76504280CFCB16CF10D5C4B56BF72FB94314F24C5A9DC494B656C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6312, Parent PID: 5064COMMON

Executed Functions

Function 00DB5CF0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7625e33958ac5e36ff14f64d35cfb6bb6524682d526862b09705821e44c964c3
Instruction ID: 3ca55956975e1b0e09e72107b5d5ee80299892a1aea387b09d5a5cfd30831d1c
Opcode Fuzzy Hash: 7625e33958ac5e36ff14f64d35cfb6bb6524682d526862b09705821e44c964c3
Instruction Fuzzy Hash: 6DB14E70E00609CFDF14DFA9D9957EEBBF2AF88304F188129E41AA7254EB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00DB65C0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71370bab7286b85b89bdb65bcbd717877ab3280b2e6d013239bbcbf2754977e7
Instruction ID: 35bb41505278befaaac58a9a8b684b973ce9602099cb074e4a94238f635ecdb0
Opcode Fuzzy Hash: 71370bab7286b85b89bdb65bcbd717877ab3280b2e6d013239bbcbf2754977e7
Instruction Fuzzy Hash: 2DB14D74E00209CFDF14CFA9D8957DDBBF2AF88714F188129D41AA7294EB78D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1727 Relevance: 5.4, Strings: 4, Instructions: 444COMMON

Download Yara Rule

Strings

xbq, xrefs: 00DB1D76
,, xrefs: 00DB1870
a^q, xrefs: 00DB1D3C
a^q, xrefs: 00DB1CDF

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q$ a^q$,$xbq
API String ID: 0-2180861429
Opcode ID: fc09f2d55a27bb6b742875a14ac5cae3abb22c02456afc406a7780c00d3ad4a2
Instruction ID: b62f3286b2a0dc5501adad68c310b2064cc12f3b9b13b20682a7df73c50080b7
Opcode Fuzzy Hash: fc09f2d55a27bb6b742875a14ac5cae3abb22c02456afc406a7780c00d3ad4a2
Instruction Fuzzy Hash: 7B028F74701200DFD705AF28D4A4B5EBBE2AB84304F14896DE4069F3A9DF71EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB887F Relevance: 4.2, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DB8CED
4'^q, xrefs: 00DB882E
4'^q, xrefs: 00DB8851

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$LR^q
API String ID: 0-3152497598
Opcode ID: fefeede5b9017649e26e45bf6a3f35098b33f87f895345734b6e5c7a272e08c0
Instruction ID: fbde392c1408a4f2fc541dd282701a61898185692eab4d62b683ae8b4871ea0c
Opcode Fuzzy Hash: fefeede5b9017649e26e45bf6a3f35098b33f87f895345734b6e5c7a272e08c0
Instruction Fuzzy Hash: 9C31E371B04209CFCF45EB78E9057AE7BA4EB51704F14449DE04A9B2A9DF345E068BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1962 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

xbq, xrefs: 00DB1D76
a^q, xrefs: 00DB1D3C
a^q, xrefs: 00DB1CDF

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q$ a^q$xbq
API String ID: 0-2081302502
Opcode ID: bb6e11a481484f8b3f4cbfd1b78dd9dcfb3cbee4ab4c93bd2279fbcec0bdef0a
Instruction ID: 7bab118f6c3a6106bff765f789f811112fda0584c0e283dcff9e15393eaa8c25
Opcode Fuzzy Hash: bb6e11a481484f8b3f4cbfd1b78dd9dcfb3cbee4ab4c93bd2279fbcec0bdef0a
Instruction Fuzzy Hash: 45616D74740200DFD705AF28D854B9EBBE2EB84704F14896DE1069F3A5DFB1ED468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9E10 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

xbq, xrefs: 00DBA156
[, xrefs: 00DBA02E

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: xbq$[
API String ID: 0-1843721657
Opcode ID: 531eaf1d62935506a6b7827d8a3ca11e5e0e4566fff58bc3eaefd8d514d96ccf
Instruction ID: 038b15a46f0ac22b7a6a8cb55f7477cfe13ea933b419338c824cf37addff09c0
Opcode Fuzzy Hash: 531eaf1d62935506a6b7827d8a3ca11e5e0e4566fff58bc3eaefd8d514d96ccf
Instruction Fuzzy Hash: 989136B0A01300EFE715DF2CE8547D57BA2B785B14F14852AD416CB3A4DBB19A46CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0EB8 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

