Edit tour

Windows Analysis Report
UxaZyTE7nq.exe

Overview

General Information

Sample Name:	UxaZyTE7nq.exe
Original Sample Name:	91a442b21fb353b221ea33e767c7fe1b.exe
Analysis ID:	816262
MD5:	91a442b21fb353b221ea33e767c7fe1b
SHA1:	e58e0d08ebdc5e91f43631b339c573a732c07056
SHA256:	35330f1bbbc0f361845b9b987e2f4ac70cdb96ab3f9e80161c2b8971c7df0df4
Tags:	exe
Infos:

Detection

AsyncRAT, DcRat, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected DcRat

Yara detected VenomRAT

Yara detected AsyncRAT

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sample is not signed and drops a device driver

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Contains functionality to load drivers

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Enables driver privileges

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates driver files

Binary contains a suspicious time stamp

Spawns drivers

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates or modifies windows services

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

UxaZyTE7nq.exe (PID: 5248 cmdline: C:\Users\user\Desktop\UxaZyTE7nq.exe MD5: 91A442B21FB353B221EA33E767C7FE1B)

MSBuild.exe (PID: 3164 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe MD5: 8B9E68304AF4B81C9AB70CB2220EBA74)

aspnet_regsql.exe (PID: 4860 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe MD5: F31014EE4DE7FE48E9B7C9BE94CFB45F)

AddInProcess.exe (PID: 1792 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe MD5: 11D8A500C4C0FBAF20EBDB8CDF6EA452)

EdmGen.exe (PID: 4856 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe MD5: 2B6A31DFD7C9ED8B413DBDAB800F10F3)

RegAsm.exe (PID: 4916 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe MD5: 2B5D765B33C67EBA41E9F47954227BC3)

Microsoft.Workflow.Compiler.exe (PID: 3232 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe MD5: D91462AE31562E241AF5595BA5E1A3C4)

SMSvcHost.exe (PID: 5564 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe MD5: 7EC8B56348F9298BCCA7A745C7F70E2C)

ngen.exe (PID: 1368 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe MD5: FBA5E8D94C9EADC279BC06B9CF041A9A)

aspnet_regbrowsers.exe (PID: 784 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe MD5: BF7E443F1E1FA88AD5A2A5EB44F42834)

AddInUtil.exe (PID: 4504 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe MD5: 65D30D747EB31E108A36EBC966C1227D)

mscorsvw.exe (PID: 4840 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe MD5: B00E9325AC7356A3F4864EAAAD48E13F)

cvtres.exe (PID: 3440 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)

ServiceModelReg.exe (PID: 5388 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe MD5: 80B018258257C2F78CBFE08198883AC1)

jsc.exe (PID: 4532 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe MD5: 2B40A449D6034F41771A460DADD53A60)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "127.0.0.1,91.134.187.20", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber  v6.0.1", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "fLhIsNqVZyP3FtIfE3paid39lvLLS0GF", "Mutex": "mhtuxtjimxsu", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "kFvNmgZ/O5v1sx/qrRRjCJ65ULSYW0YUs6D8HUtcZiIPmdxxX1FnuqnG7Hqf58PvDX3GI/brbGZ53PRUq5Q2RpiVxj+vfAPMR0vYli5u3fC8P3PEfV6q8ByxVzA/JPq19BNQyRc/ggnXxDaQb3mMnaO7P9LiftEDaJle8Xfr3Kk=", "BDOS": "null", "External_config_on_Pastebin": "false"}

Threatname: VenomRAT

{"Server": "127.0.0.1,91.134.187.20", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber  v6.0.1", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "fLhIsNqVZyP3FtIfE3paid39lvLLS0GF", "Mutex": "mhtuxtjimxsu", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "kFvNmgZ/O5v1sx/qrRRjCJ65ULSYW0YUs6D8HUtcZiIPmdxxX1FnuqnG7Hqf58PvDX3GI/brbGZ53PRUq5Q2RpiVxj+vfAPMR0vYli5u3fC8P3PEfV6q8ByxVzA/JPq19BNQyRc/ggnXxDaQb3mMnaO7P9LiftEDaJle8Xfr3Kk=", "BDOS": "null"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.512134947.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000E.00000002.513654530.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: UxaZyTE7nq.exe PID: 5248	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: UxaZyTE7nq.exe PID: 5248	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: UxaZyTE7nq.exe PID: 5248	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: jsc.exe PID: 4532	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x9d0d:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x9d3c:$e2: Add-MpPreference -ExclusionPath
0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x9cdd:$r1: Classes\Folder\shell\open\command 0x912c:$k1: DelegateExecute
0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xda88:$q1: Select * from Win32_CacheMemory 0xdac8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xdb16:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xdb64:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xda88:$q1: Select * from Win32_CacheMemory 0xdac8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xdb16:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xdb64:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
14.2.jsc.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
14.2.jsc.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xf888:$q1: Select * from Win32_CacheMemory 0xf8c8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xf916:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xf964:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xf888:$q1: Select * from Win32_CacheMemory 0x85560:$q1: Select * from Win32_CacheMemory 0xf8c8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x855a0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xf916:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x855ee:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xf964:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x8563c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0xf888:$q1: Select * from Win32_CacheMemory 0x220b0:$q1: Select * from Win32_CacheMemory 0x97d88:$q1: Select * from Win32_CacheMemory 0xf8c8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x220f0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x97dc8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0xf916:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x2213e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x97e16:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0xf964:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x2218c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x97e64:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
Click to see the 8 entries

Snort Signatures

ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) - Source IP: 91.134.187.20 - Destination IP: 192.168.2.6

Timestamp:	91.134.187.20192.168.2.64449497182850454 02/27/23-19:11:47.671813
SID:	2850454
Source Port:	4449
Destination Port:	49718
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: UxaZyTE7nq.exe	ReversingLabs: Detection: 20%
Source: UxaZyTE7nq.exe	Virustotal: Detection: 22%			Perma Link

Machine Learning detection for sample

Source: UxaZyTE7nq.exe

Joe Sandbox ML: detected

Source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1,91.134.187.20", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.1", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "fLhIsNqVZyP3FtIfE3paid39lvLLS0GF", "Mutex": "mhtuxtjimxsu", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "kFvNmgZ/O5v1sx/qrRRjCJ65ULSYW0YUs6D8HUtcZiIPmdxxX1FnuqnG7Hqf58PvDX3GI/brbGZ53PRUq5Q2RpiVxj+vfAPMR0vYli5u3fC8P3PEfV6q8ByxVzA/JPq19BNQyRc/ggnXxDaQb3mMnaO7P9LiftEDaJle8Xfr3Kk=", "BDOS": "null", "External_config_on_Pastebin": "false"}
Source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack	Malware Configuration Extractor: VenomRAT {"Server": "127.0.0.1,91.134.187.20", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.1", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "fLhIsNqVZyP3FtIfE3paid39lvLLS0GF", "Mutex": "mhtuxtjimxsu", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "kFvNmgZ/O5v1sx/qrRRjCJ65ULSYW0YUs6D8HUtcZiIPmdxxX1FnuqnG7Hqf58PvDX3GI/brbGZ53PRUq5Q2RpiVxj+vfAPMR0vYli5u3fC8P3PEfV6q8ByxVzA/JPq19BNQyRc/ggnXxDaQb3mMnaO7P9LiftEDaJle8Xfr3Kk=", "BDOS": "null"}

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UxaZyTE7nq.exe PID: 5248, type: MEMORYSTR

