Analysis
-
max time kernel
26s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 12:42
General
-
Target
36851699890e8d2ed92224eaa6d8661b.exe
-
Size
3.1MB
-
MD5
36851699890e8d2ed92224eaa6d8661b
-
SHA1
5998d5f3aa5953dae2898054b76da6b5a4c12442
-
SHA256
592dea4eea3a4fc6540a4c677253f3936822f9040add569257eb1878cbafecca
-
SHA512
09d4d80a104278c173400b9ac6daf4377f934e193ee8a69136761349504615f70f76ca79642ff45cc8a1ca7847575e68fd676f0569b5162b096d96cc74d8da0b
-
SSDEEP
98304:9p31ZVRYXDG9EGbkXJ8RaScZSYZYDPZjxoZ4MQk4d:9pjgipF/GZYs5Qk8
Malware Config
Extracted
asyncrat
0.5.7B
Ser1
fpt1.duckdns.org:6606
fpt1.duckdns.org:7707
fpt1.duckdns.org:8808
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
WindowsUpdate.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36851699890e8d2ed92224eaa6d8661b.exe"C:\Users\Admin\AppData\Local\Temp\36851699890e8d2ed92224eaa6d8661b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Tnbspwkmj.exe"C:\Users\Admin\AppData\Local\Temp\Tnbspwkmj.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Hmofnka.exe"C:\Users\Admin\AppData\Local\Temp\Hmofnka.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBD93.tmp.bat""4⤵
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"' & exit4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-7LTJF.tmp\Tnbspwkmj.tmp"C:\Users\Admin\AppData\Local\Temp\is-7LTJF.tmp\Tnbspwkmj.tmp" /SL5="$80056,2136956,315904,C:\Users\Admin\AppData\Local\Temp\Tnbspwkmj.exe"1⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"'1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD59e3e1995ce20875c3f9cb020ff6aee58
SHA167e260d93266a749ece3cef054556c5c59f8322b
SHA25637a3c6ebecd16052daf27c2c5df1ad0ea8251c8d69a2f05b1d31cde1e80f11ee
SHA51263893e8ca00e027bdb42cbb633baa8ac3f58f641798fe0a5b95ded42bf006f577a5d8eb0814902d4c3b8fd1185752c42be34de224fe32bdef22e4133f006dd4a
-
Filesize
166KB
MD5297db7ec66ee1ccd7a815ca77d2093cc
SHA10584aecee0a2badebbd61baa7a3d61e85a0898ba
SHA2560aebb777ec04a39ef633ca3085836da8036f27f68b37c7342fa4d6ade97334f0
SHA5129ac1af70e100cdad68089be615e43c9d6f8b0d201f441852e88632633dc5cdcc07d02d3b5bae81bf0eb83c8fc82893fd82074e76dd048d0608ee39d2f5ddd147
-
Filesize
170KB
MD53fec502bd6082c949bbc3a27905b137e
SHA11ea9d894dcf4c87ef876ccf0b1db7958cbeeb7f4
SHA2563d5f2db7ad9bf6b2e8d62f9ba958d4c01d56f07ef7f83ae67546dd34132506c0
SHA5124f21715415bc8178a5f3b96723f6fac2e89fd2c0abfefbc0d22841b9c8c7caa225773d462a6a626095887a7821dd69c544db30992c47a35cd0357637f5b9639b
-
Filesize
137KB
MD50c0f9b4060750f3d846f968e7b07769a
SHA16f0439dee3812996eab69a86e32e675b3aad29b8
SHA256ea5347e9694ed3a8654e9fce1406c73a27728d92dd4936348b0c9b148091ff0a
SHA5121ddc535ae51010a1ecae62a190bddc99a3c5faefe1cf1e97698bb1bcf33390458eedfcfe35a5721f13f158c30a9b5efe804e40b7fd2d7f4eca7a88bfb6d921a1
-
Filesize
64KB
MD533818be4a2058f83a8167b74b670ae4d
SHA1a1119d1da59c35f66b6dc87013004f0ba0a46d79
SHA25620a8d873abf6056dcad5c3f51de0636bab8adc16222c2fcf62df6fe87d78f9ab
SHA5126ebefc2d76de301cc94b8e6407bce7c893011eac55f6d36862eafea0c6ee7b5b5bcb8b76e06f826e7c974a4f57485524879cf4d8c3df66aaebc2498546839964
-
Filesize
62KB
MD541b95ccfe3d08df64da4f7b62fab4aa8
SHA129b905feb376ac108e6068a38de5a7739819c983
SHA25686d23f1ddc6a2be6089d38c7af357800900b1cf3f925ee4e4ceea17ae4d39043
SHA512701e65b33f141b75d22543c7925b6b2742d61c398baf28132135b4b42fda8199c3a581c7201cd3298047a30062b783b4163de880ce1bc46e89e07af91fc14d25
-
Filesize
1KB
MD57393972dcd7ebdf174791b352f0e1aba
SHA10d82dab69d45a8813a524070a933215d64f8d44a