(bq, xrefs: 00DB1192
Te^q, xrefs: 00DB0EED

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: (bq$Te^q
API String ID: 0-2856382362
Opcode ID: ee5b1b2f4ed1276c44fd7f4a407ed5ecd21b53df795a286c68623e21f1c8f797
Instruction ID: e17944acb2921a6820122f19884e9f721e4ed615345400669183e81857bec5e2
Opcode Fuzzy Hash: ee5b1b2f4ed1276c44fd7f4a407ed5ecd21b53df795a286c68623e21f1c8f797
Instruction Fuzzy Hash: 51517A34B102149FC744DF6DC458A9EBBF6EF89710F6581A9E806DB3A6CA75DC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0D20 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00DB0E40
dLdq, xrefs: 00DB0D5B

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Hbq$dLdq
API String ID: 0-411705877
Opcode ID: 6fd66dfa693e1161a81970920c6573762fa5d5fbeeb291d43e3d841104aa66ec
Instruction ID: 7e8e7f1b5312af8257b223e711c3c288759e613f7ae6b823d7f69b2a41bfdedd
Opcode Fuzzy Hash: 6fd66dfa693e1161a81970920c6573762fa5d5fbeeb291d43e3d841104aa66ec
Instruction Fuzzy Hash: BA41A0317042049FCB159F69D458A9EBFF6EF89300F1985AAE406DB3A2CB75DD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9278 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$^q, xrefs: 00DB92AD
$^q, xrefs: 00DB92B7

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: b1b6207bf8ff8f81267f2df31facb58d429f1159dff682188e714bf93446ad4e
Instruction ID: ca1139b7fd652d623434f022165a238787b7678f6d300cda1f737f7a2fa959b4
Opcode Fuzzy Hash: b1b6207bf8ff8f81267f2df31facb58d429f1159dff682188e714bf93446ad4e
Instruction Fuzzy Hash: 31415B30A0C845DBC7185F6A94A846DFBB2BB847053788855F1478B7A8CF32DC17CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB899C Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DB8CED

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 8c5e9cea8602c01badc2e21abb3053b1b0da5092d2bc65bfe7dea25e3f91a33a
Instruction ID: abb464085ef4e062ae6ff6655a90e7ecb6381f0931f83aee31b87ec083317afa
Opcode Fuzzy Hash: 8c5e9cea8602c01badc2e21abb3053b1b0da5092d2bc65bfe7dea25e3f91a33a
Instruction Fuzzy Hash: 500162B1F01101DFDB44EB7899127EE36B4EF54B00F24445EE506DB291EA709E0187B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB896D Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DB8CED

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: a67d8863b52a792ba5b6e4cb6fc207f6baa0c8195996f6515898a86fe41bcf93
Instruction ID: 1ecf4bb19c2c617f015714a86ee0b984bb2ffc0ca99ffc07acbe5a2be2e40aa0
Opcode Fuzzy Hash: a67d8863b52a792ba5b6e4cb6fc207f6baa0c8195996f6515898a86fe41bcf93
Instruction Fuzzy Hash: 1C01D270B04241CFCB45AB7889122EE36A4EF95700F14449EE446DB2D5EB708E06C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2DA8 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

./\, xrefs: 00DB2DD8, 00DB2FD4

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: ./\
API String ID: 0-3176372042
Opcode ID: 38419a6292a19796bdc82ed71762c9250c7e929a8edbb1245c928e56be28f518
Instruction ID: 5f5da7a8391060f5dd4214112b6732ffe930a3d70bd5fcd1c0027cc1a3477370
Opcode Fuzzy Hash: 38419a6292a19796bdc82ed71762c9250c7e929a8edbb1245c928e56be28f518
Instruction Fuzzy Hash: 4BA1CF31A00205DFCB15DF69C4845AEBBF2FF85310F1486A9D45AAB396DB30ED46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9BB8 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00DB9C56

