Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583461
MD5:	76969acc42256771162be6f285de947c
SHA1:	071c5791d9ca1c2382450c6ef09432e12e8b3ca2
SHA256:	155854758b79cdee58f7df5c1a4a07d3b19b3d64a0a58b2e8faf6d8b67042f3c
Tags:	NETexeMSILnjratuser-jstrosch
Infos:

Detection

DcRat, JasonRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DcRat

Yara detected JasonRAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an autostart registry key pointing to binary in C:\Windows

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4696 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 76969ACC42256771162BE6F285DE947C)

Mxscspd_BelphegorShell.exe (PID: 4084 cmdline: "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe" MD5: 412A8BBC3366FEC40120821A598EA26F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: JasonRAT

{"Server": "127.0.0.1,winner2025me.duckdns.org", "Ports": "7777", "Version": "JASON 2.1.1.0", "Autorun": "false", "Install_Folder": "AppData", "Install_File": "ScJlsrsfsks", "AES_key": "Jason\u2620LetThereBeCarnage", "Mutex": "Jason_CnzagnrahJcsdJcnzns", "AntiDetection": "null", "External_config_on_Pastebin": "false", "Startup_Delay": 1, "Certificate": "MIICRzCCAbCgAwIBAgIVANvS14Czjez/SMBBbB3uWUcyWLrFMA0GCSqGSIb3DQEBDQUAMHsxFTATBgNVBAMMDEphc29uIFNlcnZlcjEiMCAGA1UECwwZSmFzb27imKBMZXRUaGVyZUJlQ2FybmFnZTEkMCIGA1UECgwbSmFzb24g4pigIExldFRoZXJlQmVDYXJuYWdlMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwMTExMjMxNjM2WhcNMzQxMDIwMjMxNjM2WjAQMQ4wDAYDVQQDDAVKYXNvbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjynhKPrWMiHM2a9rMcQru2BGPNnbfYw5w+W/mUM/lDUQ5E5yx5wWth03JiB+yflQvUkZ/3sDm/4JQfZxiqclLIAzkXrlBxhKbaLxcxa5slQJUaypWXxwdTTu2U2bgqrOINQFGqA4qGXWVqVelz75q5QEn3PVsM9ItRcx49FsqgsCAwEAAaMyMDAwHQYDVR0OBBYEFEhI7v6kRtjV16ycOMQ1r14L2GjJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAFnxCg0+lHwa/Nkl7yer/lKO2aejOkcEGbtTxKgLGEpVClTuTTw4wQX8lc7gd0Ik5pL5VtO37O+Aj/Ysl71zgh3dd9gDKb9Uil7SP3WK2fbC/kETm++Pxi4vl4W3C6j1l9jtMOHmaNZem3Z+o+8bfkBbWtFDqp7Sul3yagpHaQzU=", "ServerSignature": "PjTTtyMY2go0IqkgPP0auxgXaWgJgSfBrFldD2kTofVnrfY4Q95vIUygNkOfDvXg9exvugXRXULtJ8VIYdVAUyOCtJjL5nFEhxkiFTV+c2RYqmHMIDydwtPnsh4BRMNcgibqvLlT2WK6OP/jVV1EV8GVrduZ74e6ok24M2khfR0=", "Group": "HOME"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Process Memory Space: file.exe PID: 4696	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39c3d90.1.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.3995570.2.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39c3d90.1.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39957c0.0.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.39957c0.0.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
0.2.file.exe.3995570.2.raw.unpack	JoeSecurity_JasonRAT	Yara detected JasonRAT	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 87.120.113.91, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, Initiated: true, ProcessId: 4084, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, ProcessId: 4084, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScJlsrsfsks

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:14:02.195868+0100	2842478	1	Malware Command and Control Activity Detected	87.120.113.91	7777	192.168.2.5	49704	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack

Malware Configuration Extractor: JasonRAT {"Server": "127.0.0.1,winner2025me.duckdns.org", "Ports": "7777", "Version": "JASON 2.1.1.0", "Autorun": "false", "Install_Folder": "AppData", "Install_File": "ScJlsrsfsks", "AES_key": "Jason\u2620LetThereBeCarnage", "Mutex": "Jason_CnzagnrahJcsdJcnzns", "AntiDetection": "null", "External_config_on_Pastebin": "false", "Startup_Delay": 1, "Certificate": "MIICRzCCAbCgAwIBAgIVANvS14Czjez/SMBBbB3uWUcyWLrFMA0GCSqGSIb3DQEBDQUAMHsxFTATBgNVBAMMDEphc29uIFNlcnZlcjEiMCAGA1UECwwZSmFzb27imKBMZXRUaGVyZUJlQ2FybmFnZTEkMCIGA1UECgwbSmFzb24g4pigIExldFRoZXJlQmVDYXJuYWdlMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwMTExMjMxNjM2WhcNMzQxMDIwMjMxNjM2WjAQMQ4wDAYDVQQDDAVKYXNvbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjynhKPrWMiHM2a9rMcQru2BGPNnbfYw5w+W/mUM/lDUQ5E5yx5wWth03JiB+yflQvUkZ/3sDm/4JQfZxiqclLIAzkXrlBxhKbaLxcxa5slQJUaypWXxwdTTu2U2bgqrOINQFGqA4qGXWVqVelz75q5QEn3PVsM9ItRcx49FsqgsCAwEAAaMyMDAwHQYDVR0OBBYEFEhI7v6kRtjV16ycOMQ1r14L2GjJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAFnxCg0+lHwa/Nkl7yer/lKO2aejOkcEGbtTxKgLGEpVClTuTTw4wQX8lc7gd0Ik5pL5VtO37O+Aj/Ysl71zgh3dd9gDKb9Uil7SP3WK2fbC/kETm++Pxi4vl4W3C6j1l9jtMOHmaNZem3Z+o+8bfkBbWtFDqp7Sul3yagpHaQzU=", "ServerSignature": "PjTTtyMY2go0IqkgPP0auxgXaWgJgSfBrFldD2kTofVnrfY4Q95vIUygNkOfDvXg9exvugXRXULtJ8VIYdVAUyOCtJjL5nFEhxkiFTV+c2RYqmHMIDydwtPnsh4BRMNcgibqvLlT2WK6OP/jVV1EV8GVrduZ74e6ok24M2khfR0=", "Group": "HOME"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: 7777
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: 127.0.0.1,winner2025me.duckdns.org
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: JASON 2.1.1.0
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: Jason_CnzagnrahJcsdJcnzns
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: MIICRzCCAbCgAwIBAgIVANvS14Czjez/SMBBbB3uWUcyWLrFMA0GCSqGSIb3DQEBDQUAMHsxFTATBgNVBAMMDEphc29uIFNlcnZlcjEiMCAGA1UECwwZSmFzb27imKBMZXRUaGVyZUJlQ2FybmFnZTEkMCIGA1UECgwbSmFzb24g4pigIExldFRoZXJlQmVDYXJuYWdlMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwMTExMjMxNjM2WhcNMzQxMDIwMjMxNjM2WjAQMQ4wDAYDVQQDDAVKYXNvbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAjynhKPrWMiHM2a9rMcQru2BGPNnbfYw5w+W/mUM/lDUQ5E5yx5wWth03JiB+yflQvUkZ/3sDm/4JQfZxiqclLIAzkXrlBxhKbaLxcxa5slQJUaypWXxwdTTu2U2bgqrOINQFGqA4qGXWVqVelz75q5QEn3PVsM9ItRcx49FsqgsCAwEAAaMyMDAwHQYDVR0OBBYEFEhI7v6kRtjV16ycOMQ1r14L2GjJMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAFnxCg0+lHwa/Nkl7yer/lKO2aejOkcEGbtTxKgLGEpVClTuTTw4wQX8lc7gd0Ik5pL5VtO37O+Aj/Ysl71zgh3dd9gDKb9Uil7SP3WK2fbC/kETm++Pxi4vl4W3C6j1l9jtMOHmaNZem3Z+o+8bfkBbWtFDqp7Sul3yagpHaQzU=
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: PjTTtyMY2go0IqkgPP0auxgXaWgJgSfBrFldD2kTofVnrfY4Q95vIUygNkOfDvXg9exvugXRXULtJ8VIYdVAUyOCtJjL5nFEhxkiFTV+c2RYqmHMIDydwtPnsh4BRMNcgibqvLlT2WK6OP/jVV1EV8GVrduZ74e6ok24M2khfR0=
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: null
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: HOME
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false
Source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack	String decryptor: false

