Behavioral task
behavioral1
Sample
1344-1647-0x00000000035F0000-0x0000000003602000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1344-1647-0x00000000035F0000-0x0000000003602000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1344-1647-0x00000000035F0000-0x0000000003602000-memory.dmp
-
Size
72KB
-
MD5
741684f5d7467dd7fc386d4db87687d4
-
SHA1
faea8171956df4d62870207dff65f0a003f90ad9
-
SHA256
11dd7234c6a5943535887b7744013a1996f8d607fd6fcaf1467323b2fa68344f
-
SHA512
d18344c624f4a9556542c6c3b04783a92d7eadd9725bb1d811364f9cb02e1d1a7139ac3a3e186da88eab6d1d74057fd04894b35d7c4abc2dcf19d9108668d548
-
SSDEEP
768:vD+q7EILuCCj+Dix/f9ing8Ybigempm6m9Z/vEgK/J7ZVc6KN:7+vrxZzbF3PK/nkJ7ZVclN
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
Files
-
1344-1647-0x00000000035F0000-0x0000000003602000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