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 75efb5d2f93c164861f292a950f4879315470007e614caed995a422110375f2c
Instruction ID: 4dad9ddfaebaee143175600cf144865feb125290b5bd347a4cee2203b1c96d0f
Opcode Fuzzy Hash: 75efb5d2f93c164861f292a950f4879315470007e614caed995a422110375f2c
Instruction Fuzzy Hash: 1A517B34600244DFD714DB2AC9A8BA9BBF2BF48714F248159E6029B3F5CB71AC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1339 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DB138B

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: bcc2a8dfec979277836100d8447166ea6a1b5114e55b1a6f58234a8ef48cfb3f
Instruction ID: a8b29a79dd099c3070ecca81b34c5ecfc6eacfe55eee8e472061572b60fe6ac8
Opcode Fuzzy Hash: bcc2a8dfec979277836100d8447166ea6a1b5114e55b1a6f58234a8ef48cfb3f
Instruction Fuzzy Hash: 7D410434F002168FCB04AB7CC465AAE7BF6EFC5314B544169D54ADB395EE30CC0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9261 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

$^q, xrefs: 00DB92AD

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: fa04e5abee566c79690f37f97cf17ed7a328e568264e62d861310911deb61ea3
Instruction ID: 64844d10ba106597c73e8c9ab403a019b9b192c10e973b542661f854bafa3d35
Opcode Fuzzy Hash: fa04e5abee566c79690f37f97cf17ed7a328e568264e62d861310911deb61ea3
Instruction Fuzzy Hash: FE418C30A0C980DBC7191F6984684ADFFB2BB857053788895F147CA7A4CB35CC17CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0D10 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

dLdq, xrefs: 00DB0D5B

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: dLdq
API String ID: 0-3390252261
Opcode ID: e4f542e2b76eceac4012377862d0ec092e2ae362fca47ac9f1996bd91ccd282a
Instruction ID: e3f9c55c67271a55c343cb0186b0a3bfacaaff42089b5be8ade83c99984ad320
Opcode Fuzzy Hash: e4f542e2b76eceac4012377862d0ec092e2ae362fca47ac9f1996bd91ccd282a
Instruction Fuzzy Hash: 68313C35A00204DFDB15DF69C458B9EBBF6AF48300F188569E406AB3A1CB75ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9190 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00DB91AA

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: d4afc89868fc59f330450214586e41e19ed1f297b5f64ad52ae71f5e70e0512e
Instruction ID: f03d020ea961e51f3a89ebee84d4306a4cf4af45a98bdf7ed588a5e4c2d8b7ba
Opcode Fuzzy Hash: d4afc89868fc59f330450214586e41e19ed1f297b5f64ad52ae71f5e70e0512e
Instruction Fuzzy Hash: 73218130B10154DFDB049B6CD868BADBBF6AF88710F244159E506DB3B1CF719C058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB3321 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

|, xrefs: 00DB3380

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: aa430c43bd617a58919d5a86a4db43a5514eb99fa086c25cedc4b8e2854fa087
Instruction ID: 840651ec3060df016520392963801eb8fa11601f8f51ececae0d285985507ab1
Opcode Fuzzy Hash: aa430c43bd617a58919d5a86a4db43a5514eb99fa086c25cedc4b8e2854fa087
Instruction Fuzzy Hash: C9117C75B00210DFCB44DF79C814BAE7BF5AF88700F10846AE94AEB3A0DB359D019B95

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9697 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00DB96C3

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 81e0207975a765ee1c3bf718b7264554282e1c7830af8c70eb4595251b448c6d
Instruction ID: 71f31d1d4ec9783a9200b9f9bc2489beb6b3cc5c3e08653ef98ecf816a6894d3
Opcode Fuzzy Hash: 81e0207975a765ee1c3bf718b7264554282e1c7830af8c70eb4595251b448c6d
Instruction Fuzzy Hash: 58118130B50200CFDB149F69C459BAEBBF6EF88710F15405AE902EB3A1CEB59C01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DB96A8 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00DB96C3

