Analysis
-
max time kernel
163s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2023 00:45
Behavioral task
behavioral1
Sample
3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe
Resource
win7-20230831-en
General
-
Target
3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe
-
Size
65KB
-
MD5
71350265ce9a9650b2881c7b444a24d9
-
SHA1
8e6a91f8243b6b1f19d8168694456a810c7fd2f7
-
SHA256
3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127
-
SHA512
13d79398657909266b6494e0ce688805844ace9b96f2d381f0623c9cce33f689074f0f2051d696bcc04537035f03a8e591fa5a15a33cc99c621ddb7b53e123ac
-
SSDEEP
1536:t2Fhvk7JknoDR58tXwL6cgue6rsgE8PU6aivQZIE6EXb/lCzyRkmma3tS8rTTRKx:t2FhvkNkgE8PU6aivfE/XbNOIkmTrox
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
XXX
185.81.157.153:55
AsyncMutex_vs
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2700-0-0x0000000000330000-0x0000000000346000-memory.dmp asyncrat -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exepid process 2700 3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exedescription pid process Token: SeDebugPrivilege 2700 3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exepid process 2700 3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe"C:\Users\Admin\AppData\Local\Temp\3f4fd2769bc0d88074a6df3409a1f86fe5073e1cc4d57e84d5a322f0d7240127_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2700-0-0x0000000000330000-0x0000000000346000-memory.dmpFilesize
88KB
-
memory/2700-1-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/2700-2-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB
-
memory/2700-3-0x00000000055D0000-0x0000000005B74000-memory.dmpFilesize
5.6MB
-
memory/2700-4-0x0000000005200000-0x0000000005292000-memory.dmpFilesize
584KB
-
memory/2700-5-0x00000000051E0000-0x00000000051EA000-memory.dmpFilesize
40KB
-
memory/2700-6-0x0000000074790000-0x0000000074F40000-memory.dmpFilesize
7.7MB
-
memory/2700-7-0x0000000004E10000-0x0000000004E20000-memory.dmpFilesize
64KB