Malware Analysis Report

2024-11-13 13:55

Sample ID 231210-br3tlabccn
Target 3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473
SHA256 3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473
Tags
rat asyncrat ducktail
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473

Threat Level: Known bad

The file 3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473 was found to be: Known bad.

Malicious Activity Summary

rat asyncrat ducktail

Ducktail family

Async RAT payload

Asyncrat family

Detect Ducktail Third Stage Payload

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-10 01:26

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Detect Ducktail Third Stage Payload

Description Indicator Process Target
N/A N/A N/A N/A

Ducktail family

ducktail

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-10 01:23

Reported

2023-12-10 01:29

Platform

win7-20231023-en

Max time kernel

119s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe

"C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe"

Network

N/A

Files

memory/1972-0-0x00000000060F0000-0x0000000006B15000-memory.dmp

memory/1972-3-0x0000000001C80000-0x0000000001C8A000-memory.dmp

memory/1972-5-0x000000013FAE0000-0x000000014040D000-memory.dmp

memory/1972-7-0x0000000007CE0000-0x0000000008991000-memory.dmp

memory/1972-10-0x0000000005FC0000-0x0000000006081000-memory.dmp

memory/1972-13-0x0000000001C60000-0x0000000001C72000-memory.dmp

memory/1972-19-0x0000000001D40000-0x0000000001D60000-memory.dmp

memory/1972-16-0x0000000001D60000-0x0000000001D6D000-memory.dmp

memory/1972-22-0x0000000001D90000-0x0000000001DA8000-memory.dmp

memory/1972-34-0x0000000005420000-0x0000000005433000-memory.dmp

memory/1972-31-0x00000000070B0000-0x0000000007131000-memory.dmp

memory/1972-28-0x00000000056C0000-0x0000000005700000-memory.dmp

memory/1972-37-0x0000000007210000-0x00000000072D4000-memory.dmp

memory/1972-40-0x00000000054C0000-0x00000000054E1000-memory.dmp

memory/1972-25-0x0000000005BB0000-0x0000000005C33000-memory.dmp

memory/1972-43-0x00000000020E0000-0x000000000210A000-memory.dmp

memory/1972-46-0x0000000005700000-0x000000000573C000-memory.dmp

memory/1972-49-0x0000000006090000-0x00000000060CE000-memory.dmp

memory/1972-52-0x00000000076A0000-0x0000000007A4E000-memory.dmp

memory/1972-57-0x0000000005510000-0x000000000552A000-memory.dmp

memory/1972-60-0x0000000005500000-0x0000000005508000-memory.dmp

memory/1972-63-0x00000000060D0000-0x00000000060E9000-memory.dmp

memory/1972-66-0x00000000054F0000-0x00000000054F9000-memory.dmp

C:\Users\Admin\AppData\Roaming\vnetbox\System.Core.Vnet.db

MD5 e9f6d3a4a4faadff2b563b2a9ed992c6
SHA1 4e6def1b3f48cde3c490f25fd8b6387c44c43ed2
SHA256 501c84c252d0d76940886b9c6b6aee49389d38cddcc21293da80f0809525a463
SHA512 ec94e9886e0830a97044205b5721535cb8fa5e0d4b132d75806a4f381a56e09f516622eb9a2f9e0252840a773ec58c477b27a65f3c39828347f80b23672661cb

memory/1972-396-0x000000013FAE0000-0x000000014040D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-10 01:23

Reported

2023-12-10 01:29

Platform

win10v2004-20231130-en

Max time kernel

141s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe

"C:\Users\Admin\AppData\Local\Temp\3afa3362ea1b6346158dbecd041a69843e7b230a37142e508fb26567363a4473.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 153.141.79.40.in-addr.arpa udp

Files

memory/4552-0-0x0000000180000000-0x0000000180A25000-memory.dmp

memory/4552-3-0x0000020781D50000-0x0000020781D5A000-memory.dmp

memory/4552-4-0x00007FF7D1080000-0x00007FF7D19AD000-memory.dmp

memory/4552-7-0x00000207863B0000-0x0000020787061000-memory.dmp

memory/4552-22-0x0000020781DE0000-0x0000020781DF8000-memory.dmp

memory/4552-19-0x0000020781D90000-0x0000020781DB0000-memory.dmp

memory/4552-16-0x0000020781DB0000-0x0000020781DBD000-memory.dmp

memory/4552-31-0x0000020785D90000-0x0000020785E11000-memory.dmp

memory/4552-28-0x00000207855A0000-0x00000207855E0000-memory.dmp

memory/4552-25-0x00000207855E0000-0x0000020785663000-memory.dmp

memory/4552-13-0x0000020781D30000-0x0000020781D42000-memory.dmp

memory/4552-34-0x0000020785570000-0x0000020785583000-memory.dmp

memory/4552-10-0x00000207856F0000-0x00000207857B1000-memory.dmp

memory/4552-37-0x0000020785EF0000-0x0000020785FB4000-memory.dmp

memory/4552-40-0x00000207856A0000-0x00000207856C1000-memory.dmp

memory/4552-52-0x0000020788A80000-0x0000020788E2E000-memory.dmp

memory/4552-49-0x0000020785E20000-0x0000020785E5E000-memory.dmp

memory/4552-46-0x0000020785D50000-0x0000020785D8C000-memory.dmp

memory/4552-43-0x0000020785670000-0x000002078569A000-memory.dmp

memory/4552-66-0x0000020785560000-0x0000020785569000-memory.dmp

memory/4552-63-0x0000020785E60000-0x0000020785E79000-memory.dmp

memory/4552-60-0x0000020785590000-0x0000020785598000-memory.dmp

memory/4552-57-0x0000020785D20000-0x0000020785D3A000-memory.dmp

C:\Users\Admin\AppData\Roaming\vnetbox\System.Core.Vnet.db

MD5 f0968c8b74a91662b0e100688c6d3f98
SHA1 ebc7d7fe76131a26eeca5f4a9269762083ab2687
SHA256 140aaa5e206b3244421efe6f97b13e483c884344fdc3e36ad37ed0ea566a479d
SHA512 3229da73765e6cf4fa90fc872bff1837725d7782be36fc6b232b9420bf49918d7c318c6203a8bc2a9e20b4b68d4294b34300f4c7a98007a778fcdc3fe5f53a11

memory/4552-396-0x00007FF7D1080000-0x00007FF7D19AD000-memory.dmp