Source: UxaZyTE7nq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Bir_Mateb\source\repos\27 Feb 2023\FormElements-master\obj\Debug\FormElements.pdb source: UxaZyTE7nq.exe
Source:	Binary string: C:\agent\1\s\sys\x64\Release\ProcExpDriver.pdb source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp, UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp, ?????.sys.0.dr

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2850454 ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) 91.134.187.20:4449 -> 192.168.2.6:49718

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: global traffic

TCP traffic: 192.168.2.6:49718 -> 91.134.187.20:4449

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown	TCP traffic detected without corresponding DNS query: 40.90.65.8
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 8.241.126.249
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 8.241.126.249
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.5
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.70
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.134.187.20

Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000E.00000002.513654530.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000E.00000002.513654530.000000000302F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp, UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp, ?????.sys.0.dr	String found in binary or memory: https://www.sysinternals.com0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected VenomRAT

Source: Yara match

File source: Process Memory Space: jsc.exe PID: 4532, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.512134947.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UxaZyTE7nq.exe PID: 5248, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 14.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen

Source: 0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.UxaZyTE7nq.exe.1dc9347bb50.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 14.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA44924AD	0_2_00007FFCA44924AD
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA4494308	0_2_00007FFCA4494308
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA4494300	0_2_00007FFCA4494300
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA44A5BC9	0_2_00007FFCA44A5BC9
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA449BC59	0_2_00007FFCA449BC59
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA4496858	0_2_00007FFCA4496858
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA4499010	0_2_00007FFCA4499010
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_0150DB08	14_2_0150DB08
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_01501EF0	14_2_01501EF0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_01502668	14_2_01502668
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_0150D9B0	14_2_0150D9B0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_01501EE2	14_2_01501EE2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_0586E328	14_2_0586E328
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_0586EBF8	14_2_0586EBF8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_05866E00	14_2_05866E00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_0586DFE0	14_2_0586DFE0

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA44A9254 NtLoadDriver,	0_2_00007FFCA44A9254
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA44902F8 NtResumeThread,	0_2_00007FFCA44902F8
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA44902E8 NtResumeThread,	0_2_00007FFCA44902E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_01502AC0 NtProtectVirtualMemory,	14_2_01502AC0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_01502668 NtProtectVirtualMemory,	14_2_01502668

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Code function: 0_2_00007FFCA44A9254 NtLoadDriver,

0_2_00007FFCA44A9254

Source: UxaZyTE7nq.exe

Static PE information: No import functions for PE file found

Source: UxaZyTE7nq.exe, 00000000.00000002.266309550.000001DC92F80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRunpeX.Stub.Framework.exeL vs UxaZyTE7nq.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.266090632.000001DC916DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UxaZyTE7nq.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprocexp.SysB vs UxaZyTE7nq.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientAny.exe" vs UxaZyTE7nq.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.271051377.000001DCA3077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRunpeX.Stub.Framework.exeL vs UxaZyTE7nq.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprocexp.SysB vs UxaZyTE7nq.exe

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

File created: C:\Users\user\AppData\Local\Temp\?????.sys

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Driver loaded: \Registry\Machine\System\CurrentControlSet\Services\TaskKill

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\?????.sys 440883CD9D6A76DB5E53517D0EC7FE13D5A50D2F6A7F91ECFC863BC3490E4F5C

Source: UxaZyTE7nq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UxaZyTE7nq.exe	ReversingLabs: Detection: 20%
Source: UxaZyTE7nq.exe	Virustotal: Detection: 22%

Source: UxaZyTE7nq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UxaZyTE7nq.exe C:\Users\user\Desktop\UxaZyTE7nq.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Code function: 0_2_00007FFCA44A8655 AdjustTokenPrivileges,

0_2_00007FFCA44A8655

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UxaZyTE7nq.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

File created: C:\Users\user\AppData\Local\Temp\?????.sys

Jump to behavior

Source: ?????.sys.0.dr

Binary string: \DosDevices\PROCEXP152\ObjectTypes\\Device\PROCEXP152PsAcquireProcessExitSynchronizationPsReleaseProcessExitSynchronizationMmGetMaximumNonPagedPoolInBytesObGetObjectTypeMutantIoCreateDeviceSecureIoValidateDeviceIoControlAccessD:P

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@29/5@0/2

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Mutant created: \Sessions\1\BaseNamedObjects\mhtuxtjimxsu

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: UxaZyTE7nq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UxaZyTE7nq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: UxaZyTE7nq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Bir_Mateb\source\repos\27 Feb 2023\FormElements-master\obj\Debug\FormElements.pdb source: UxaZyTE7nq.exe
Source:	Binary string: C:\agent\1\s\sys\x64\Release\ProcExpDriver.pdb source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp, UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp, ?????.sys.0.dr

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA44A5BC9 push ebx; ret	0_2_00007FFCA44A61DA
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA449EE19 push AFE80939h; ret	0_2_00007FFCA449EE1E
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA449EE2E pushfd ; ret	0_2_00007FFCA449EE31
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Code function: 0_2_00007FFCA449CB9C push esi; iretd	0_2_00007FFCA449CBD4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_01501C5A push ebx; iretd	14_2_01501C7A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Code function: 14_2_05862491 push edi; iretd	14_2_05862492

Source: UxaZyTE7nq.exe

Static PE information: real checksum: 0x5c1b0 should be: 0x60c13

Source: UxaZyTE7nq.exe

Static PE information: 0xDF4149F2 [Thu Sep 9 19:52:18 2088 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.981513997954339

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

File created: C:\Users\user\AppData\Local\Temp\?????.sys

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

File created: C:\Users\user\AppData\Local\Temp\?????.sys

Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match

File source: Process Memory Space: jsc.exe PID: 4532, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.512134947.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UxaZyTE7nq.exe PID: 5248, type: MEMORYSTR

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TaskKill

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: UxaZyTE7nq.exe PID: 5248, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match

File source: Process Memory Space: jsc.exe PID: 4532, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.512134947.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UxaZyTE7nq.exe PID: 5248, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe TID: 5216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe TID: 2608	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe TID: 5172	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe TID: 5172	Thread sleep count: 110 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe TID: 5216	Thread sleep count: 9781 > 30	Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\?????.sys

Jump to dropped file

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

Window / User API: threadDelayed 9781

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe base: 414000	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe base: 416000	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe base: D9D008	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe	Jump to behavior
Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Jump to behavior

Source: jsc.exe, 0000000E.00000002.513654530.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000E.00000002.513654530.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000E.00000002.513654530.00000000030B0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe	Queries volume information: C:\Users\user\Desktop\UxaZyTE7nq.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UxaZyTE7nq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match

File source: Process Memory Space: jsc.exe PID: 4532, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931dd380.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UxaZyTE7nq.exe.1dc931cab58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.512134947.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UxaZyTE7nq.exe PID: 5248, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match

File source: 0000000E.00000002.513654530.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected DcRat

Source: Yara match

File source: 0000000E.00000002.513654530.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	131 Windows Management Instrumentation	2 Windows Service	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	241 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	2 Windows Service	1 Disable or Modify Tools	LSASS Memory	12 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	2 LSASS Driver	212 Process Injection	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	2 Scheduled Task/Job	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	2 LSASS Driver	212 Process Injection	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	22 Obfuscated Files or Information	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UxaZyTE7nq.exe	21%	ReversingLabs	Win64.Trojan.Generic
UxaZyTE7nq.exe	23%	Virustotal		Browse
UxaZyTE7nq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\?????.sys	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\?????.sys	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
14.2.jsc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1202836		Download File

