58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (2)

• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
• C:\argus-vr-agent\quarantine\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93_extracted\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• ec7db8b5960a038eb53bd5e159474fd6
• ecab6a9f6ea86d85f2a02f97a196559582262df7

IOCs (JSON)Copy

{
  "sha256": "58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93",
  "family": "AsyncRAT",
  "verdict": "suspicious",
  "confidence": 80,
  "signals": [
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1059",
    "T1027.002"
  ],
  "children": [
    "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
    "C:\\argus-vr-agent\\quarantine\\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93_extracted\\58928c973bd77cabdf6bca123c77f7915c3f335f42e364893c2673d954d22d93.exe"
  ]
}