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: d4dbadd6285f0041871afe38209045a8e4b295ad04840c710906d1c408b882e4
Instruction ID: 3d2edec49f98454b9c5fcb3d30cea2ac7bc9b5af466e0e1aa8f9df9250f41eb7
Opcode Fuzzy Hash: d4dbadd6285f0041871afe38209045a8e4b295ad04840c710906d1c408b882e4
Instruction Fuzzy Hash: 4B113034B50204DFDB149F69C499FADBBE6EF88710F144059E502AB3A5CEB59C01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA5D0 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00DBA5FD

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 8adc39850755d097301b7813b9829a96c7efdf3d6d07e0471fefb9a9c85ee900
Instruction ID: 619a4e8896355b0e9181c37deb21dd16379c6f0ea5c80f4d3f63c285155e4ff2
Opcode Fuzzy Hash: 8adc39850755d097301b7813b9829a96c7efdf3d6d07e0471fefb9a9c85ee900
Instruction Fuzzy Hash: 7F11AC71B102049FCB049B18D919BAE7BF6AB88710F240059F502EB3A1CF719D05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0E3F Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00DB0E40

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 6875523071aa9ea465a2e7809e2a3115e0f22968667e0e968f248151064e9775
Instruction ID: c8feaaf98fa8e4f8906062d9986667d8f5d64da32c7c0721119a981adc607c4d
Opcode Fuzzy Hash: 6875523071aa9ea465a2e7809e2a3115e0f22968667e0e968f248151064e9775
Instruction Fuzzy Hash: 26F0C8303042545FC3469B3DA81446E7FEBEFCA25035A44F6E10ACB3E6DD298C068775

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8CD8 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00DB8CED