Domains

Source	Detection	Scanner	Label	Link
l-0007.l-dc-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.sysinternals.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
l-0007.l-dc-msedge.net	13.107.43.16	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000E.00000002.513654530.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000E.00000002.513654530.000000000302F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.sysinternals.com0	UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC93093000.00000004.00000800.00020000.00000000.sdmp, UxaZyTE7nq.exe, 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp, ?????.sys.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.134.187.20	unknown	France		16276	OVHFR	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	816262
Start date and time:	2023-02-27 19:10:25 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	UxaZyTE7nq.exe
Original Sample Name:	91a442b21fb353b221ea33e767c7fe1b.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@29/5@0/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.6% (good quality ratio 0.3%) Quality average: 30.2% Quality standard deviation: 41.2%
HCA Information:	Successful, ratio: 96% Number of executed functions: 33 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, HxTsr.exe, RuntimeBroker.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.35.236.109, 173.222.108.210, 173.222.108.226, 20.90.152.133, 184.28.57.26, 40.126.32.74, 20.190.160.22, 40.126.32.133, 20.190.160.20, 40.126.32.140, 40.126.32.68, 20.190.160.14, 40.126.32.136, 23.0.174.120, 23.0.174.122, 23.0.174.136, 23.0.174.121, 23.0.174.130, 23.0.174.123, 23.0.174.137, 23.0.174.129, 23.0.174.138, 13.107.5.88, 20.90.153.243, 20.90.156.32
Excluded domains from analysis (whitelisted): client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, e-0009.e-msedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, cdn.onenote.net.edgekey.net, wns.notify.trafficmanager.net, prda.aadg.msidentity.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, cdn.onenote.net, config.edge.skype.com, www.bing.com, client.wns.windows.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, ctldl.windowsupdate.com, www.tm.a.prd.aadg.akadns.net, wu-bg-shim.trafficmanager.net, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, l-0007.config.skype.com, e1553.dspg.akamaiedge.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:11:48	API Interceptor	2x Sleep call for process: jsc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
l-0007.l-dc-msedge.net	modest-menu.exe	Get hash	malicious	Unknown	Browse	13.107.43.16
	Pepsico LLC RFQ Information.com.exe	Get hash	malicious	GuLoader	Browse	13.107.43.16
	file.exe	Get hash	malicious	Nymaim	Browse	13.107.43.16
	file.exe	Get hash	malicious	RedLine	Browse	13.107.43.16
	8dlWtwg48G.exe	Get hash	malicious	Fabookie	Browse	13.107.43.16
	DHL AWB.js	Get hash	malicious	GuLoader	Browse	13.107.43.16
	https://madalonlaw-my.sharepoint.com:443/:b:/p/sdavalos/ES7WLbIY1jNMq6AlFu50i38B95khnUlQKvgFTYOg8VA76w?e=4%3aPZONAY&at=9	Get hash	malicious	Unknown	Browse	13.107.43.16
	https://document1.box.com/s/akq1m6wb78qbuhj7r4op5uogtknw8ssr	Get hash	malicious	Unknown	Browse	13.107.43.16
	202105-USD122986.exe	Get hash	malicious	AgentTesla	Browse	13.107.43.16
	https://hyclogisticscom-my.sharepoint.com/:x:/g/personal/shlomo_hyclogistics_com/ERTxS7bQd2xLmRxdNmUFmmoBRA2FOG_umzjSHIRFNUWUlQ?e=wodANM	Get hash	malicious	Unknown	Browse	13.107.43.16
	Revised Purchase Order.exe	Get hash	malicious	Remcos	Browse	13.107.43.16
	SecureMessageAtt.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.43.16
	2nd-payload.bin.dll	Get hash	malicious	Ursnif	Browse	13.107.43.16
	6m6k3k1OtZ.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.43.16
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	13.107.43.16
	R-Studio.v9.1.191039.exe	Get hash	malicious	Unknown	Browse	13.107.43.16
	04YVmZ1211.exe	Get hash	malicious	Unknown	Browse	13.107.43.16
	MicrosoftEdgeWebview2Setup.exe	Get hash	malicious	Unknown	Browse	13.107.43.16
	Ih5Ndh.dll	Get hash	malicious	Ursnif	Browse	13.107.43.16
	990702.xls	Get hash	malicious	Unknown	Browse	13.107.43.16

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	file.exe	Get hash	malicious	RedLine	Browse	51.89.204.181
	https://greenindiaenvironmentalconsultant.in/feedback.html	Get hash	malicious	HTMLPhisher	Browse	51.210.113.204
	file.exe	Get hash	malicious	RedLine	Browse	51.89.204.181
	zDmQ9SLGOr.elf	Get hash	malicious	Unknown	Browse	8.33.144.231
	UnJXSGaaEh.JS.js	Get hash	malicious	AsyncRAT	Browse	51.77.78.35
	SecuriteInfo.com.Win64.Trojan.Agent.2G5ELT.4490.2041.exe	Get hash	malicious	Xmrig, ccminer	Browse	149.56.27.47
	tamj1tEuQe.elf	Get hash	malicious	Mirai	Browse	192.99.130.92
	SecuriteInfo.com.Win64.Trojan-gen.23581.31557.exe	Get hash	malicious	Xmrig	Browse	51.68.190.80
	SecuriteInfo.com.Win64.Evo-gen.30580.11620.exe	Get hash	malicious	Xmrig	Browse	51.68.190.80
	file.exe	Get hash	malicious	RedLine	Browse	51.89.204.181
	RmL5OwrOSzxkHdO.exe	Get hash	malicious	AgentTesla	Browse	198.50.154.90
	https://www.todayville.com/meeting-the-threshold-justins-tantrum-gets-justice-rouleaus-approval	Get hash	malicious	Unknown	Browse	54.38.64.100
	loader.exe	Get hash	malicious	Unknown	Browse	51.79.119.231
	file.exe	Get hash	malicious	RedLine	Browse	51.89.204.181
	9LuXRgeRSv.exe	Get hash	malicious	Laplas Clipper	Browse	51.195.166.203
	https://killianferrer.com/zn/b/prod.php?cm9ib2NvcA=mod	Get hash	malicious	HTMLPhisher	Browse	188.165.53.185
	B8WzvBHEts.exe	Get hash	malicious	Xmrig	Browse	51.68.190.80
	file.exe	Get hash	malicious	Xmrig, zgRAT	Browse	198.50.243.185
	sample.cmd	Get hash	malicious	Unknown	Browse	51.79.163.195
	sample.cmd	Get hash	malicious	Unknown	Browse	51.79.163.195

