Summary

a9fda52ef09f461c_aspnet_state.exe

File a9fda52ef09f461c_aspnet_state.exe

Summary
Download Resubmit sample

Size 1.5MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 f284b10b74b48c547cf88cb1cad0a975
SHA1 3d36e192386a96a43d8ed3a61a83d821fdc34745
SHA256 a9fda52ef09f461c795882ee0e1e12a7c067a88021223b922062be45eb5035b6
SHA512
4d6995f3709bf1f4831879670da4257c20932483bcf6a4c77906fd75e80f1d9b8439f401822f92808a00c51a9bca55cb4dabf652d91a21fee96b505a79c0d13c
CRC32 371D2544
ssdeep None
PDB Path aspnet_state.pdb
Yara
  • DebuggerException__SetConsoleCtrl - (no description)
  • anti_dbg - Checks if being debugged
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • win_registry - Affect system registries

Score

This file is very suspicious, with a score of 8.9 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6432968

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE May 11, 2025, 4:11 a.m. May 11, 2025, 4:17 a.m. 363 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-05-05 11:35:09,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpf7a_02
2025-05-05 11:35:09,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\pYrtEsqRCbILImuMWO
2025-05-05 11:35:09,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\aiPOThcPEprKBWpkTrZoxZFpLjguIFD
2025-05-05 11:35:09,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-05-05 11:35:09,015 [analyzer] INFO: Automatically selected analysis package "exe"
2025-05-05 11:35:09,405 [analyzer] DEBUG: Started auxiliary module Curtain
2025-05-05 11:35:09,405 [analyzer] DEBUG: Started auxiliary module DbgView
2025-05-05 11:35:09,875 [analyzer] DEBUG: Started auxiliary module Disguise
2025-05-05 11:35:10,078 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-05-05 11:35:10,078 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-05-05 11:35:10,078 [analyzer] DEBUG: Started auxiliary module Human
2025-05-05 11:35:10,078 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-05-05 11:35:10,078 [analyzer] DEBUG: Started auxiliary module Reboot
2025-05-05 11:35:10,140 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-05-05 11:35:10,140 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-05-05 11:35:10,155 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-05-05 11:35:10,155 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-05-05 11:35:10,280 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\a9fda52ef09f461c_aspnet_state.exe' with arguments '' and pid 2960
2025-05-05 11:35:11,280 [analyzer] INFO: Process with pid 2960 has terminated
2025-05-05 11:35:11,280 [analyzer] INFO: Process list is empty, terminating analysis.
2025-05-05 11:35:12,483 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-05-05 11:35:12,483 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-05-11 04:11:29,446 [cuckoo.core.scheduler] INFO: Task #6433608: acquired machine win7x6427 (label=win7x6427)
2025-05-11 04:11:29,446 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.227 for task #6433608
2025-05-11 04:11:29,653 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3399881 (interface=vboxnet0, host=192.168.168.227)
2025-05-11 04:11:30,522 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6427
2025-05-11 04:11:30,950 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6427 to vmcloak
2025-05-11 04:14:30,284 [cuckoo.core.guest] INFO: Starting analysis #6433608 on guest (id=win7x6427, ip=192.168.168.227)
2025-05-11 04:14:31,289 [cuckoo.core.guest] DEBUG: win7x6427: not ready yet
2025-05-11 04:14:36,326 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6427, ip=192.168.168.227)
2025-05-11 04:14:36,399 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6427, ip=192.168.168.227, monitor=latest, size=6660546)
2025-05-11 04:14:37,760 [cuckoo.core.resultserver] DEBUG: Task #6433608: live log analysis.log initialized.
2025-05-11 04:14:38,789 [cuckoo.core.resultserver] DEBUG: Task #6433608 is sending a BSON stream
2025-05-11 04:14:40,045 [cuckoo.core.resultserver] DEBUG: Task #6433608: File upload for 'shots/0001.jpg'
2025-05-11 04:14:40,067 [cuckoo.core.resultserver] DEBUG: Task #6433608 uploaded file length: 133490
2025-05-11 04:14:41,160 [cuckoo.core.resultserver] DEBUG: Task #6433608: File upload for 'curtain/1746437712.38.curtain.log'
2025-05-11 04:14:41,163 [cuckoo.core.resultserver] DEBUG: Task #6433608 uploaded file length: 36
2025-05-11 04:14:41,263 [cuckoo.core.resultserver] DEBUG: Task #6433608: File upload for 'sysmon/1746437712.48.sysmon.xml'
2025-05-11 04:14:41,270 [cuckoo.core.resultserver] DEBUG: Task #6433608 uploaded file length: 204622
2025-05-11 04:14:42,162 [cuckoo.core.resultserver] DEBUG: Task #6433608 had connection reset for <Context for LOG>
2025-05-11 04:14:43,357 [cuckoo.core.guest] INFO: win7x6427: analysis completed successfully
2025-05-11 04:14:43,369 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-05-11 04:14:43,395 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-05-11 04:14:44,047 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6427 to path /srv/cuckoo/cwd/storage/analyses/6433608/memory.dmp
2025-05-11 04:14:44,050 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6427
2025-05-11 04:17:30,220 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.227 for task #6433608
2025-05-11 04:17:32,767 [cuckoo.core.scheduler] DEBUG: Released database task #6433608
2025-05-11 04:17:32,789 [cuckoo.core.scheduler] INFO: Task #6433608: analysis procedure completed

Signatures

Yara rules detected for file (5 events)
description (no description) rule DebuggerException__SetConsoleCtrl
description Checks if being debugged rule anti_dbg
description Listen for incoming communication rule network_tcp_listen
description Communications over RAW socket rule network_tcp_socket
description Affect system registries rule win_registry
This executable has a PDB path (1 event)
pdb_path aspnet_state.pdb
File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)
G Data Antivirus (Windows) Virus: Win64.Expiro.Gen.7 (Engine A)
Avast Core Security (Linux) Win64:Expiro-AJ [Inf]
C4S ClamAV (Linux) Win.Malware.Expiro-9937504-0
WithSecure (Linux) Malware.W32/Infector.Gen
ESET Security (Windows) a variant of Win64/Expiro.CQ virus
Sophos Anti-Virus (Linux) W64/Moiva-B
DrWeb Antivirus (Linux) Win32.Expiro.153
ClamAV (Linux) Win.Malware.Expiro-9937504-0
Bitdefender Antivirus (Linux) Win64.Expiro.Gen.7
Kaspersky Standard (Windows) Virus.Win64.Moiva.a
Emsisoft Commandline Scanner (Windows) Win64.Expiro.Gen.7 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.