Analysis

  • max time kernel
    155s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2023, 08:12

General

  • Target

    23112023_1612_codernna_02.exe

  • Size

    65KB

  • MD5

    cbb96929db676720addb90c67764d366

  • SHA1

    38e5458a902a87d4ad1e994d92a1dcdcd115c094

  • SHA256

    aa4bd04106c0aa7e985165538154e6b42923bd2662b00cd18776b97b7bd70342

  • SHA512

    8857e4a9cca6e58d3a390235a3090d2a09ee1a722bc375965ad7acef7cf39246fd2b75dcf63145a99813b3771c0aee93e5176b12949be69555029477798879d4

  • SSDEEP

    1536:M29tg/k4RWsUvaI9TRi/GW1jZERE8vU6aGmh0Rf8CbYvIQSGQYZzmbjf8riTRtx:M29tg/kwgE8vU6aGmKRfxbYwkn4IIXx

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

NNa

C2

buike.kozow.com:6606

buike.kozow.com:7707

buike.kozow.com:8808

Mutex

AsyncMut9348u95iuj3485u843u584iji34hr79duyh 9u324hiur934uiruu98

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23112023_1612_codernna_02.exe
    "C:\Users\Admin\AppData\Local\Temp\23112023_1612_codernna_02.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4204-0-0x0000000074D60000-0x0000000075510000-memory.dmp

          Filesize

          7.7MB

        • memory/4204-1-0x00000000002B0000-0x00000000002C6000-memory.dmp

          Filesize

          88KB

        • memory/4204-2-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

          Filesize

          64KB

        • memory/4204-3-0x0000000074D60000-0x0000000075510000-memory.dmp

          Filesize

          7.7MB

        • memory/4204-4-0x0000000005730000-0x0000000005CD4000-memory.dmp

          Filesize

          5.6MB

        • memory/4204-5-0x0000000005370000-0x0000000005402000-memory.dmp

          Filesize

          584KB

        • memory/4204-6-0x0000000005410000-0x000000000541A000-memory.dmp

          Filesize

          40KB

        • memory/4204-9-0x00000000063C0000-0x000000000645C000-memory.dmp

          Filesize

          624KB

        • memory/4204-10-0x0000000005F50000-0x0000000005FB6000-memory.dmp

          Filesize

          408KB

        • memory/4204-11-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

          Filesize

          64KB