Behavioral task
behavioral1
Sample
1320-65-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1320-65-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1320-65-0x0000000000400000-0x0000000000412000-memory.dmp
-
Size
72KB
-
MD5
2d21243253c96a3416ea6eab6203f8a6
-
SHA1
db43d53b33ce1fc7441af1be316a36ede50d7476
-
SHA256
70dd77f314db5725c87342f5ec802bc519be7dc7f41987680fe54015413a1b48
-
SHA512
db805c14225c092aa3bfdc1563e6f9f4001e89d4ca0c9626f475113cde3158e9a195e2204e8009360848a40608524285364497e5a95d705ef67f62a9abba1a1e
-
SSDEEP
768:CuIYdTxJzlTWU/Wmhmo2qblyDj8lpnFePIGMpz4m40bf5k5p4ePDOF/3HcBDZ:CuIYdTxFp2+VLn1hpEcbf5l3F/qd
Malware Config
Extracted
asyncrat
0.5.7B
Default
fresh03.ddns.net:45265
fresh03.ddns.net:34110
fresh03.ddns.net:2245
fresh01.ddns.net:45265
fresh01.ddns.net:34110
fresh01.ddns.net:2245
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
logs.exe
-
install_folder
%AppData%
Signatures
Files
-
1320-65-0x0000000000400000-0x0000000000412000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