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 87.120.113.91:7777 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: winner2025me.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: winner2025me.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 87.120.113.91:7777

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: winner2025me.duckdns.org

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291327110.000000001D935000.00000004.00000020.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3291032924.000000001D830000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3288869079.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en89k
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003D71000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

System Summary

.NET source code contains very large array initializations

Source: Mxscspd_BelphegorShell.exe.0.dr, Program.cs

Large array initialization: Main: array initializer size 180224

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F561C6	1_2_00007FF848F561C6
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F59368	1_2_00007FF848F59368
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F4FBF0	1_2_00007FF848F4FBF0
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F40D05	1_2_00007FF848F40D05
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F415D1	1_2_00007FF848F415D1
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F510A5	1_2_00007FF848F510A5
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F56F72	1_2_00007FF848F56F72
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F41A5E	1_2_00007FF848F41A5E

Source: Mxscspd_BelphegorShell.exe.0.dr

Static PE information: No import functions for PE file found

Source: file.exe, 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAbezethibou64.exe" vs file.exe
Source: file.exe, 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMxscspd_BelphegorShell.exe4 vs file.exe
Source: file.exe, 00000000.00000002.2044783649.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2039897335.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewrapper_jre_offline.exeP vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamewrapper_jre_offline.exeP vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/4@4/2

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Jason_CnzagnrahJcsdJcnzns

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Section loaded: msdmo.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Mxscspd_BelphegorShell.exe.0.dr, Program.cs

.Net Code: LoadAndExecuteAssemblyInMemory System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E9004B push edx; retf	0_2_04E90072
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E9002C push ebx; retf	0_2_04E9004A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E901A4 push ebx; retf	0_2_04E901BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04E9026B push 3C00CB50h; retf	0_2_04E90292
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Code function: 1_2_00007FF848F4755E push ds; iretd	1_2_00007FF848F4755F

Source: file.exe

Static PE information: section name: .text entropy: 7.7525499842123144

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Jump to dropped file

Boot Survival

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ScJlsrsfsks

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ScJlsrsfsks			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ScJlsrsfsks			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Memory allocated: 1290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Memory allocated: 1BD70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Window / User API: threadDelayed 1606			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Window / User API: threadDelayed 8229			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6640	Thread sleep count: 1606 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6568	Thread sleep count: 8229 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe TID: 6752	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291579026.000000001DA02000.00000004.00000020.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3288869079.0000000001353000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe "C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"

Jump to behavior

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF7000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DEA000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291381905.000000001D953000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managern
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF7000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DEA000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected JasonRAT

Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.Mxscspd_BelphegorShell.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Mxscspd_BelphegorShell.exe.12b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39c3d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.39957c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3995570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, type: DROPPED

Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291327110.000000001D935000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpeng.exe
Source: Mxscspd_BelphegorShell.exe, 00000001.00000002.3291579026.000000001DA02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: Mxscspd_BelphegorShell.exe PID: 4084, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Exploit.Generic
file.exe	100%	Avira	HEUR/AGEN.1307423
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label	Link
winner2025me.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
winner2025me.duckdns.org	87.120.113.91	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
winner2025me.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003D71000.00000004.00000800.00020000.00000000.sdmp, Mxscspd_BelphegorShell.exe, 00000001.00000002.3289268084.0000000003E62000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
87.120.113.91	winner2025me.duckdns.org	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583461
Start date and time:	2025-01-02 20:13:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/4@4/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 94% Number of executed functions: 45 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 4696 because it is empty
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:14:01	API Interceptor	1x Sleep call for process: Mxscspd_BelphegorShell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.113.91	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91/image.exe
87.120.113.91	LPO-0048532025.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91/image.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172
	Hornswoggle.exe	Get hash	malicious	GuLoader	Browse	199.232.214.172
	8n26gvrXUM.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	199.232.210.172
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse	199.232.214.172
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	87.120.115.216
	rebirth.arm4t.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.spc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.sh4.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.x86.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.ppc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm6.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.m68.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63

