Edit tour

Windows Analysis Report
O0I14144.exe

Overview

General Information

Sample name:	O0I14144.exe renamed because original name is a hash value
Original sample name:	Serfinanzas sas obligacin de pago pendiente 632012447844D024400C0401I747O9965002152002178968523365101404253177A00270010O0I14144.exe
Analysis ID:	1486300
MD5:	2edc069ff3ad923a690b87b479a5730b
SHA1:	6a2b61caaee1a01e07600733817b0fd246df0aef
SHA256:	11eb08d4313711c1753029776d19d11eaabba4af381b456ccc405cd1d5784752
Tags:	exenjrat
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AsyncRAT

Yara detected DcRat

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Yara signature match

Classification

Process Tree

System is w10x64

O0I14144.exe (PID: 1196 cmdline: "C:\Users\user\Desktop\O0I14144.exe" MD5: 2EDC069FF3AD923A690B87B479A5730B)

conhost.exe (PID: 5276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "dxpam.duckdns.org", "Ports": "5999", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "jvLtElaMrTwMxP1PP38PSfO1IDqo4CS5", "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALz18kcXxyYRNtzNciIOitqVEEKYOOJZOGjSaWOLKz3M/Df8QpKzt86Y+GK3639BYF/OzJ6i8PyJcI4jCe+L56ytnlJDfAYTzg7df+pvpE6bSgYYgBSEMcKBPrpx6bV5z/V8FOCVqlt9xfM47rHzIs6kOkc0Xu0TqFGxVfi3Koj/AgMBAAGjMjAwMB0GA1UdDgQWBBQOZShjgdZ92lUVGT5AalbF4rcBrDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABuRWEmIgb/BjPElBrcq4LuUTHLBWgnJN3yXXtFA+Nl/+mYto5FZMUmzz3mbjKRHuzo79jdei4h1vSO9+2gTFWw1mY8HoeEoyL0YExBQMCoUPjpLJEuAydiWBMXXBmv0zPzE3W7zhG6DRe8pXQkZ2yu8c9G4KxXS1ITmSrlJqBQ6", "ServerSignature": "eROjiuz0PWs+xgxamB7sdm3kB9OKtq8I1pPHgtkdiF0h9pw4eJzyp0fCw7zAO7/Q6+ftDqxvY+0OnHCoiErkMARDy55VYX6/gB5S0xXaoVgAqsvboJJN7EtFrwNTMUTPnslStHIwjEI/4a7JpzD5BLO0KCD9qZ2yVxSo7MwJXPE=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x236f6:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.3609001047.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2569990328.00000179F58C0000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x4a8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3893502294.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3286320057.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3164758658.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2975716985.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2456977547.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4167565251.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4479290218.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3422261313.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4486989808.00000179F5940000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xd708:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x10c3e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.3175992535.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4220604796.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4487765659.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3635692766.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3643963176.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4486924059.00000179F58C1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3a8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3172097914.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3852099703.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4486562668.00000179F5840000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xd7a8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x10cde:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9af0:$a2: timeout 3 > NUL 0x9b10:$a3: START "" " 0x999b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x999b:$s2: L2Mgc2NodGFza3MgL2 0x991a:$s3: QW1zaVNjYW5CdWZmZXI 0x9968:$s4: VmlydHVhbFByb3RlY3Q
00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cd2:$q1: Select * from Win32_CacheMemory 0x9d12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9dae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa14a:$s1: DcRatBy
00000000.00000003.4331716148.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2980365684.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4172144002.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4325221172.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2880319799.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2565382447.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2348032885.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2756003699.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3898327239.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3830502451.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4471042057.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2760409553.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xb100:$b1: DcRatByqwqdanchun 0x44a2c:$b2: DcRat By qwqdanchun1
