popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

AsyncClient.exe

Generic Malware Admin Tool (Sysinternals etc ...) UPX Malicious Packer PE File PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 14, 2023, 5:39 p.m. June 14, 2023, 5:43 p.m.
Size 1.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3dc64f540a2a9278e15cadf61d71369f
SHA256 d12b75beda6b6b046c088d0ebe654632510deb36a600381c3391ce0cc108f8e3
CRC32 7F0A3D59
ssdeep 12288:wG+i1cTob5rpXuEq++p6xG5ssxODepysgSk9DyL1HUyIP9IylT8rhke6nuRs9U5U:wrkcG+p6U5U8ae6n+5s3
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a
GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x75860d27
CallWindowProcA+0x1b GetClassNameA-0x95 user32+0x2794a @ 0x7586794a
asyncclient+0x16a30f @ 0x56a30f
asyncclient+0x169a06 @ 0x569a06
EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048
BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e
ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981
ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa
ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600
asyncclient+0x19da @ 0x4019da
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: f3 a5 0b ca 75 05 5f 5e c2 0c 00 f3 a4 5f 5e c2
exception.symbol: RtlMoveMemory+0x1b RtlFindActivationContextSectionGuid-0x270 ntdll+0x63c5b
exception.instruction: movsd dword ptr es:[edi], dword ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 408667
exception.address: 0x76f73c5b
registers.esp: 1636972
registers.edi: 31588352
registers.eax: 1995914304
registers.ebp: 1637176
registers.edx: 0
registers.ebx: 6633774
registers.esi: 3674352516
registers.ecx: 62
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003f0000
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.67509407
FireEye Generic.mg.3dc64f540a2a9278
McAfee Artemis!3DC64F540A2A
Malwarebytes Malware.AI.3868291842
Sangfor Trojan.Win32.Agent.Vsv0
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/GenKryptik.GKSI
Cynet Malicious (score: 99)
APEX Malicious
Kaspersky Backdoor.MSIL.Crysan.hgy
Avast Win32:RATX-gen [Trj]
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.VbCrypt.250
McAfee-GW-Edition BehavesLike.Win32.Generic.tm
SentinelOne Static AI - Suspicious PE
Webroot W32.Trojan.Gen
Avira TR/Dropper.Gen
ZoneAlarm Backdoor.MSIL.Crysan.hgy
GData MSIL.Backdoor.ASyncRAT.E8UBKT
VBA32 BScope.Trojan-Dropper.Injector
MAX malware (ai score=84)
Panda Trj/Chgt.AD
Rising Backdoor.Crysan!8.10ECA (CLOUD)
Fortinet W32/PossibleThreat
BitDefenderTheta Gen:NN.ZevbaF.36250.En3@ain2gNpi
AVG Win32:RATX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)