Process:	C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.253995428229512
Encrypted:	false
SSDEEP:	6:kKz9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:iDImsLNkPlE99SNxAhUe/3
MD5:	1AA3272D53B554F8EB4E3186C994B69D
SHA1:	B361BB9EAC9B65949B50F176E97FF1461EB480A9
SHA-256:	9008EA54347D7A5DB2E0E113F9F33A34035A0CF7D954D50E03C5BA4496E0CE22
SHA-512:	964D5E2222E2DA9734D61F0BEB31DABB9E40D84AAAF5F86A8D25191068E446741539408F18D5F9763A012F28A1F30A0EF607663AB2E3B01A0595C12A42976B18
Malicious:	false
Reputation:	low
Preview:	p...... ..........y{J]..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	5.655415027243687
Encrypted:	false
SSDEEP:	3072:vXpgDh/4L28y4UBQ9bwD9wb651a0UlDRvznBf+gk:Vry4UBQ9bX651aXxR+
MD5:	412A8BBC3366FEC40120821A598EA26F
SHA1:	171CC5CF93880517BA70B59C3A26FC9B249BC02D
SHA-256:	D918B089C7CCE51352C6BCB6C3851FBF420884221BB30254179C55C42929F466
SHA-512:	2890B21770E6C8FD432AEC2193462C19229AD9AE9E2E873784720FB40A46FFD927B58258D76D4FA38B3825A76CD2DD24F2179730783AC3FE6DA24BCBEAAF8047
Malicious:	true
Yara Hits:	Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...hdng.........."...................... .....@..... ....................... ............@...@......@............... ............................................................................................................................... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..BH...............................................................................MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...v.o..........."...0.................. .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text...4.... ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.638702692097853
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	286'720 bytes
MD5:	76969acc42256771162be6f285de947c
SHA1:	071c5791d9ca1c2382450c6ef09432e12e8b3ca2
SHA256:	155854758b79cdee58f7df5c1a4a07d3b19b3d64a0a58b2e8faf6d8b67042f3c
SHA512:	c6a687236323e2ea70c89f3ad38a80d8be179ebf281ff2b5b39db9f9a3ecab67eb9ec8237df82464566d0c7fa952e5d9dfa171b61a7f1b3abeb4897f54769f52
SSDEEP:	6144:U5nFOwQLKFIkwMs+OZBH/5kA5wJEGrNTxhd:UJFOZKFIk2ZBf5kA+JE6h
TLSH:	7154E07EF245AE91C65D8A7384D7E83613B5DCAE8593E34E30E8353105B33EA0046E9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g.vg................................. ........@.. ....................................@................................

