Behavioral task
behavioral1
Sample
1976-70-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1976-70-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1976-70-0x0000000000400000-0x000000000041E000-memory.dmp
-
Size
120KB
-
MD5
527edd9f9553a3a5183802968ee29813
-
SHA1
e008bf6e83846df1dc2af4aec7b9b3052aac317d
-
SHA256
e5c3be58e13d5817df580a7d79e0b2957a1a92a4c8b1f9476a2890e1fa0d4384
-
SHA512
5d7e2aacbf751601fd13a606b807bb4bd71ba18c1f50e5e89a4694434cfd2828c3f2657bad0f116b841482ba70115562dd81e06e9351c56d38fb84e4e8133054
-
SSDEEP
768:WuwCfTg46YbWUn9jjmo2qrnUPB+lOOFPIwzjbzgX3iS5RjBBDZ:WuwCfTgpM2QiUOOCw3bsXSSDd
Malware Config
Extracted
asyncrat
0.5.7B
Default
192.3.193.136:2023
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
1976-70-0x0000000000400000-0x000000000041E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