Analysis Overview
SHA256
3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473
Threat Level: Known bad
The file 3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473 was found to be: Known bad.
Malicious Activity Summary
Ducktail family
Async RAT payload
Asyncrat family
Detect Ducktail Third Stage Payload
Unsigned PE
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-10 01:26
Signatures
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Asyncrat family
Detect Ducktail Third Stage Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ducktail family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-10 01:23
Reported
2023-12-10 01:29
Platform
win7-20231023-en
Max time kernel
119s
Max time network
133s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe
"C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe"
Network
Files
memory/1972-0-0x00000000060F0000-0x0000000006B15000-memory.dmp
memory/1972-3-0x0000000001C80000-0x0000000001C8A000-memory.dmp
memory/1972-5-0x000000013FAE0000-0x000000014040D000-memory.dmp
memory/1972-7-0x0000000007CE0000-0x0000000008991000-memory.dmp
memory/1972-10-0x0000000005FC0000-0x0000000006081000-memory.dmp
memory/1972-13-0x0000000001C60000-0x0000000001C72000-memory.dmp
memory/1972-19-0x0000000001D40000-0x0000000001D60000-memory.dmp
memory/1972-16-0x0000000001D60000-0x0000000001D6D000-memory.dmp
memory/1972-22-0x0000000001D90000-0x0000000001DA8000-memory.dmp
memory/1972-34-0x0000000005420000-0x0000000005433000-memory.dmp
memory/1972-31-0x00000000070B0000-0x0000000007131000-memory.dmp
memory/1972-28-0x00000000056C0000-0x0000000005700000-memory.dmp
memory/1972-37-0x0000000007210000-0x00000000072D4000-memory.dmp
memory/1972-40-0x00000000054C0000-0x00000000054E1000-memory.dmp
memory/1972-25-0x0000000005BB0000-0x0000000005C33000-memory.dmp
memory/1972-43-0x00000000020E0000-0x000000000210A000-memory.dmp
memory/1972-46-0x0000000005700000-0x000000000573C000-memory.dmp
memory/1972-49-0x0000000006090000-0x00000000060CE000-memory.dmp
memory/1972-52-0x00000000076A0000-0x0000000007A4E000-memory.dmp
memory/1972-57-0x0000000005510000-0x000000000552A000-memory.dmp
memory/1972-60-0x0000000005500000-0x0000000005508000-memory.dmp
memory/1972-63-0x00000000060D0000-0x00000000060E9000-memory.dmp
memory/1972-66-0x00000000054F0000-0x00000000054F9000-memory.dmp
C:\Users\Admin\AppData\Roaming\vnetbox\System.Core.Vnet.db
| MD5 | e9f6d3a4a4faadff2b563b2a9ed992c6 |
| SHA1 | 4e6def1b3f48cde3c490f25fd8b6387c44c43ed2 |
| SHA256 | 501c84c252d0d76940886b9c6b6aee49389d38cddcc21293da80f0809525a463 |
| SHA512 | ec94e9886e0830a97044205b5721535cb8fa5e0d4b132d75806a4f381a56e09f516622eb9a2f9e0252840a773ec58c477b27a65f3c39828347f80b23672661cb |
memory/1972-396-0x000000013FAE0000-0x000000014040D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-10 01:23
Reported
2023-12-10 01:29
Platform
win10v2004-20231130-en
Max time kernel
141s
Max time network
156s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe
"C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.141.79.40.in-addr.arpa | udp |
Files
memory/4552-0-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/4552-3-0x0000020781D50000-0x0000020781D5A000-memory.dmp
memory/4552-4-0x00007FF7D1080000-0x00007FF7D19AD000-memory.dmp
memory/4552-7-0x00000207863B0000-0x0000020787061000-memory.dmp
memory/4552-22-0x0000020781DE0000-0x0000020781DF8000-memory.dmp
memory/4552-19-0x0000020781D90000-0x0000020781DB0000-memory.dmp
memory/4552-16-0x0000020781DB0000-0x0000020781DBD000-memory.dmp
memory/4552-31-0x0000020785D90000-0x0000020785E11000-memory.dmp
memory/4552-28-0x00000207855A0000-0x00000207855E0000-memory.dmp
memory/4552-25-0x00000207855E0000-0x0000020785663000-memory.dmp
memory/4552-13-0x0000020781D30000-0x0000020781D42000-memory.dmp
memory/4552-34-0x0000020785570000-0x0000020785583000-memory.dmp
memory/4552-10-0x00000207856F0000-0x00000207857B1000-memory.dmp
memory/4552-37-0x0000020785EF0000-0x0000020785FB4000-memory.dmp
memory/4552-40-0x00000207856A0000-0x00000207856C1000-memory.dmp
memory/4552-52-0x0000020788A80000-0x0000020788E2E000-memory.dmp
memory/4552-49-0x0000020785E20000-0x0000020785E5E000-memory.dmp
memory/4552-46-0x0000020785D50000-0x0000020785D8C000-memory.dmp
memory/4552-43-0x0000020785670000-0x000002078569A000-memory.dmp
memory/4552-66-0x0000020785560000-0x0000020785569000-memory.dmp
memory/4552-63-0x0000020785E60000-0x0000020785E79000-memory.dmp
memory/4552-60-0x0000020785590000-0x0000020785598000-memory.dmp
memory/4552-57-0x0000020785D20000-0x0000020785D3A000-memory.dmp
C:\Users\Admin\AppData\Roaming\vnetbox\System.Core.Vnet.db
| MD5 | f0968c8b74a91662b0e100688c6d3f98 |
| SHA1 | ebc7d7fe76131a26eeca5f4a9269762083ab2687 |
| SHA256 | 140aaa5e206b3244421efe6f97b13e483c884344fdc3e36ad37ed0ea566a479d |
| SHA512 | 3229da73765e6cf4fa90fc872bff1837725d7782be36fc6b232b9420bf49918d7c318c6203a8bc2a9e20b4b68d4294b34300f4c7a98007a778fcdc3fe5f53a11 |
memory/4552-396-0x00007FF7D1080000-0x00007FF7D19AD000-memory.dmp