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\?????.sys	ENQUIRY - TAIPEI DISCHARGE EQUIPMENT.PDF.exe	Get hash	malicious	Vector Stealer	Browse
	8UwYWNRGdr.exe	Get hash	malicious	AsyncRAT, DcRat, VenomRAT	Browse
	5nEPpS2Hhg.exe	Get hash	malicious	AgentTesla	Browse
	Excel_xls.exe	Get hash	malicious	XWorm	Browse
	proforma Invoice Sheet.exe	Get hash	malicious	AgentTesla	Browse
	PO 347282-1.exe	Get hash	malicious	AsyncRAT	Browse
	ORPO-INVOCE.exe	Get hash	malicious	AgentTesla	Browse
	ORPO-INVOCE0987.jar	Get hash	malicious	AgentTesla	Browse
	SKH076434567-09876543476.jar	Get hash	malicious	Snake Keylogger	Browse
	ORIGINAL_BL_INVOICE_PL_.exe	Get hash	malicious	Vector Stealer	Browse
	OnionBrowserV27.321.4212-exe-only.zip	Get hash	malicious	RedLine	Browse
	npp.28.442421Installer.x64-exe-only.zip	Get hash	malicious	RedLine	Browse
	rufus-28.412.213-exe-only.zip	Get hash	malicious	RedLine	Browse
	npp.27.31.21.x64.exe	Get hash	malicious	RedLine	Browse
	32WRxzwd03.exe	Get hash	malicious	lgoogLoader	Browse
	YFBSe9827J.exe	Get hash	malicious	lgoogLoader	Browse
	file.exe	Get hash	malicious	lgoogLoader	Browse
	file.exe	Get hash	malicious	lgoogLoader	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.381.20116.exe	Get hash	malicious	Snake Keylogger	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62932 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	62932
Entropy (8bit):	7.9958071285043335
Encrypted:	true
SSDEEP:	1536:pvl2gmukMiArbge/oKIxf+Q9yNJLaRCfIElhUuDz:pvl2gmZhpehIxfJsJLawfIElhUu3
MD5:	FC4666CBCA561E864E7FDF883A9E6661
SHA1:	2F8D6094C7A34BF12EA0BBF0D51EE9C5BB7939A5
SHA-256:	10F3DEB6C452D749A7451B5D065F4C0449737E5EE8A44F4D15844B503141E65B
SHA-512:	C71F54B571E01F247F072BE4BBEBDF5D8410B67EB79A61E7E0D9853FE857AB9BD12F53E6AF3394B935560178107291FC4BE351B27DEB388EBA90BA949633D57D
Malicious:	false
Preview:	MSCF............,...................I.................oU.s .authroot.stl......5..CK..8U[...q.yL;sf!d.D..."2."C...2....RRRHnT...\...!2.)QQ2..nN.\7.....lgYk;.^.....}..h4.....Kc.cG.q.tY..Drg<..G.D....c.qnx..G.......r.8.....w...;.Q6..o.xf:f..:NL[.`..]I.@ ,W..J..Qf.z9.<.../.D.p:0R...#..I,.%.+."...B.n)...[Y=.,0...R.#..G5..2..]........$p..3.M.O...._L.......g.....?=.J..!...G~.#.J:.Wj.........9(:..g.8,.o.b...3..C..t.7L=..+~%pc...%..b(.q.......F.'...@~P .6CA.(d.Z~..6....=.).9......A........p...Gy....7U.L....S...^.R.T.p...R..:.hr./..8...a&p.l(....g.3a)...[.M..v.......g,.U..l.F..._kJv.4.rG.{.K.6.X.rz.8.r..&..G.j..p".z...L...EUX.......;...Y.................j}..FrT.,J3.d?T.T}Q..hn.?.4F...~K...........'...c...X,.v..yk..0._.j\|.(.q4k1....^b..6...z..\9'}.%....S.[..D.k....J.../D$.#..O.o~%S.9u....\|61.........~....Q+.w.e....7}..:.....^.p.mKm._9v......'.3T..bY3..9a..p.'1..Lx.O.g..J5w+.r..K.R.P.....E0bf*r...c..;...`.j...i.;y.C..#\|L.e.(.....w.X'...z../.-...c.......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1615723839320826
Encrypted:	false
SSDEEP:	6:kKM0qz7ksN+SkQlPlEGYRMY9z+4KlDA3RUe+OGNglcy:k+kPlE99SNxAhUefblcy
MD5:	C878E1166FCB2708482602C39E162BBA
SHA1:	884E515CBE4BFA12F511D978A6D785CAD4CAFA82
SHA-256:	FF266CFA40017CF79B191B137229C3724982F9DA2F3D442F70693FFBE033A084
SHA-512:	6728CE5910D39EC81CE2F83718343C779CF0B7BD0D119BA65D1477DBA5AD046AD54B5C7BC59D11C400DD2F4F9C347B73B6727546C90C63C59D6D9B6DEBF13A1D
Malicious:	false
Preview:	p...... ........k.4e"K..(....................................................... .........g.%.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.a.1.6.7.1.3.2.5.4.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UxaZyTE7nq.exe.log

Download File

Process:	C:\Users\user\Desktop\UxaZyTE7nq.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.374391981354885
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTxAIOKbbDLI4MWuPOKN08JOKhap+92n4MNQpN9tv:ML9E4KrgKDE4KGKN08AKh6+84xpNT
MD5:	C8A62E39DE7A3F805D39384E8BABB1E0
SHA1:	B32B1257401F17A2D1D5D3CC1D8C1E072E3FEE31
SHA-256:	A7BC127854C5327ABD50C86000BF10586B556A5E085BB23523B07A15DD4C5383
SHA-512:	7DB2825131F5CDA6AF33A179D9F7CD0A206FF34AE50D6E66DE9E99BE2CD1CB985B88C00F0EDE72BBC4467E7E42B5DC6132403AA2EC1A0A7A6D11766C438B10C3
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\f2e0589ed6d670f264a5f65dd0ad000f\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\?????.sys

Download File

Process:	C:\Users\user\Desktop\UxaZyTE7nq.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36208
Entropy (8bit):	6.284053631838433
Encrypted:	false
SSDEEP:	768:tKCM0IWRhm8LiES4cT4iZ923OMqUD6Q4KICJw4:t7/Vhzb3pL4GJw4
MD5:	97E3A44EC4AE58C8CC38EEFC613E950E
SHA1:	BC47E15537FA7C32DFEFD23168D7E1741F8477ED
SHA-256:	440883CD9D6A76DB5E53517D0EC7FE13D5A50D2F6A7F91ECFC863BC3490E4F5C
SHA-512:	8EF7FC489B6FFED9EC14746E526AE87F44C39D5EAFFF0D4C3BFA0B3F0D28450F76D1066F446C766F4C9A20842A7F084FE4A9F94659D5487EA88959FCCB2A96EB
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ENQUIRY - TAIPEI DISCHARGE EQUIPMENT.PDF.exe, Detection: malicious, Browse Filename: 8UwYWNRGdr.exe, Detection: malicious, Browse Filename: 5nEPpS2Hhg.exe, Detection: malicious, Browse Filename: Excel_xls.exe, Detection: malicious, Browse Filename: proforma Invoice Sheet.exe, Detection: malicious, Browse Filename: PO 347282-1.exe, Detection: malicious, Browse Filename: ORPO-INVOCE.exe, Detection: malicious, Browse Filename: ORPO-INVOCE0987.jar, Detection: malicious, Browse Filename: SKH076434567-09876543476.jar, Detection: malicious, Browse Filename: ORIGINAL_BL_INVOICE_PL_.exe, Detection: malicious, Browse Filename: OnionBrowserV27.321.4212-exe-only.zip, Detection: malicious, Browse Filename: npp.28.442421Installer.x64-exe-only.zip, Detection: malicious, Browse Filename: rufus-28.412.213-exe-only.zip, Detection: malicious, Browse Filename: npp.27.31.21.x64.exe, Detection: malicious, Browse Filename: 32WRxzwd03.exe, Detection: malicious, Browse Filename: YFBSe9827J.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.CrypterX-gen.381.20116.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w.{.w.{.w.{.~...p.{.w.z.H.{.~...t.{.~...t.{.~...t.{."...v.{."..v.{.".y.v.{.Richw.{.........PE..d...l..a.........." .....L..........X.......................................................................................................x...(............`.......l..p!......0....I..T............................................@...............................text....%.......&.................. ..h.rdata.......@.......*..............@..H.data...,....P.......:..............@....pdata.......`.......<..............@..HPAGE.........p.......@.............. ..`INIT.................\.............. ..b.rsrc................f..............@..B.reloc..0............j..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\MyData\DataLogs.conf

