Behavioral task
behavioral1
Sample
4660-163-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4660-163-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4660-163-0x0000000000400000-0x0000000000412000-memory.dmp
-
Size
72KB
-
MD5
c0647207915f60137d9f970e047f28fc
-
SHA1
6ad2dec9ab49307494f2b2bb42054ea7147df554
-
SHA256
04553830fc905bba420a6475fdf5cc0ad3bda80e879f23fcddc5b30cf7fbc263
-
SHA512
b5a6ab6011dc65525959a04b18137d29cd702a76ca30720f2f0159ac4438c09f1064b35afb4445e46bf87be454805203afd5f44aa41778c2fab90e94896c2bdc
-
SSDEEP
1536:Uuk2VThSa2v0M4ipQBcQqtb0FcNrY3dCj:UukqThSa28M4ipQBEb02r+Yj
Malware Config
Extracted
asyncrat
0.5.7B
Windows Sheel Host
20.111.19.215:3152
Windows Sheel Host
-
delay
3
-
install
false
-
install_file
Windows Sheel Host.exe
-
install_folder
%AppData%
Signatures
Files
-
4660-163-0x0000000000400000-0x0000000000412000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