Behavioral task
behavioral1
Sample
2532-1-0x0000018E18DE0000-0x0000018E18DF2000-memory.exe
Resource
win7-20240221-en
General
-
Target
2532-1-0x0000018E18DE0000-0x0000018E18DF2000-memory.dmp
-
Size
72KB
-
MD5
3a79747ee548d77bdf3019f3c367fe37
-
SHA1
d866f878597bcb9eb29aca3db3fd94de748bdd22
-
SHA256
0fe8d5c76559706ea070d61e4146553f6b486f34f942437a2fccb3872c2502be
-
SHA512
1e40f9c6ae3c8debe494dd3e904ffae8092c23fff579206b30ea315b03be0d5e317e7eab212403697e859d978354923958b22590c2816ad4150e439740a2341c
-
SSDEEP
768:CihJILQe08+bixTSxLyjixY8Yb0geu8yDZEgK/J9tpqKYhY7:CiZExSoRzbbJLDZkJ9tpqKmY7
Malware Config
Extracted
asyncrat
1.0.7
Default
38.181.35.175:8848
DcRatMutex
-
delay
1
-
install
false
-
install_file
qazqaz.exe
-
install_folder
%AppData%
Signatures
Files
-
2532-1-0x0000018E18DE0000-0x0000018E18DF2000-memory.dmp.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