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:Rt:v
MD5:	CF759E4C5F14FE3EEC41B87ED756CEA8
SHA1:	C27C796BB3C2FAC929359563676F4BA1FFADA1F5
SHA-256:	C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
SHA-512:	C7F832AEE13A5EB36D145F35D4464374A9E12FA2017F3C2257442D67483B35A55ECCAE7F7729243350125B37033E075EFBC2303839FD86B81B9B4DCA3626953B
Malicious:	false
Preview:	.5.False

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.978944604782391
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UxaZyTE7nq.exe
File size:	363008
MD5:	91a442b21fb353b221ea33e767c7fe1b
SHA1:	e58e0d08ebdc5e91f43631b339c573a732c07056
SHA256:	35330f1bbbc0f361845b9b987e2f4ac70cdb96ab3f9e80161c2b8971c7df0df4
SHA512:	262ef3d9577dacde7ad613fe858073b347d21a553961c63f6f64c9dd593fc610dc2bb04ab84b6cf2a4c9347e3795d825690bdb412d19e89fe380da5bd4009f58
SSDEEP:	6144:ozh88dY9m16JNcxnDggHNrRP5fw2fTt+iMaNOSm3lVVCT4kH/7zppTR:o18fCcaxdPhHTANaYSIlHCT4k/9
TLSH:	3D74129093DC9C57FF5C1679C8AC11172A789EBBD7A796CF2EA844CC66EA3000472573
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....IA..........."...0.................. ....@...... ....................................`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDF4149F2 [Thu Sep 9 19:52:18 2088 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a468	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x58514	0x58600	False	0.9499453014497878	data	7.981513997954339	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5c000	0x60	0x200	False	0.125	data	3.1757517953526886	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_GROUP_ICON	0x5c058	0x6	data

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
91.134.187.20192.168.2.64449497182850454 02/27/23-19:11:47.671813	TCP	2850454	ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT)	4449	49718	91.134.187.20	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2023 19:11:46.553606033 CET	49672	443	192.168.2.6	40.90.65.8
Feb 27, 2023 19:11:47.573369026 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:47.600991011 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:11:47.601259947 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:47.635396004 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:47.671813011 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:11:47.679271936 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:47.708478928 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:11:47.756535053 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:50.830960989 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:50.904359102 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:11:50.904592991 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:11:50.982225895 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:03.165569067 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:03.248050928 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:03.248159885 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:03.277838945 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:03.320290089 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:03.347985983 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:03.398428917 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:03.510010004 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:03.592195034 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:03.592434883 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:03.680654049 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:04.232732058 CET	49693	80	192.168.2.6	93.184.220.29
Feb 27, 2023 19:12:06.153676987 CET	80	49707	209.197.3.8	192.168.2.6
Feb 27, 2023 19:12:06.153904915 CET	49707	80	192.168.2.6	209.197.3.8
Feb 27, 2023 19:12:08.657963991 CET	49704	80	192.168.2.6	8.241.126.249
Feb 27, 2023 19:12:08.658171892 CET	49707	80	192.168.2.6	209.197.3.8
Feb 27, 2023 19:12:08.674978018 CET	80	49707	209.197.3.8	192.168.2.6
Feb 27, 2023 19:12:08.675625086 CET	49707	80	192.168.2.6	209.197.3.8
Feb 27, 2023 19:12:08.677985907 CET	80	49704	8.241.126.249	192.168.2.6
Feb 27, 2023 19:12:08.678109884 CET	49704	80	192.168.2.6	8.241.126.249
Feb 27, 2023 19:12:09.339575052 CET	80	49709	93.184.220.29	192.168.2.6
Feb 27, 2023 19:12:09.341197968 CET	49709	80	192.168.2.6	93.184.220.29
Feb 27, 2023 19:12:12.360469103 CET	49729	443	192.168.2.6	13.107.43.16
Feb 27, 2023 19:12:12.360563993 CET	443	49729	13.107.43.16	192.168.2.6
Feb 27, 2023 19:12:12.360718966 CET	49729	443	192.168.2.6	13.107.43.16
Feb 27, 2023 19:12:16.451729059 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:16.530651093 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:16.530862093 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:16.566533089 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:16.656225920 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:16.683962107 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:16.832526922 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:16.904267073 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:16.904393911 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:16.984352112 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:28.577745914 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:28.670877934 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:28.671067953 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:28.700054884 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:28.744337082 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:28.772017002 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:28.808320999 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:28.888947964 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:28.889134884 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:28.967809916 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:40.849802017 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:40.919904947 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:40.925098896 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:40.954245090 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:41.011068106 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:41.043493032 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:41.089118958 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:41.098615885 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:41.170604944 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:41.171689034 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:41.248167038 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:50.921273947 CET	49709	80	192.168.2.6	93.184.220.29
Feb 27, 2023 19:12:50.939707041 CET	80	49709	93.184.220.29	192.168.2.6
Feb 27, 2023 19:12:50.939836979 CET	49709	80	192.168.2.6	93.184.220.29
Feb 27, 2023 19:12:55.917112112 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:55.997915983 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:55.998095036 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:56.027657986 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:56.075226068 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:56.103025913 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:56.128896952 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:56.201147079 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:12:56.201338053 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:12:56.279298067 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:01.184989929 CET	49683	443	192.168.2.6	20.190.159.5
Feb 27, 2023 19:13:01.356775045 CET	49684	443	192.168.2.6	40.126.31.70
Feb 27, 2023 19:13:01.365171909 CET	49685	443	192.168.2.6	40.126.31.70
Feb 27, 2023 19:13:05.696619987 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:05.779391050 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:05.779546976 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:05.808697939 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:05.856870890 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:05.884537935 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:05.905389071 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:05.982521057 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:05.982654095 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:06.060770035 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:17.950309992 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:18.030042887 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:18.030193090 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:18.059967041 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:18.108022928 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:18.138520956 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:18.145309925 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:18.217257977 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:18.217431068 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:18.296447992 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:30.156754971 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:30.232592106 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:30.234091997 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:30.263084888 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:30.312685013 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:30.340630054 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:30.341931105 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:30.420027018 CET	4449	49718	91.134.187.20	192.168.2.6
Feb 27, 2023 19:13:30.420202017 CET	49718	4449	192.168.2.6	91.134.187.20
Feb 27, 2023 19:13:30.498017073 CET	4449	49718	91.134.187.20	192.168.2.6