00000000.00000003.3070691319.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3169213864.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.4001942793.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3503972303.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2467759953.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3121126867.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3508303558.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3426951741.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3030221509.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.2569860231.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3075988779.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3846495356.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4484756612.000001798030F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.4484756612.000001798030F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x75b0:$b2: DcRat By qwqdanchun1 0xf2d4:$b2: DcRat By qwqdanchun1 0xf524:$b2: DcRat By qwqdanchun1
00000000.00000003.3372677514.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000003.3116631490.00000179F673C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x9490:$b2: DcRat By qwqdanchun1 0x10b8c:$b2: DcRat By qwqdanchun1
00000000.00000002.4484756612.0000017980085000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x232c5c:$b2: DcRat By qwqdanchun1
Process Memory Space: O0I14144.exe PID: 1196	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: O0I14144.exe PID: 1196	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: O0I14144.exe PID: 1196	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1411e8:$a1: havecamera 0xbfb47:$b1: DcRatByqwqdanchun 0x145dd7:$b1: DcRatByqwqdanchun 0x2061:$b2: DcRat By qwqdanchun1 0x5c0d:$b2: DcRat By qwqdanchun1 0x15963:$b2: DcRat By qwqdanchun1 0x1a94e:$b2: DcRat By qwqdanchun1 0x1e43d:$b2: DcRat By qwqdanchun1 0x22c24:$b2: DcRat By qwqdanchun1 0x266f6:$b2: DcRat By qwqdanchun1 0x2a1e3:$b2: DcRat By qwqdanchun1 0x31c44:$b2: DcRat By qwqdanchun1 0x35808:$b2: DcRat By qwqdanchun1 0x6f1cf:$b2: DcRat By qwqdanchun1 0x72c3d:$b2: DcRat By qwqdanchun1 0x79d24:$b2: DcRat By qwqdanchun1 0x7da76:$b2: DcRat By qwqdanchun1 0xae059:$b2: DcRat By qwqdanchun1 0xb1963:$b2: DcRat By qwqdanchun1 0xb9bcd:$b2: DcRat By qwqdanchun1 0xcb506:$b2: DcRat By qwqdanchun1
Click to see the 54 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.O0I14144.exe.179f5a50000.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.O0I14144.exe.179f5a50000.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65f7:$a1: havecamera 0x9af0:$a2: timeout 3 > NUL 0x9b10:$a3: START "" " 0x999b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.O0I14144.exe.179f5a50000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x999b:$s2: L2Mgc2NodGFza3MgL2 0x991a:$s3: QW1zaVNjYW5CdWZmZXI 0x9968:$s4: VmlydHVhbFByb3RlY3Q
0.2.O0I14144.exe.179f5a50000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cd2:$q1: Select * from Win32_CacheMemory 0x9d12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9dae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.O0I14144.exe.179f5a50000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa14a:$s1: DcRatBy
0.2.O0I14144.exe.179f5a50000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.O0I14144.exe.179f5a50000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47f7:$a1: havecamera 0x7cf0:$a2: timeout 3 > NUL 0x7d10:$a3: START "" " 0x7b9b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7c50:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0.2.O0I14144.exe.179f5a50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7c50:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b9b:$s2: L2Mgc2NodGFza3MgL2 0x7b1a:$s3: QW1zaVNjYW5CdWZmZXI 0x7b68:$s4: VmlydHVhbFByb3RlY3Q
0.2.O0I14144.exe.179f5a50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7ed2:$q1: Select * from Win32_CacheMemory 0x7f12:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7f60:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7fae:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.O0I14144.exe.179f5a50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x834a:$s1: DcRatBy
Click to see the 5 entries

Suricata Signatures

ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT) - Source IP: 89.117.23.25 - Destination IP: 192.168.2.5

Timestamp:	2024-08-01T22:39:28.038485+0200
SID:	2848048
Source Port:	5999
Destination Port:	58852
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.O0I14144.exe.179f5a50000.0.unpack