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 2cffcf40ecfb2b205fbde2f9d1872ab522f74850cd7133ac483e2372ee048017
Instruction ID: 3cb5c11d4821ebac4a098e1ea715c11c5ba1021a79e714ab2cba89ca9ebf5cfd
Opcode Fuzzy Hash: 2cffcf40ecfb2b205fbde2f9d1872ab522f74850cd7133ac483e2372ee048017
Instruction Fuzzy Hash: 87016271B00115DFCB44EB68D912AEE77B9EF88B00F1040ADE54ADB290EB709E01C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB5CE4 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017e369623ce3d0f3eaa117a1f8647ef0414537deb3ba15b05af22190c44a0a0
Instruction ID: ca1ad645922c105222ca6cd800a76333e77aa4ff03b516ce39367b05d9437f07
Opcode Fuzzy Hash: 017e369623ce3d0f3eaa117a1f8647ef0414537deb3ba15b05af22190c44a0a0
Instruction Fuzzy Hash: D5B13D70E00609CFDF10DFA9D9957DEBBF1AF48314F188129E41AA7254EB749845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB65B7 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5d7f5de60d56ea46b42a6a65ca5485774efe2fb8728b5785ff3b4f7e279ffb
Instruction ID: 18d923ae6a821cd8c5b94fab3e95186490eb37547ed7229a367bdbb49bd6cab5
Opcode Fuzzy Hash: bd5d7f5de60d56ea46b42a6a65ca5485774efe2fb8728b5785ff3b4f7e279ffb
Instruction Fuzzy Hash: 4CA14C70E00209CFDF10CFA9D9957DDBBF1AF48714F188129D85AA7294EB78D885CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA208 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34099d7b18fa59fef51869dd87f4eb314e287e5840b3df0eedb1b0cf8668cc9c
Instruction ID: 58b3ccc76c849d1854231b5c36042b78e8359324faa4a9c45c3385ecde26c16e
Opcode Fuzzy Hash: 34099d7b18fa59fef51869dd87f4eb314e287e5840b3df0eedb1b0cf8668cc9c
Instruction Fuzzy Hash: 62A18C70B05205DFCB09EF78D454AADB7F2EF89304B108969D9069B395DF30DD4A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2A20 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda2d650501c46e8cb2f03dd4c0c8670fd4a0e86a6246bb45a21edb7099a7431
Instruction ID: c6844947eff419adfeed6dd4a54351dc119eb15d791bf8175a9ed85bb1566424
Opcode Fuzzy Hash: dda2d650501c46e8cb2f03dd4c0c8670fd4a0e86a6246bb45a21edb7099a7431
Instruction Fuzzy Hash: F3A19C746053419FCB05EF30E458A5E7BB2FF84750B208A69D5068F3AADF35998ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2A30 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9959eef61aff0129c89876dea9943d0b4028021ca1e80a098b51a7ebe829b99
Instruction ID: 34c97986000fe76139661a625e885fae5c41810aba404478f7dd7d240a040c64
Opcode Fuzzy Hash: e9959eef61aff0129c89876dea9943d0b4028021ca1e80a098b51a7ebe829b99
Instruction Fuzzy Hash: FDA19C746053419FCB05EF34E45895E7BB2FF84750B208A69D5068F3AADF31998ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DB942B Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200f571fe0aa24315cad90ec2b0dfc63ceaa8d7b5fddfc20230ae57646b2e00a
Instruction ID: 63d541584a35ea9dfed1df320c0be9b70aab439ea729a24fd55fb576e34122d5
Opcode Fuzzy Hash: 200f571fe0aa24315cad90ec2b0dfc63ceaa8d7b5fddfc20230ae57646b2e00a
Instruction Fuzzy Hash: 35417C34600155DFCB14DF68C994AAEFBB2FF45314F2184A9E516AB3A6CB31EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DB37F8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714c484dba91ac19525d3936e5520a03cce909cf97421cc01ec066d2fe74427d
Instruction ID: 2d5b31581bff54bbe286238648d052fbd6141dc4e418b77f3a97a8a48ba8e9f0
Opcode Fuzzy Hash: 714c484dba91ac19525d3936e5520a03cce909cf97421cc01ec066d2fe74427d
Instruction Fuzzy Hash: 9241CD71B002448FCB28EF7DD5956AEBBF6EBC8314F14842DD14A9B380CF3499468BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0AA0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e31acdf2fd8d9dbad4f6ef957b3bf5069b2445c7bdeefe084fd3b0fe2938afa
Instruction ID: 2de3184fb3b23dac623c4ac31242d425cea254e79c782bafabf97f639185665e
Opcode Fuzzy Hash: 9e31acdf2fd8d9dbad4f6ef957b3bf5069b2445c7bdeefe084fd3b0fe2938afa
Instruction Fuzzy Hash: F551B03861A205DFC706EF28F9A49497B63FB84305750866ED40ACB37DEB35A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DB11D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ce9b0aef51d6ca0b77d9031fe5fca570f4f22bbefe5b604f18cfa9a09cab63
Instruction ID: 536f61855285b9d60e5dba9ceae8cefebc5050d37c4daa7961608746ed62803a
Opcode Fuzzy Hash: b2ce9b0aef51d6ca0b77d9031fe5fca570f4f22bbefe5b604f18cfa9a09cab63
Instruction Fuzzy Hash: EA41A070E00209EFCB04EFBDC5546AEBBFAEF88300F648569D44AD7345DA349D428BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4210 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e30d74ff6d5dae6356e7541ba06faaf07da95eb35b753f6020b92a1b174ea7d
Instruction ID: aa0dcd6ae19880c84517deb7f4144d99b5407958adb38fc0cdc02153145266fc
Opcode Fuzzy Hash: 4e30d74ff6d5dae6356e7541ba06faaf07da95eb35b753f6020b92a1b174ea7d
Instruction Fuzzy Hash: D041E1B0D00349DFDB10DF99C584ADEBFF5BF48314F148429E41AAB254DB74A985CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00DB4207 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315ff4501b1cb84df64c8e20a22ea953b1338fa9e295d0a8ce61e21867057f26
Instruction ID: 1eaf4bd95e343bbc0e7df6645ba8424702a158a9d7ec8138a7794191bb507f7e
Opcode Fuzzy Hash: 315ff4501b1cb84df64c8e20a22ea953b1338fa9e295d0a8ce61e21867057f26
Instruction Fuzzy Hash: E04102B5D00349DFCB10DF99C580ADEBFF4BF48314F148429E81AAB254DB749989CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0998 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d9e48f368042f2faff216170f12efc46a1da35655f1e2d9add40a87d461bec
Instruction ID: 67b9b545282475cd79ccc2cb9a744b9edcd90ab1c9df095baf687e0f94d9f47b
Opcode Fuzzy Hash: 74d9e48f368042f2faff216170f12efc46a1da35655f1e2d9add40a87d461bec
Instruction Fuzzy Hash: FE216030704702EFDB65AB74A9686EF3FA8AF55301B19886DD407C72A5EF34C9018B75