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 27, 2023 19:12:12.347565889 CET	8.8.8.8	192.168.2.6	0x5272	No error (0)	l-0007.l-dc-msedge.net		13.107.43.16	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	19:11:20
Start date:	27/02/2023
Path:	C:\Users\user\Desktop\UxaZyTE7nq.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\UxaZyTE7nq.exe
Imagebase:	0x1dc91420000
File size:	363008 bytes
MD5 hash:	91A442B21FB353B221EA33E767C7FE1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.266467876.000001DC931AA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.266467876.000001DC9326F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	19:11:28
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Imagebase:	0x198d6330000
File size:	258144 bytes
MD5 hash:	8B9E68304AF4B81C9AB70CB2220EBA74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	2
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
Imagebase:	0x1f77e8a0000
File size:	126560 bytes
MD5 hash:	F31014EE4DE7FE48E9B7C9BE94CFB45F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	3
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Imagebase:	0x186a8be0000
File size:	42080 bytes
MD5 hash:	11D8A500C4C0FBAF20EBDB8CDF6EA452
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
Imagebase:	0x1a018270000
File size:	96864 bytes
MD5 hash:	2B6A31DFD7C9ED8B413DBDAB800F10F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	5
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
Imagebase:	0x20cfa730000
File size:	64096 bytes
MD5 hash:	2B5D765B33C67EBA41E9F47954227BC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	6
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
Imagebase:	0x174169e0000
File size:	32872 bytes
MD5 hash:	D91462AE31562E241AF5595BA5E1A3C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	7
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
Imagebase:	0x2126f360000
File size:	136296 bytes
MD5 hash:	7EC8B56348F9298BCCA7A745C7F70E2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	8
Start time:	19:11:29
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Imagebase:	0x7ff7aa180000
File size:	174184 bytes
MD5 hash:	FBA5E8D94C9EADC279BC06B9CF041A9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	9
Start time:	19:11:30
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
Imagebase:	0x1fcf0460000
File size:	44648 bytes
MD5 hash:	BF7E443F1E1FA88AD5A2A5EB44F42834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	10
Start time:	19:11:30
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
Imagebase:	0x28d293e0000
File size:	42600 bytes
MD5 hash:	65D30D747EB31E108A36EBC966C1227D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	11
Start time:	19:11:30
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Imagebase:	0x7ff701c60000
File size:	128584 bytes
MD5 hash:	B00E9325AC7356A3F4864EAAAD48E13F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	12
Start time:	19:11:30
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Imagebase:	0x7ff60e470000
File size:	47280 bytes
MD5 hash:	33BB8BE0B4F547324D93D5D2725CAC3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	13
Start time:	19:11:30
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
Imagebase:	0x7ff7bec50000
File size:	270440 bytes
MD5 hash:	80B018258257C2F78CBFE08198883AC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	14
Start time:	19:11:30
Start date:	27/02/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
Imagebase:	0xb50000
File size:	46688 bytes
MD5 hash:	2B40A449D6034F41771A460DADD53A60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000E.00000002.512134947.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 0000000E.00000002.513654530.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.6%
Total number of Nodes:	530
Total number of Limit Nodes:	91

Executed Functions

Function 00007FFCA4494308 Relevance: 3.1, Strings: 2, Instructions: 583
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFCA4494450
]_H, xrefs: 00007FFCA449446F

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID: fish$]_H
API String ID: 0-3021672115
Opcode ID: 47b69f6e88fc1e368a10dd519109e2b330ab43a43ae3d52b0fcfd51cb779dedd
Instruction ID: 3294874027e328f9b4414563b2faba7515dfac1d1e5cdcdb3a9864e5a72e8e66
Opcode Fuzzy Hash: 47b69f6e88fc1e368a10dd519109e2b330ab43a43ae3d52b0fcfd51cb779dedd
Instruction Fuzzy Hash: C3F17831A0EA9D4FEB58DA6898A11B977D0EF56314B1405BED08AC31EBDE14FC02D3E5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4494300 Relevance: 2.6, APIs: 1, Instructions: 1093memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE ref: 00007FFCA44AC205

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cd303d459da28bb656d0daed6db0046b9d40f3f29f9699b056d11b3e0f564fd8
Instruction ID: d6a5552c36a00b56dfef10a8c057ffe7686bab73d65dd5da02df6a7659b07b24
Opcode Fuzzy Hash: cd303d459da28bb656d0daed6db0046b9d40f3f29f9699b056d11b3e0f564fd8
Instruction Fuzzy Hash: DD82A93090D69E8FE759CB14C4A12B477E1EF95311F0049BDD18E9B5EBDE28B846CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4499010 Relevance: 2.2, Strings: 1, Instructions: 930
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T]_H, xrefs: 00007FFCA449D1C4

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID: T]_H
API String ID: 0-1147892275
Opcode ID: aead15e65f456c4fcaa213870eaf8484b6770c4efb9931abe69560249e86e4cc
Instruction ID: 8b4291014dac51743da5ffafa05a8fe2fae176ce8e0946b14db37cef56e775ed
Opcode Fuzzy Hash: aead15e65f456c4fcaa213870eaf8484b6770c4efb9931abe69560249e86e4cc
Instruction Fuzzy Hash: 3D520470A0DA1D4FDB68DA68C8A5A797BE1EF59300B1005BDE08EC72A7CE24FC42D755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44A5BC9 Relevance: 1.9, Instructions: 1893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64211bda6b5c4dcc6fb3e57887f09573a575693418fdcdf5fe853018821ea14a
Instruction ID: 9361cdaa4515e309685a46e6aca4bd657152cfb2b72cf7b6e1c8fc90ddbfa5d8
Opcode Fuzzy Hash: 64211bda6b5c4dcc6fb3e57887f09573a575693418fdcdf5fe853018821ea14a
Instruction Fuzzy Hash: 38D27830A0DA5D8FE759DB28C4A55B977E1FF95300B0049BEE08AC72A6DE34F846C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44A8655 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE ref: 00007FFCA44A8790

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 621aeed17c38ee6e3712fe9629a4b2ca15fb28c03f5a61c63c937923a30d07ef
Instruction ID: 8e9b40c5572be323f2edf22d56ebd7a0d2517bc891bdd0a54c15214c8076793e
Opcode Fuzzy Hash: 621aeed17c38ee6e3712fe9629a4b2ca15fb28c03f5a61c63c937923a30d07ef
Instruction Fuzzy Hash: 41517F71908A1C8FDF58DF48D895BE9B7F1FB68310F0042AAE44EE7252DB70A945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44902E8 Relevance: 1.6, APIs: 1, Instructions: 124
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFCA44AC875

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2bf0a3522f1ad002c30eb9db2d1f3787c5e6994e26f08f08767096d3c865bade
Instruction ID: cb5db0dd74795d79399316825acb3b68b389969b9b33790bb312b56744c8952d
Opcode Fuzzy Hash: 2bf0a3522f1ad002c30eb9db2d1f3787c5e6994e26f08f08767096d3c865bade
Instruction Fuzzy Hash: B231157190DA5C8FDB58DB9C98957F9BFF4EBA6310F14016BC04AD3257DA20A802C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44902F8 Relevance: 1.6, APIs: 1, Instructions: 119nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 00007FFCA44AC875

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dc30f5040377ad411da17c39852eb581545289d5b948b1338c87622fb6b6d247
Instruction ID: 4df35aa46499152b3c86f54094ded93c80bb596131c4bad3ee352d69f627e5db
Opcode Fuzzy Hash: dc30f5040377ad411da17c39852eb581545289d5b948b1338c87622fb6b6d247
Instruction Fuzzy Hash: EF31267190DA5C8FDB58DB9C98897F9BFF4FB99310F14016BC04AD3256CB20A842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44A9254 Relevance: 1.6, APIs: 1, Instructions: 111nativeCOMMON