Malware Configuration Extractor: AsyncRAT {"Server": "dxpam.duckdns.org", "Ports": "5999", "Version": "1.0.7", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "jvLtElaMrTwMxP1PP38PSfO1IDqo4CS5", "Mutex": "DcRatMutex_qwqdanchun", "Certificate": "MIICMDCCAZmgAwIBAgIVAIhNlmebb6nSe6ECHjMpYKJ1i7gvMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIxMDEyODA1MzU1N1oXDTMxMTEwNzA1MzU1N1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALz18kcXxyYRNtzNciIOitqVEEKYOOJZOGjSaWOLKz3M/Df8QpKzt86Y+GK3639BYF/OzJ6i8PyJcI4jCe+L56ytnlJDfAYTzg7df+pvpE6bSgYYgBSEMcKBPrpx6bV5z/V8FOCVqlt9xfM47rHzIs6kOkc0Xu0TqFGxVfi3Koj/AgMBAAGjMjAwMB0GA1UdDgQWBBQOZShjgdZ92lUVGT5AalbF4rcBrDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBABuRWEmIgb/BjPElBrcq4LuUTHLBWgnJN3yXXtFA+Nl/+mYto5FZMUmzz3mbjKRHuzo79jdei4h1vSO9+2gTFWw1mY8HoeEoyL0YExBQMCoUPjpLJEuAydiWBMXXBmv0zPzE3W7zhG6DRe8pXQkZ2yu8c9G4KxXS1ITmSrlJqBQ6", "ServerSignature": "eROjiuz0PWs+xgxamB7sdm3kB9OKtq8I1pPHgtkdiF0h9pw4eJzyp0fCw7zAO7/Q6+ftDqxvY+0OnHCoiErkMARDy55VYX6/gB5S0xXaoVgAqsvboJJN7EtFrwNTMUTPnslStHIwjEI/4a7JpzD5BLO0KCD9qZ2yVxSo7MwJXPE=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Multi AV Scanner detection for submitted file

Source: O0I14144.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: O0I14144.exe

Joe Sandbox ML: detected

Source: O0I14144.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: ntdll.pdb source: O0I14144.exe, 00000000.00000003.2037353881.00000179F5A6A000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4487408350.00000179F5BF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: O0I14144.exe, 00000000.00000003.2037353881.00000179F5A6A000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4487408350.00000179F5BF6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FDE144 FindFirstFileExW,

0_2_00007FF624FDE144

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: dxpam.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: dxpam.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:58852 -> 89.117.23.25:5999

Source: Joe Sandbox View

IP Address: 89.117.23.25 89.117.23.25

Source: Joe Sandbox View

ASN Name: LRTC-ASLT LRTC-ASLT

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: dxpam.duckdns.org

Source: O0I14144.exe, 00000000.00000002.4485937377.00000179F3FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: O0I14144.exe, 00000000.00000002.4486562668.00000179F58B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: O0I14144.exe, 00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4484756612.0000017980085000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 00000000.00000003.3609001047.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2569990328.00000179F58C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3893502294.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3286320057.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3164758658.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2975716985.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2456977547.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4167565251.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4479290218.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3422261313.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4486989808.00000179F5940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000003.3175992535.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4220604796.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4487765659.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3635692766.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3643963176.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4486924059.00000179F58C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3172097914.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3852099703.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4486562668.00000179F5840000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 00000000.00000003.4331716148.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2980365684.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4172144002.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4325221172.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2880319799.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2565382447.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2348032885.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2756003699.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3898327239.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3830502451.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4471042057.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2760409553.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3070691319.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3169213864.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.4001942793.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3503972303.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2467759953.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3121126867.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3508303558.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3426951741.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3030221509.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.2569860231.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3075988779.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3846495356.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4484756612.000001798030F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3372677514.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000003.3116631490.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000000.00000002.4484756612.0000017980085000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FC10A0 Sleep,SleepEx,GetConsoleWindow,GetConsoleWindow,ShowWindow,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,NtDelayExecution,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,Sleep,SleepEx,

