Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2992-30-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2992-30-0x0000000000400000-0x0000000000412000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
2992-30-0x0000000000400000-0x0000000000412000-memory.dmp
-
Size
72KB
-
MD5
f74e11e9befa73216e67bc5ac3b56d0d
-
SHA1
46fe5668905efc9d188e7cb37240673fa6c792f1
-
SHA256
d29f50ede1dd3628d0f5e1393ca6f8dce7bc16d7b1fa519bfae52e5664b10245
-
SHA512
bfa524d700b08fe0e01f41d9dfbc49a85a0189b11bfb0a65dba85205cf7826a9e603888a393dbd6b26250260e6fd2f2bc54d8a102b7fe00c4e2bcf88b3957ef7
-
SSDEEP
768:suu91TwQsOnFWUF01/mo2qDpghWjK4PIKUCAT0bbnpAxpOf6PBNh8BDZ8x:suu91TwSo21F9KUCAYbbnKmi5Kd8x
Malware Config
Extracted
asyncrat
0.5.7B
Default
5.252.165.55:1986
AsyncMutex_5SI8OkPnk
-
delay
3
-
install
true
-
install_file
Notes.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2992-30-0x0000000000400000-0x0000000000412000-memory.dmp
Files
-
2992-30-0x0000000000400000-0x0000000000412000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