Download Yara Rule

APIs

NtLoadDriver.NTDLL ref: 00007FFCA44A92FF

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: DriverLoad
String ID:
API String ID: 2513027847-0
Opcode ID: 778ddb17e7ccc8eaa351f6fc6855aac5d95f837440dc27070591ba8d36a783de
Instruction ID: b7a84a3f4a7842e9be59f45b0d3abbf52783d06f2728fcc36224cca9ba1a3788
Opcode Fuzzy Hash: 778ddb17e7ccc8eaa351f6fc6855aac5d95f837440dc27070591ba8d36a783de
Instruction Fuzzy Hash: E231E43190CA4C9FDB58DB58C849BE9BBF1FF9A321F04422ED009D32A1DB706416CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4496858 Relevance: .9, Instructions: 902COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8083e554f40ebca69b482946fc317ed1bdaff28c30fe85437ff24d0adb5f7c
Instruction ID: a48551a49d4b821484b3c15c64938e4e6d61a9257ddda740469b05e4d50f18f3
Opcode Fuzzy Hash: 2d8083e554f40ebca69b482946fc317ed1bdaff28c30fe85437ff24d0adb5f7c
Instruction Fuzzy Hash: 1662D13051AA5D8FE759DF18C4E09B973E1FF94304B604ABDD08B876AACA35F842C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44924AD Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f701e5041f8668e1d79cfd96d3f9109b548343a8c5baf06d29008db68c8c48d5
Instruction ID: 57b2384400c8cee07c1ab021ebc5f75a3b1e892d0a93a520291dfdcc70ba5f74
Opcode Fuzzy Hash: f701e5041f8668e1d79cfd96d3f9109b548343a8c5baf06d29008db68c8c48d5
Instruction Fuzzy Hash: 0332D630618E4D8FDB88EF1CC8A5AA577E1FF99310B144AA9E00DD7296CE35EC42C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA449BC59 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2a4136b10b3f7dd95b5ae1d49102af2a3815313f5a7b7b8151d08268e72f9a
Instruction ID: 70fbba69d50816f24ca0b6da99128ea2f55f4ef8953c7c1eb9fdc480e03996f7
Opcode Fuzzy Hash: 2b2a4136b10b3f7dd95b5ae1d49102af2a3815313f5a7b7b8151d08268e72f9a
Instruction Fuzzy Hash: 14F17A3050DBAA4FE31DCA6884E51B577D2FF91302B144E7ED48AC72AADE24F802C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4498B20 Relevance: 2.1, APIs: 1, Instructions: 641
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916686f177c61bd8e15619574d0ddd371cee0db2e1f559be8ce25a22db914c5e
Instruction ID: c63e593dfab1d1b37494a994b4a70255ec21099e86db801433afc4197d980067
Opcode Fuzzy Hash: 916686f177c61bd8e15619574d0ddd371cee0db2e1f559be8ce25a22db914c5e
Instruction Fuzzy Hash: D8127A3190EA9D4FE768D71C886A1B577E0FF99311F0409BED04DDB2A6DE28B805C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4490258 Relevance: 1.8, APIs: 1, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb78852cd9d48ba15e7365fc1e7897220dbb4bbf4eec344130417bb93fd868dc
Instruction ID: 47ea7287a1d45408db1a0fdb0d94c08de2e7b3dc8fcf77cad0711f95ae098496
Opcode Fuzzy Hash: eb78852cd9d48ba15e7365fc1e7897220dbb4bbf4eec344130417bb93fd868dc
Instruction Fuzzy Hash: FDA1D17190DA5C8FDB68DB4C98556E8BBE0FF98310F1046ABD009A3256DA30AD81CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44AA1F0 Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2454ea3f8c842642e2e86f06c7979801b3b689af8a30bc96b21eafbe3c677903
Instruction ID: 97355cd5ef70333a02ca1ca3d0af2fbc36ff2692fb72f15b3997a8bcfc52544c
Opcode Fuzzy Hash: 2454ea3f8c842642e2e86f06c7979801b3b689af8a30bc96b21eafbe3c677903
Instruction Fuzzy Hash: 0C81AC3180EB9C4FEB59DB1888566F97BE0FF16310F0405BED049E71A2EBA57806C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44A9F91 Relevance: 1.8, APIs: 1, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34997f1853ea5e253ba2f823dab1966ae774380332920d4fc86d70a03a14c12
Instruction ID: e870f8dc6fb3e483c8a9b9865873f81985616d2bec56955fc746a3d6cf2e323d
Opcode Fuzzy Hash: a34997f1853ea5e253ba2f823dab1966ae774380332920d4fc86d70a03a14c12
Instruction Fuzzy Hash: B8818C71908A2C8FDBA8DF48D855AE9B7F0FB98311F1042AAD40DE7255DB70A981CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4492BEE Relevance: 1.6, APIs: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FFCA4492D01

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1d1c0e30c34b93f23161892d8109dedf1b2540e92aee472066d464d1f44ca89b
Instruction ID: c8dc5441477cf4dcbb8369440a4df41b8f670d9f65e3318f1454a4b4e2e9bc12
Opcode Fuzzy Hash: 1d1c0e30c34b93f23161892d8109dedf1b2540e92aee472066d464d1f44ca89b
Instruction Fuzzy Hash: D3414234604A4D8FEB98DF68C8957A977D1FB58301F10462EE84EC7295CF75E981CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4492FEA Relevance: 1.6, APIs: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFCA44930C1

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fa6112e8332243609ea90bf83d3e0becc81a6eab044eda3e381ecb8e03485cfa
Instruction ID: b9229dae5063f09ff1343fb6f3c4ecbb4bba8aa70645fb9a363f43233ce9b561
Opcode Fuzzy Hash: fa6112e8332243609ea90bf83d3e0becc81a6eab044eda3e381ecb8e03485cfa
Instruction Fuzzy Hash: 0241263090C7885FDB19DBA89C566E97FF0EB56321F0402AFD049C32A3CB646846C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44A8885 Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFCA44A8945

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5a71aefe587a6f754aa2c9cc29012d81c48305128eb0bbd1f111f80f21c79f65
Instruction ID: eb85d2b7f762c55130905342b7d830b37766070854f6ff5b4bd0c1d39e1fb2a6
Opcode Fuzzy Hash: 5a71aefe587a6f754aa2c9cc29012d81c48305128eb0bbd1f111f80f21c79f65
Instruction Fuzzy Hash: BE314A3090CA8C8FDB19DB68C895BF87BF0FF56321F04026EC089D31A2CB64A416CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA44AA359 Relevance: 1.6, APIs: 1, Instructions: 113threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FFCA44AA3FD

Memory Dump Source

Source File: 00000000.00000002.281862107.00007FFCA4490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4490000_UxaZyTE7nq.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e6d7565af5c0603aef5c215d94859788dc99420abcde6cd329f5442e452dc551
Instruction ID: 2d38cc2fbca66b52402980a0ee865ce3465e034425cfb5ccd7f1b118615d8605
Opcode Fuzzy Hash: e6d7565af5c0603aef5c215d94859788dc99420abcde6cd329f5442e452dc551
Instruction Fuzzy Hash: 9531DE3190CB5C8FDB68DF58C889AEA7BF0FF69311F0441ABD049D7256DB60A805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA455131A Relevance: 1.1, Instructions: 1117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5315a23d725987cf334d43e5913382aceb0ac78f5e65b4c0f2cfb4f6a0832a0
Instruction ID: 3ec826a4318e79827dde824277a5a349c921dfabea7a85b3194bf6680feed779
Opcode Fuzzy Hash: a5315a23d725987cf334d43e5913382aceb0ac78f5e65b4c0f2cfb4f6a0832a0
Instruction Fuzzy Hash: F0627C72D0EB994FD755DB6888A55B57FE0EF56300F0809BEC08ACB1B2DA25B845C393

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4550186 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147fc4c8626a474b5a39c9f18754f5db69528f54898ed1a67186f80b969f75a4
Instruction ID: 8f1650854eb732f166a616875b3143d6f0bafb2362301cf6cde1c203f3bbce49
Opcode Fuzzy Hash: 147fc4c8626a474b5a39c9f18754f5db69528f54898ed1a67186f80b969f75a4
Instruction Fuzzy Hash: A0F12A72C0EBDA4FEB55D66858A61B57FE0EF56610F0509FAC088CB1A3DB15780AC363