0_2_00007FF624FC10A0

Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FD3DC4	0_2_00007FF624FD3DC4
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FD661C	0_2_00007FF624FD661C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FD6080	0_2_00007FF624FD6080
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FD6F3C	0_2_00007FF624FD6F3C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FDDF38	0_2_00007FF624FDDF38
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FDE144	0_2_00007FF624FDE144
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FE41C8	0_2_00007FF624FE41C8
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FD4CC8	0_2_00007FF624FD4CC8
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FE6510	0_2_00007FF624FE6510
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FE0508	0_2_00007FF624FE0508
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FDB33C	0_2_00007FF624FDB33C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FE1BEC	0_2_00007FF624FE1BEC
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FE3C28	0_2_00007FF624FE3C28
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00000179F594E99C	0_2_00000179F594E99C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00000179F594ED78	0_2_00000179F594ED78
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00000179F594F1A8	0_2_00000179F594F1A8
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00000179F5952454	0_2_00000179F5952454
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00000179F594DAC0	0_2_00000179F594DAC0
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00000179F594FC5C	0_2_00000179F594FC5C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF848FC01F8	0_2_00007FF848FC01F8
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF848FC0A7E	0_2_00007FF848FC0A7E
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF848FC88D2	0_2_00007FF848FC88D2
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF848FC7B26	0_2_00007FF848FC7B26

Source: O0I14144.exe, 00000000.00000003.2037353881.00000179F5BE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs O0I14144.exe
Source: O0I14144.exe, 00000000.00000002.4487408350.00000179F5D6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs O0I14144.exe
Source: O0I14144.exe, 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs O0I14144.exe