File Icon


Icon Hash:	d08c8e8ea2868a54

Static PE Info

General

Entrypoint:	0x43fc8b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67760267 [Thu Jan 2 03:05:11 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fc41	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x7d18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3dc91	0x3de00	be00ba236e84578e223b1173c30b8f09	False	0.7859296085858586	data	7.7525499842123144	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0x7d18	0x7e00	918509519b072686227a93f0492951a9	False	0.34759424603174605	data	5.884923281729306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	7fbb61b20dd594194e8c38485aabe777	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x400c4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.21890243902439024
RT_ICON	0x40750	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.3400537634408602
RT_ICON	0x40a5c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	English	United States	0.35450819672131145
RT_ICON	0x40c68	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.46283783783783783
RT_ICON	0x40db4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.5026652452025586
RT_ICON	0x41c80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.5798736462093863
RT_ICON	0x4254c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	English	United States	0.40264976958525345
RT_ICON	0x42c38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.3273121387283237
RT_ICON	0x431c4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.27344398340248965
RT_ICON	0x45790	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.37875234521575984
RT_ICON	0x4685c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.37868852459016394
RT_ICON	0x47208	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4796099290780142
RT_GROUP_ICON	0x476ac	0xae	data	English	United States	0.5977011494252874
RT_VERSION	0x47796	0x35c	data	English	United States	0.4755813953488372
RT_MANIFEST	0x47b2e	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:14:02.195868+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	87.120.113.91	7777	192.168.2.5	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:14:01.379029036 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:01.383846045 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:01.383945942 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:01.400010109 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:01.404804945 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.185301065 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.191057920 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:02.195868015 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.367734909 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:02.419197083 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:03.551254034 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:03.556164980 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:03.556217909 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:03.560991049 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:14.959703922 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:14.964713097 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:14.964814901 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:14.969571114 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:15.263408899 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:15.309828043 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:15.394859076 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:15.434983969 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.358086109 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.362925053 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.363883972 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.368664980 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.675950050 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.716252089 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:26.799747944 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:26.841099024 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:37.763591051 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:37.768320084 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:37.768379927 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:37.773216963 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:38.096590042 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:38.153585911 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:38.221914053 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:38.262952089 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.169670105 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.174635887 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.174743891 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.179577112 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.479302883 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.528523922 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:14:49.612181902 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:14:49.669166088 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:00.575818062 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:00.580912113 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:00.581012011 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:00.585863113 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:00.900336027 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:00.950438023 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:01.034948111 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:01.075571060 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:11.997792959 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:12.002756119 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.002859116 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:12.007597923 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.309508085 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.356694937 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:12.441042900 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:12.497256041 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.388670921 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.393526077 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.393623114 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.398469925 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.708152056 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.762868881 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:23.831518888 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:23.872361898 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:34.794539928 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:34.799428940 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:34.799490929 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:34.804239035 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:35.106250048 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:35.153528929 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:35.238431931 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:35.294157982 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.241620064 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.246479988 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.246546984 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.251359940 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.540797949 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.590958118 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:46.661737919 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:46.716011047 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:57.653762102 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:57.658647060 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:57.658714056 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:57.663446903 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:57.967681885 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:58.012890100 CET	49704	7777	192.168.2.5	87.120.113.91
Jan 2, 2025 20:15:58.098320961 CET	7777	49704	87.120.113.91	192.168.2.5
Jan 2, 2025 20:15:58.153625011 CET	49704	7777	192.168.2.5	87.120.113.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:13:57.254897118 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:13:58.247528076 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:13:59.263191938 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:14:01.263308048 CET	56738	53	192.168.2.5	1.1.1.1
Jan 2, 2025 20:14:01.373661041 CET	53	56738	1.1.1.1	192.168.2.5
Jan 2, 2025 20:14:01.373677969 CET	53	56738	1.1.1.1	192.168.2.5
Jan 2, 2025 20:14:01.373686075 CET	53	56738	1.1.1.1	192.168.2.5
Jan 2, 2025 20:14:01.373693943 CET	53	56738	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 2, 2025 20:13:55.197978020 CET	192.168.2.5	8.8.8.8	4d5a		Echo
Jan 2, 2025 20:13:55.204114914 CET	8.8.8.8	192.168.2.5	555a		Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:13:57.254897118 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:13:58.247528076 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:13:59.263191938 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.263308048 CET	192.168.2.5	1.1.1.1	0xb1a5	Standard query (0)	winner2025me.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:14:01.373661041 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.373677969 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.373686075 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:01.373693943 CET	1.1.1.1	192.168.2.5	0xb1a5	No error (0)	winner2025me.duckdns.org	87.120.113.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:02.459532022 CET	1.1.1.1	192.168.2.5	0x9af0	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:14:02.459532022 CET	1.1.1.1	192.168.2.5	0x9af0	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:13:51
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6a0000
File size:	286'720 bytes
MD5 hash:	76969ACC42256771162BE6F285DE947C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000000.00000002.2046836359.0000000003995000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:13:51
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe"
Imagebase:	0xa10000
File size:	190'464 bytes
MD5 hash:	412A8BBC3366FEC40120821A598EA26F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000001.00000000.2043885584.0000000000A12000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000001.00000002.3288838962.00000000012B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: 00000001.00000002.3290754458.0000000013D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_JasonRAT, Description: Yara detected JasonRAT, Source: C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: JasonRAT

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Mxscspd_BelphegorShell.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe