popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1618469631.exe

AsyncRAT
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 March 12, 2021, 1:41 p.m. March 12, 2021, 1:44 p.m.
Size 256.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 31055a78f49e732959933d81f7ee4de1
SHA256 257c85c6309d53db09c2f8953fec99a8aa075eff1f304303b10e3c707542c670
CRC32 94A6F204
ssdeep 3072:JKL4PqtmpBYmSIk8ZsJgigSDCkcT5IZz5L+9Zbl:JRqQam1lydLw
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • IsPE32 - (no description)
  • IsNET_EXE - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDebugData - DebugData Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
138.124.180.119 Active Moloch
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00460ab0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00460b30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00460b30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00460bf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00460bf0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00460db0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fba1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fba2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01eb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00582000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0421f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04210000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
url http://tempuri.org/IConnectionRegister/ValidateUriRouteResponse
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/IssueT
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/IssueT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateT
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/RenewT
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/IssueT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/CancelT
url http://schemas.xmlsoap.org/ws/2004/09/mext
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/CancelT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal
url http://tempuri.org/
url http://tempuri.org/IRemotePanel/GetSettings
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/ValidateT
url http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponseT
url http://schemas.xmlsoap.org/ws/2004/09/transfer/GetT
url http://tempuri.org/IConnectionRegister/ValidateUriRouteT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinalw
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/RenewT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/IssueT
url http://schemas.xmlsoap.org/soap/envelope/
url http://schemas.xmlsoap.org/ws/2004/09/mexX
url http://schemas.xmlsoap.org/wsdl/3
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Validate
url http://schemas.xmlsoap.org/ws/2004/09/mexZ
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/CancelT
url http://schemas.xmlsoap.org/ws/2004/09/mexQ
url http://schemas.datacontract.org/2004/07/System
url http://schemas.xmlsoap.org/ws/2004/08/addressing
url http://schemas.xmlsoap.org/ws/2004/09/mex
url http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponse
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewT
url http://go2.microsoft.com/fwlink/?LinkId=131738
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Cancel
url http://schemas.xmlsoap.org/ws/2004/09/mexJ
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Renew
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/ValidateT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RenewT
url http://schemas.xmlsoap.org/ws/2004/09/mexo
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/ValidateT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over Toredo network rule network_toredo
description Communications smtp rule network_smtp_dotNet
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Possibly employs anti-virtualization techniques rule vmdetect
description Detection of Virtual Appliances through the use of WMI for use of evasion. rule WMI_VM_Detect
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
host 138.124.180.119
host 172.217.25.14
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
dead_host 138.124.180.119:3214
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Siggen2.61971
MicroWorld-eScan Trojan.GenericKD.36419763
FireEye Generic.mg.31055a78f49e7329
CAT-QuickHeal Trojan.MSIL
ALYac Trojan.GenericKD.36419763
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Spyware ( 00576cef1 )
Alibaba TrojanPSW:MSIL/RedLine.fca358a7
K7GW Spyware ( 00576cef1 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Generic.D22BB8B3
BitDefenderTheta Gen:NN.ZemsilF.34608.qm3@a0UwAid
Cyren W32/Trojan.JNFB-8255
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Spy.Agent.DCX
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
ClamAV Win.Malware.Enigma-9840152-0
Kaspersky HEUR:Trojan-Banker.MSIL.ClipBanker.gen
BitDefender Trojan.GenericKD.36419763
Paloalto generic.ml
AegisLab Trojan.MSIL.ClipBanker.7!c
Rising Spyware.Agent!8.C6 (CLOUD)
Ad-Aware Trojan.GenericKD.36419763
Emsisoft Trojan-Spy.Agent (A)
F-Secure Trojan.TR/AD.RedLineSteal.fkvov
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0WC421
McAfee-GW-Edition GenericRXNW-BS!31055A78F49E
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Banker.MSIL.dvg
Avira TR/AD.RedLineSteal.fkvov
Antiy-AVL Trojan[Banker]/MSIL.ClipBanker
Gridinsoft Trojan.Win32.Agent.ns
Microsoft PWS:MSIL/RedLine.GG!MTB
ViRobot Trojan.Win32.Z.Agent.262144.CBA
ZoneAlarm HEUR:Trojan-Banker.MSIL.ClipBanker.gen
GData Trojan.GenericKD.36419763
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_RedLine.C4304939
McAfee GenericRXNW-BS!31055A78F49E
MAX malware (ai score=100)
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.RedLineStealer
TrendMicro-HouseCall TROJ_GEN.R002C0WC421
Tencent Msil.Trojan-banker.Clipbanker.Lffx
Ikarus Trojan.MSIL.Spy