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 00000000.00000003.3609001047.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2569990328.00000179F58C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3893502294.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3286320057.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3164758658.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2975716985.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2456977547.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4167565251.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4479290218.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3422261313.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4486989808.00000179F5940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000003.3175992535.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4220604796.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4487765659.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3635692766.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3643963176.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4486924059.00000179F58C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3172097914.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3852099703.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4486562668.00000179F5840000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 00000000.00000003.4331716148.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2980365684.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4172144002.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4325221172.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2880319799.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2565382447.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2348032885.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2756003699.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3898327239.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3830502451.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4471042057.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2760409553.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3070691319.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3169213864.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.4001942793.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3503972303.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2467759953.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3121126867.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3508303558.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3426951741.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3030221509.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.2569860231.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3075988779.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3846495356.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4484756612.000001798030F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3372677514.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000003.3116631490.00000179F673C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000000.00000002.4484756612.0000017980085000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, Settings.cs	Base64 encoded string: 'so6g8x/eplbfvXco0YjpK61piELa5aaeIrmAy4YRQQg12B3O/4OssgFxOasBcXePktPc8OHNkuWzvsHTq9816w==', 'wOBTH/LB4xcVlp60+l/GiL1RJDeCvRc1k0j2FkLdtiKb1N9s8E8y9ZB1WTxXTsbeAI27X9uqsuTfQVPCIqAlasCEcykvatsAs4zX6owV7YQ=', 'zf/CF/z6BAwgKNyFDxWfgDmZ5BrTVQ+ueymGu63piwojDK6/xnTrT8b+nfpRel6VnMrQAN1QEdOxBfEm7Rp7Kw==', 'MGXxjJpPq1eucRt3GWYF551CI4rRGUn2efpmOxwfSqxjCyggrFAvFnQ1iAdXRWVZ+T7nFXH2uObt8fFtHJeBVA+BLpaueDatEgtrQ7+m5Hw=', 'zRACpORMeGzkzAVexlLwub13RLhFRubUknBt1Bfl6QpYwQWlRRYotHBgsrStBLoPojWlwI7UuXeSNhLtEF1+CMmWv8p7ufhgLokbyKtK5wAeX4jZ/De0klugpTLMphdTaMmH6vDDtvA3nZ3JEnJHkhGSukt5Z5c+ZHw4wGCY90BkdoIkDaRg2AI+MkfQYPKi1NIprGlDaBwnSmFHm8+L2opZFD2j3hqQx8rK7Z9R5wLpgE89l5LllhSbB3hz9Anf149zao/Ex7qE1gLq1Q2IptxpvANbTLDCelQJ2uZ70bRzFtZULxJJf+jH/m7arIpGeEkNrtDBs/4LJmg9txFMSzurOSwJc5/2SJFRhlYzS9QdOn7x3jpOJ9JcUV3Ocg9+2/OYeBTk7C8IwpO+nwTtbBbYod5stnisZfq9blBxVhpU//a9F8/c4RuMmCNO50zIucMkhrVqqxUoa/nSHbi0JoMFt1Ejl4MTm/0FVFHb2EDAdukodR+noPLPMR80NrEkx95b5//KETTM0glp8tHMkoXbq5h18JLuSmpzIvZuTCzht0me2Yu5q/cdjy9yrYRE3ZExUpVNF2yvDpuKEuP/PAnbsoALAa5pJyjgD4/rk/1KarTLCvJ5b6ZOpR7jnk2CvDUB4kz/qq+H/NFW/ryM3kfcQZzPT+YHu6pD8apkBI5zw4rZmRhALSckHRrwzsvg9PcUtHUb7p5rNrJ7FurTUxex78845Guvq8MHne4PU+4aUoVVGrGhUOQAzHbsno/TCDwNX0AQNy2NXk7t2LJSKxpa1HwdjMwwHepAfAtwMWeegwPahFZLTONqL7v+8uvvBF94YiWxdiRJH1Ot0lWPUu9syFuhor2bTE30CQKTKvjjPWtC40h0osQ2873VJUUbIjtnDPOvahe125/r1id3nG9nvcm4dzIG8FzjhuD8XlyNVVf/ek/aAMfwlz68jtPcNID9PfTYvn6EAB4oaCzwoZ+T/7WQjuhW+FrOym53bNSkRaUauqZSPA1vlK4F7KnFINgkuwpIcxoXTQnwThCo/qCURYMBHkwjTBIT5i41GgdGH1kHdgSjSoXS5nDE1l47', 'nNB4duZsqTXXJhPbIn21qvAyaPcvIs+dxUFmPFY7aHZtcxsym7AgPk2gBWzQQZcIfrf5LHlOe7dFTTuuoC+t+da5acKzzc80neyHO8Dl7lBvn6cg4zCLwfAU7EcejmXp7IGiMYNy/NvXXqT5gxyu7d5Y2xQSz2EzzCQ5bbb2RnHw9JCWuqwCIbXZgwJnVP2sAJ3E3uEjseQpxoToM27QDRFG8zV5gWKCzXzOLJDWWLO/AIaNVvUEvw3zbzuUdPw4Q7gM3wYaghOb9oIgsVAociw9Xy8j+yI86nfDhzUDpyM=', 'tSF/UchRkcTn1ZApgUy+YoFKxI01SWx7d4jbekqktXcSZUS2OC1KYKYwhB98vVteWIRnzIIbebsQPMh4y2NZJw==', 'UM28kXtlB2aa3s2iXYPt6vS9J0JiuASU6llohJaHQ/6L/SRIIHiQ9+v49D/GeVTcS0A2gLdWhjGLGKEY78IFpA=='
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/0@7/1

Source: C:\Users\user\Desktop\O0I14144.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5276:120:WilError_03
Source: C:\Users\user\Desktop\O0I14144.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcRatMutex_qwqdanchun

Source: O0I14144.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\O0I14144.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: O0I14144.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\O0I14144.exe "C:\Users\user\Desktop\O0I14144.exe"
Source: C:\Users\user\Desktop\O0I14144.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Section loaded: msdmo.dll	Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: O0I14144.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: O0I14144.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: O0I14144.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ntdll.pdb source: O0I14144.exe, 00000000.00000003.2037353881.00000179F5A6A000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4487408350.00000179F5BF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: O0I14144.exe, 00000000.00000003.2037353881.00000179F5A6A000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4487408350.00000179F5BF6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\O0I14144.exe

0_2_00007FF624FC10A0

Source: O0I14144.exe

Static PE information: section name: _RDATA

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR

Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: O0I14144.exe, 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\O0I14144.exe	Memory allocated: 179F5A00000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Memory allocated: 179F5E40000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe	Window / User API: threadDelayed 2186			Jump to behavior
Source: C:\Users\user\Desktop\O0I14144.exe	Window / User API: threadDelayed 7638			Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe TID: 2072

Thread sleep time: -37815825351104557s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FDE144 FindFirstFileExW,

0_2_00007FF624FDE144

Source: C:\Users\user\Desktop\O0I14144.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: O0I14144.exe, 00000000.00000003.2569990328.00000179F58C0000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000003.3504100086.00000179F58E2000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000003.3609957547.00000179F58E3000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4486962642.00000179F58E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FD2E2C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF624FD2E2C

Source: C:\Users\user\Desktop\O0I14144.exe

0_2_00007FF624FC10A0

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FDF910 GetProcessHeap,

0_2_00007FF624FDF910

Source: C:\Users\user\Desktop\O0I14144.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FD2E2C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF624FD2E2C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FCB0A4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF624FCB0A4
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FE8744 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF624FE8744
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: 0_2_00007FF624FCB250 SetUnhandledExceptionFilter,	0_2_00007FF624FCB250

Source: C:\Users\user\Desktop\O0I14144.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, Amsi.cs	Reference to suspicious API methods: Win32.VirtualAllocEx(procAddress, (UIntPtr)(ulong)patch.Length, 64u, out var _)

Source: O0I14144.exe, 00000000.00000003.2348032885.00000179F666D000.00000004.00000020.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4484756612.0000017980083000.00000004.00000800.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4484756612.0000017980064000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: O0I14144.exe, 00000000.00000002.4484756612.0000017980083000.00000004.00000800.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4484756612.0000017980064000.00000004.00000800.00020000.00000000.sdmp, O0I14144.exe, 00000000.00000002.4484756612.000001798034F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FE4880 cpuid

0_2_00007FF624FE4880

Source: C:\Users\user\Desktop\O0I14144.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF624FE2644
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: EnumSystemLocalesW,	0_2_00007FF624FDA54C
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: EnumSystemLocalesW,	0_2_00007FF624FE25AC
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: GetLocaleInfoW,	0_2_00007FF624FE2890
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: GetLocaleInfoW,	0_2_00007FF624FE2A98
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: try_get_function,GetLocaleInfoW,	0_2_00007FF624FDAACC
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF624FE2190
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF624FE29E8
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: EnumSystemLocalesW,	0_2_00007FF624FE24DC
Source: C:\Users\user\Desktop\O0I14144.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF624FE2BC4

Source: C:\Users\user\Desktop\O0I14144.exe

Code function: 0_2_00007FF624FCB320 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF624FCB320

Source: C:\Users\user\Desktop\O0I14144.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.O0I14144.exe.179f5a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR

Source: O0I14144.exe, 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: O0I14144.exe, 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: procexp.exe
Source: O0I14144.exe, 00000000.00000003.2348032885.00000179F677C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: O0I14144.exe, 00000000.00000002.4487276511.00000179F5A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\O0I14144.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4484756612.000001798030F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000000.00000002.4484756612.0000017980001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4484756612.000001798030F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: O0I14144.exe PID: 1196, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	2 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report O0I14144.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
O0I14144.exe