Behavioral task
behavioral1
Sample
912-75-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
912-75-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
912-75-0x0000000000400000-0x0000000000412000-memory.dmp
-
Size
72KB
-
MD5
52f84c85b160ab6cbb11cb94f1a66209
-
SHA1
871d5029d36f1f17c31922046c9ebb70c673f395
-
SHA256
cdf4e5f95ccb8a906c6a5c8f0a3df3e6b9777cb62641e42ff1f93aa474379259
-
SHA512
3e4a851302525f2240746c93a2a60833797edc7bc9c23638c6444611239a0545b85a9abd3034332076b4d8a3435d9487fe70edfecac8a5ce3769a997af7f9787
-
SSDEEP
768:Hu/6ZTgoiziWUUM9rmo2qrrKjGKG6PIyzjbFgX3iEJ/bma6ov5BDZ:Hu/6ZTgle2mKYDy3bCXSy/bmapfd
Malware Config
Extracted
asyncrat
0.5.7B
Default
asyncgeneration1.duckdns.org:4404
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
912-75-0x0000000000400000-0x0000000000412000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