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874639909.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088bf1c746a8c07ce1ce4bc109727feb4b8dfabb65b315a4bfa11a9619a2ddc4
Instruction ID: 807504a6eee94406bd669e75b8620f8cca1a41b9431c50f7ece83a00ff04b011
Opcode Fuzzy Hash: 088bf1c746a8c07ce1ce4bc109727feb4b8dfabb65b315a4bfa11a9619a2ddc4
Instruction Fuzzy Hash: FF213371504200DFDB01DF84D9C4B26BF62FB94328F24C56AED0D0A29AC336D846CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926200d6906ac62c713356297c4e70a3017b7b6402914c0d102c3b701204f432
Instruction ID: 9b9858bfe21df2ba5d5908cda5d52bd2218aa66361ec963bb4f2236f308945e4
Opcode Fuzzy Hash: 926200d6906ac62c713356297c4e70a3017b7b6402914c0d102c3b701204f432
Instruction Fuzzy Hash: 0B216F30714302DFDF64ABB5A9686EF7EA8AF44305718882DD40BC6254EF34C902DB76

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8FF3 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61825dc300c2f87d4a74a0c15785641fd530687884036b670407faa6aba8632
Instruction ID: 7ed2f6b5e66515ed2e087231897d72d5d8d8d8048151e543b775c5e507a221c3
Opcode Fuzzy Hash: a61825dc300c2f87d4a74a0c15785641fd530687884036b670407faa6aba8632
Instruction Fuzzy Hash: 66215930601215CFCB15AB78D9646AEBBB6EF89304F14442CD446EB3A5DF319C8ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB9E6B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccae131901beb0147b9997542dfc7845e30d705ca4a0d072494a78e2ad196ea
Instruction ID: 3b19eab95a36064df4cc5565928d0ac0619329d398d4e9ebaa918ccae9cdaad9
Opcode Fuzzy Hash: 4ccae131901beb0147b9997542dfc7845e30d705ca4a0d072494a78e2ad196ea
Instruction Fuzzy Hash: 72217AB5A01300EFE715DF28E8947D07BA2B784B10F04856AD401CB365DB708A46CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA1FB Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c6d2eaa4d22a95971705972bcd6c6358478896f1c5542bc12e0e833eeb70e7
Instruction ID: 6b9006cb32e97ca257e28da571c3c9ec644adb4cf6ab8d2db9411674fb69db7c
Opcode Fuzzy Hash: 31c6d2eaa4d22a95971705972bcd6c6358478896f1c5542bc12e0e833eeb70e7
Instruction Fuzzy Hash: A11106317082008BCB04A77CD9945AD77E69BC4654700867DCD0ADB399EF31DD0A47F6

