dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77_extracted\dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• 0987466ea2c57cd3b520ef025ed97ece71622ff3
• eb9656a9ac3dffcfc1677194a67a0279

IOCs (JSON)Copy

{
  "sha256": "dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77",
  "family": "AsyncRAT",
  "verdict": "suspicious",
  "confidence": 80,
  "signals": [
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1059",
    "T1027.002"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77_extracted\\dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77.exe"
  ]
}