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4550950 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ce09f9915e6f8b603ec1910ee7d51e42fa9fd7be7fd8c4cbf5dd2ce7352ba3
Instruction ID: 39790e845b0d796765b68c93bd8cca1b40154dc978c71bf7ce8c905065efa265
Opcode Fuzzy Hash: 50ce09f9915e6f8b603ec1910ee7d51e42fa9fd7be7fd8c4cbf5dd2ce7352ba3
Instruction Fuzzy Hash: 32D1167280EBDA4FE756D66888A51B5BFE0FF56710F0409FED0C8CB1A2DA15B845C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA45515E9 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73cd836a56c650db6697ba42f66ea7bc64f5e95f8e39e8ffb58e839292e9ba23
Instruction ID: dfcabb53df69a67cf6f7799e7a391bcf3576451df5feb8a99a4f0e096942b0e5
Opcode Fuzzy Hash: 73cd836a56c650db6697ba42f66ea7bc64f5e95f8e39e8ffb58e839292e9ba23
Instruction Fuzzy Hash: 04D16B71D0EB594FD798DB58C8A5AB5BBE1FF96300F0409AFD08BC7262DA21B841C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4550B6B Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbe527b9f7cf8f5fe8728fa8b19d0956656ef88ad75e82318b1460378d7148c
Instruction ID: 824958cfeb1484f808da59c5bff811d13d558fa69e62ea3611fb7354e482bea4
Opcode Fuzzy Hash: 5dbe527b9f7cf8f5fe8728fa8b19d0956656ef88ad75e82318b1460378d7148c
Instruction Fuzzy Hash: 0A617C7290EB994FD749DB58C8E55B5BBE1FF96300B0409BEC089C71A3CA25B801C3A3

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4551B29 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babe564bc34b74103ee4b88d65ce6e85bc83b02cf3e6cf00fe74f0bb5a85b171
Instruction ID: 48d11a47ccd8cfca89e46d804fbb2aee974ffe12db50bcf90c4a060c1fa37294
Opcode Fuzzy Hash: babe564bc34b74103ee4b88d65ce6e85bc83b02cf3e6cf00fe74f0bb5a85b171
Instruction Fuzzy Hash: 3A518F31D0EB594FD755D768C8965B57FE0EF95310F0809BEC04AC7162DE12B845C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA45501B8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962e671dba2205d177e05f8ced1fb73d81432fea07cb90e319732d4dbf9e28a3
Instruction ID: 47a0fedfb3a7b9585e7e3f69c9f369daf4d5780d99fbd8e5e88b0b123ff42f86
Opcode Fuzzy Hash: 962e671dba2205d177e05f8ced1fb73d81432fea07cb90e319732d4dbf9e28a3
Instruction Fuzzy Hash: 0F414F72C1EB994FDB59D6688CA75B97BE0EF41700F04087DC085871A3DB157806C397

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCA4552CA8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282403573.00007FFCA4550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCA4550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffca4550000_UxaZyTE7nq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2259d6c0164c7dc4c58b9729aee79a83910bbc4fa4f25b7b4f4d61dbff6e49
Instruction ID: 3b090002b1b0b418f2d03d8b374bab43463ac10cf9f54639a8169a518347d142
Opcode Fuzzy Hash: ed2259d6c0164c7dc4c58b9729aee79a83910bbc4fa4f25b7b4f4d61dbff6e49
Instruction Fuzzy Hash: 86116A7260DB490FD788D65CA4515B9B7E1FBD6320F0406AEE08EC7253DA12E802C796

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: jsc.exePID: 4532, Parent PID: 5248COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	0

Executed Functions

Function 01502668 Relevance: 2.0, APIs: 1, Instructions: 457
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 01502B49

Memory Dump Source

Source File: 0000000E.00000002.513428155.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1500000_jsc.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 851cbe47ebe6e3ed5879e9ff171264d11a3bcadc3b2b2c5b24fe63f8b85a0f1b
Instruction ID: 8f3118091cac5971f307f198a15bcf398cd21e07e8d7a319ef8fdb53af240927
Opcode Fuzzy Hash: 851cbe47ebe6e3ed5879e9ff171264d11a3bcadc3b2b2c5b24fe63f8b85a0f1b
Instruction Fuzzy Hash: 4CE1B431F013068BDB16DAED8C943AE76E7BFC4620F188629DA15DF3C5EEB499814741

Uniqueness

Uniqueness Score: -1.00%

Function 01502AC0 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 01502B49

Memory Dump Source

Source File: 0000000E.00000002.513428155.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1500000_jsc.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e792ec31fa5b17f4ffc3812145930b6c8cfbbb4f72aef2bad7986bc3c232f42e
Instruction ID: 81f0e1db18f0b3ff34ba94fdad963d1c2ac67c9f9290d4a2c18e6ac37f48d0b0
Opcode Fuzzy Hash: e792ec31fa5b17f4ffc3812145930b6c8cfbbb4f72aef2bad7986bc3c232f42e
Instruction Fuzzy Hash: 6921F0B1D012099FCB10DFAAD984ADEFBF5BB48310F60842AE919A7250C7789940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01508D98 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01508E27

Memory Dump Source

Source File: 0000000E.00000002.513428155.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1500000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ca27811f78f00fe3caff70eafe60d02a477d9d56f745a1b1475ae55336cff53d
Instruction ID: 9f93d0c795c97955006ed1b17483172750f1c0da4b12a46c8bc0f78c539ff7b1
Opcode Fuzzy Hash: ca27811f78f00fe3caff70eafe60d02a477d9d56f745a1b1475ae55336cff53d
Instruction Fuzzy Hash: BD21D2B5D002089FDB10CFAAD984ADEBBF9EB48320F14851AE914A7350D378A944DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01508DA0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01508E27

Memory Dump Source

Source File: 0000000E.00000002.513428155.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1500000_jsc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8f5834a8252b543223a4aabfe32f666383736345cacd003f84bdcf9e90ecb326
Instruction ID: ad0681e2324bdcb0d5ab14386590e4aaed6dd03438b6da073c8c82c20acb60a7
Opcode Fuzzy Hash: 8f5834a8252b543223a4aabfe32f666383736345cacd003f84bdcf9e90ecb326
Instruction Fuzzy Hash: 4421B0B5D002099FDB10CFAAD984ADEBFF9FB48320F14841AE914A7350D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01501C18 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(010145A0,00000000,?,?), ref: 01503D4B

Memory Dump Source

Source File: 0000000E.00000002.513428155.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1500000_jsc.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: abe37c8c583d93c70614083cda7ea6445c0d4e1b0d5ab4b159b1becc35fe1e31
Instruction ID: 0160fd8d5aaa5e9b5f26c4fea0cb722ee33144d2160b793cb9f1b57a87a689da
Opcode Fuzzy Hash: abe37c8c583d93c70614083cda7ea6445c0d4e1b0d5ab4b159b1becc35fe1e31
Instruction Fuzzy Hash: D421F571900209DFCB54DF9AD944BEEBBF5BB88310F108429E455AB350D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01503CC8 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(010145A0,00000000,?,?), ref: 01503D4B

Memory Dump Source

Source File: 0000000E.00000002.513428155.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1500000_jsc.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f73279b61d29537fc6b1e25351abfdc1068b7c94468dd04f0d1524d1e7221ff6
Instruction ID: 8cef51dcbb32347d8c10e13322cd2a7044ae3987e4a50656818af8fb444b4758
Opcode Fuzzy Hash: f73279b61d29537fc6b1e25351abfdc1068b7c94468dd04f0d1524d1e7221ff6
Instruction Fuzzy Hash: AB21F571900209DFCB54DF9AD944AEEBBF5BB88310F10841AE459A7350C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UxaZyTE7nq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Threatname: VenomRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UxaZyTE7nq.exe.log

C:\Users\user\AppData\Local\Temp\?????.sys

C:\Users\user\AppData\Roaming\MyData\DataLogs.conf

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
UxaZyTE7nq.exe

Function 00007FFCA4494308 Relevance: 3.1, Strings: 2, Instructions: 583
COMMON

Function 00007FFCA4499010 Relevance: 2.2, Strings: 1, Instructions: 930
COMMON