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1431 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93d1e8405bf3b04cece823d02b1facd5c0401bbb81def64e55f5ee05061b83b
Instruction ID: 80b1bf462287e75df02c83bfd267191b2bea474691bce0b566b57c6116106c72
Opcode Fuzzy Hash: c93d1e8405bf3b04cece823d02b1facd5c0401bbb81def64e55f5ee05061b83b
Instruction Fuzzy Hash: 2D118274A01205DFCB51EB78D45856A7BF2BF8970575504BDD40ACB3A4EB30CD42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB5B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9660025ac7b285d61108a7c69cbb66ad00976c7df798c8dde00f27675eec7267
Instruction ID: 4454dc0c0d7f7f96a1fde5942512c973a32577ffd79ae8f4879f5cfbeb2a373d
Opcode Fuzzy Hash: 9660025ac7b285d61108a7c69cbb66ad00976c7df798c8dde00f27675eec7267
Instruction Fuzzy Hash: B511D370A01205DFCB40FB78D8116AEBBF5EF81314B108A6DD5168B396EB71990A8BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874639909.0000000000D0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 11a7841cbd6368016eace637ae154998693f23e8f66a5b67a54f7fe16c071c81
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 45110372404280CFCB02CF44D9C4B16BF72FB94328F28C5AADD090B256C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DB1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9edf7295c6613351c8a118498be35d8a2829621675338e1b14b1667b0e3eefd
Instruction ID: f8057c874fc7da197c89ccf196a21956416dfd52ebb250158bd4952223b006f6
Opcode Fuzzy Hash: a9edf7295c6613351c8a118498be35d8a2829621675338e1b14b1667b0e3eefd
Instruction Fuzzy Hash: C611AD74B01209DFCB54EBB9D554A6A7BE6AF8870571008BDD00ACB364EA31CC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB5C0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f87bd2f86093fcfe05941d437f729d8944114f04d5454eca70e0288f91d6be
Instruction ID: 0e10aa68218e054ba6d38662ed8977408733ff2ea331291b38e2df9f6df66c71
Opcode Fuzzy Hash: 19f87bd2f86093fcfe05941d437f729d8944114f04d5454eca70e0288f91d6be
Instruction Fuzzy Hash: 9F11C470601205DFCB40FB38D4116AEBBF5EF85314B108A6DD1068B386EB719A0ACBF5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB37E9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f903e55ad817569ff846de1706c109a46f30be1321212ab1f461a2a8267cc47
Instruction ID: 929642aa8e449d84a549ec41809c0f167cfa5f1bf2e16cd8fc15d116878aab64
Opcode Fuzzy Hash: 2f903e55ad817569ff846de1706c109a46f30be1321212ab1f461a2a8267cc47
Instruction Fuzzy Hash: 9201DF303012008BCB18AB3DA6A46BE76A3EBC5354B04853DE00BCB791CF35CC4A9765

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8D68 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8c3dc3cc7f3e914afe1969cb22de689f84b2b886afeaf54d023ff7f4e90cb2
Instruction ID: aacd62ce37c1fb0224ef3b11989a95cef858e5b652ccf6ed7dadff55cda6fc63
Opcode Fuzzy Hash: 5e8c3dc3cc7f3e914afe1969cb22de689f84b2b886afeaf54d023ff7f4e90cb2
Instruction Fuzzy Hash: 85111EB5800648CFCB20CF9AD584BDEBBF4EB48324F20841AD559A7250C778A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB8D60 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fdb421464949ae13bed39df8f15877bf89c2f52713114de8c8d30e19ff5947
Instruction ID: 39e013f43744aecf777e5ee086e06588fe33068c1f58fde0310efa936f5a7b6a
Opcode Fuzzy Hash: b8fdb421464949ae13bed39df8f15877bf89c2f52713114de8c8d30e19ff5947
Instruction Fuzzy Hash: B71112B5800648CFCB10CF99D584BDEBBF4AB08324F20841AC569B7250C738A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00DB25F1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630054c83e22b7d63cd688932b5da73a4587202f3a52f42600b6809db9fb036e
Instruction ID: bd9ff83b65daae6dbfdf59dc23192d5c6feb345dff870cd2f57fcec78a63b998
Opcode Fuzzy Hash: 630054c83e22b7d63cd688932b5da73a4587202f3a52f42600b6809db9fb036e
Instruction Fuzzy Hash: D4D052300242008FC344DF98E498D82BBA8BF55A00B01009AE8018B223C721A810EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0A8F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62bf6f95656ed9636aa051fea51fc873df68be8401f46f291ea80f0ab7c5e85a
Instruction ID: 62cef7f1a91351c23a6efd147c70e5563532153833f4a419cfafe767b5d47037
Opcode Fuzzy Hash: 62bf6f95656ed9636aa051fea51fc873df68be8401f46f291ea80f0ab7c5e85a
Instruction Fuzzy Hash: 9DC08C21144307EFE31027A0F90CAED3D29ABC1305F008822A043842A5CE7C4802533F

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0A73 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3183a2da057eac562d16e17bb7472d4f9ee042539f1056fc2a0b51baf360a75
Instruction ID: dcadec8146d34fcf1a7bcf89453c5994748da8fb49f2c7d14a552d07dc5cf448
Opcode Fuzzy Hash: d3183a2da057eac562d16e17bb7472d4f9ee042539f1056fc2a0b51baf360a75
Instruction Fuzzy Hash: DDC08C2114474AEFEB1027A0F90CAED3E29A7C1305F008826A043842A5CE7C4842973F

Uniqueness

Uniqueness Score: -1.00%

Function 00DB2600 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218e4c13fab5a2c69efbf71f30264478f9006db640652dd49332cb3f09782a52
Instruction ID: 98ee300482e656ecfc93354bbd4b8bb06d33255cd89fb234c33b14f871955a40
Opcode Fuzzy Hash: 218e4c13fab5a2c69efbf71f30264478f9006db640652dd49332cb3f09782a52
Instruction Fuzzy Hash: 34C048392642088F8244EA99E598C12B7A8BF58A00341009AE5058B732CB21F810DA61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00DBA7A8 Relevance: 1.0, Instructions: 1020COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef0378dc99612f05ee58f96854980ecf8666d6edc3a40e3ec17a89a5bd4eb32
Instruction ID: 44d054ae8c57c634c08c8bacab0329952ca791a7423e21635aec010bb6207a1b
Opcode Fuzzy Hash: cef0378dc99612f05ee58f96854980ecf8666d6edc3a40e3ec17a89a5bd4eb32
Instruction Fuzzy Hash: 69827B30700205CFDB14DF69C99476EBAE2FF84304F648569E14A8B3A6CFB1DD4A8B61

Uniqueness

Uniqueness Score: -1.00%

Function 00DB59A8 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2874902457.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_db0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aedb50ecc0fb888b4db5417a1cf8eaffb57647e5167271d4c88c733f42a148dd
Instruction ID: 7c814a4ed1d2ede48b8440d2fa85324fa9f2ae5bd16407d450f6f7e928eb26a2
Opcode Fuzzy Hash: aedb50ecc0fb888b4db5417a1cf8eaffb57647e5167271d4c88c733f42a148dd
Instruction Fuzzy Hash: 0D917170E00709CFDF14CFA9D9917DDBBF2AF88704F188129D41AA7258DB749885CB55

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xwuh6EHyYm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xwuh6EHyYm.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
xwuh6EHyYm.exe

Function 028A0C88 Relevance: 3.4, APIs: 2, Instructions: 378
memorythreadCOMMON

Function 028A0C78 Relevance: 3.3, APIs: 2, Instructions: 275
memorythreadCOMMON

Function 028A120C Relevance: 1.6, APIs: 1, Instructions: 144
processCOMMON

Function 028A0548 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Function 028A056C Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Function 028A15BB Relevance: 1.6, APIs: 1, Instructions: 60
injectionCOMMON

Function 028A14F8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 028A0560 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 028A0554 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Function 028A0578 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Function 028A1443 Relevance: 1.6, APIs: 1, Instructions: 55
threadCOMMON

Function 027BD3B4 Relevance: .1, Instructions: 75
COMMON

Function 027BD3AF Relevance: .1, Instructions: 56
COMMON