SHA256338f0a8c7923b2ee317255833aff6f688b21a2f60aede9f5e3c8ac02fb850d38
SHA512a45c8b9adeb29911e205725d40942ee3cb05abfc762bb33952762be58c832e1c42ac5ea1b2c7cf5bae4981926ea4669326e7c0e3a27e51dcdb0755110500b0a2
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
70KB
MD5510646d4bee5577b731d3b2e670c17bf
SHA13bfa412bd1fe579bb9d21096a6bc418f52e9f41e
SHA256c93ceaf0895d2f023663124546a2fccf7844ac5d8087862f934e1cec9f5e03a6
SHA512e1870d46b1d3d9cda55f4c51bdd6e9b094076b8f39605b57d8b5339401f4441046d8f6fc94984fbfb7edd274808a3b4d391b53b59d4195ec92c7388231dacf2b
-
Filesize
57KB
MD53add58cb3b600b54e19c2d23a4cfd5dc
SHA14df6f64828dafd53792f1c8b10375119948f5405
SHA2569f4b12b106ca2a7d51bfbfe187ff2bbca431f43c8e5b1dcecce427141d2ef3c7
SHA512635622b717bbc2458a5c0fcf85ee74afe38f0ac4c364671a73c9b80259a7c71193ecbed8781ebbc8452f1eee3f9766264c86b10dd840e80e5c09a6fde8bd33b8
-
Filesize
22KB
MD5ab35386487b343e3e82dbd2671ff9dab
SHA103591d07aea3309b631a7d3a6e20a92653e199b8
SHA256c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2
SHA512b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09
-
Filesize
34KB
MD51e9862129e86e2e0aa5aada9ad83fb87
SHA1ff3bbf1251269e36a374a96bc0008a956959c507
SHA2562684679e596c733896787c45ff624e31d8d3762071505a9d73d5670ea09dfdc9
SHA512928f02e2556cd66f37c474c59e2cc2e7b4ccc9f69a63dda36676a948ebb6c723118731277ac2e3e1954016e87dc0aeba6c909b65e6411394117d9b4f927eb258
-
Filesize
11KB
MD516e94c3d7d1de81362173bcd0bf224c0
SHA13f43100a4fd16789ff4d4a817b20b88ce993aa3f
SHA256e36063889f45c1fbc035f89e7d9e4326cc4949794f67756f5b3862a786666d82
SHA512dde81921945016214fd8dd33e281f7c040512dc56ee6140e14858249f0e08d806891a20bfd2d2c6f9bc33ac1da16a1e61d8d260571c3636e33e08cb537e4e3d7
-
Filesize
30KB
MD5cc18341e8063cbd4d5d3171045452c71
SHA13ec6c5def0dd1f994775ac2b1a7c4abf4aa77064
SHA2565287990920589b935ea6e0b74d98aebf55d8036f85d32c3df9f070ebda9c9529
SHA512c1ed908528af1f9866bc3ea93b1b7cc40537df65e66e8e07a89758e5d7fb5d97fa4b9c678bb5b805acd783c6b4c39baba27df245c4e215dc40673ecfc444c989
-
Filesize
49KB
MD512ac4a567b709fa75fd86613a5a93460
SHA13298a87644ec8fd22cc70880f59028d9824afff3
SHA256ea91eb8a55a6c4f0e2c3cdd5d8bd9521b90cb686526febe390d3a168112a4bdd
SHA512ab9be2a655721080fab55d36d3cd45243cd78894fb0522d9ffbd4fc2d947e719c2c6549cd1896a381617dd7da5d3547e8dd260e94469ecdbe53ecf786af98f4e
-
Filesize
45KB
MD51518a8f8c7872f2502df4ae3a55fc648
SHA155b33a700a0eca3d07e510ebd5cf6be0d31925ce
SHA25600c6c4c56e4090952bbd623cb3de12fab21d0595b6e3205426e235ec64f0b3ed
SHA51221141cbeaf536e59a04cc4c7ab3459cd91e4ecbc9c22b5d109b536f63502a93044838ac22ecc0a9847914e9c97fa4db215a727b397451adc47bb14041ce8e9d8
-
Filesize
58KB
MD57730e03ccb4f7f8a1e021c5838f2f889
SHA1c458f8e019452023cd2df0da944b60ad88632be2
SHA2560d4f5d77d3f1290d5014ad323229b9861e8481a464116d923052d025f8473f0b
SHA512eeb8ae37ee8591c1db3bd8faee12e076968bc39e5646cd9ca122273841c170c87b39df243d1943632900c12baed5aa1324d3aef43888c38f8423cfc9608ef01b
-
Filesize
59KB
MD5393bc93f991ed5d6db39c11391f77202
SHA171fcadf31673882067c4eb86703fd9f586173c98
SHA2564d814a85a802b5249eff7d6f5b1b953535a46361aa762fe2f6d3d6b5a51e5003
SHA512353f615feecd41645dba2090fcae267f5205785c5a4db813e8e2a082d892ceb1a7be048793c5ee9c7826eb38f7bae33464f90177c81a15c53fd37ecbab796161
-
Filesize
157B
MD51a191b5056ce4e00bf3a8fbed08be322
SHA1497d0516d498b4549ac442b30016abb205550167
SHA25660f6e7816326639e0588e8aa3a2a3e5cd4d201bfa962c354c0cc2041d8a1ffb6
SHA5128b11201b7e74293db1b9cf698248b04b7188f428e3f9d70d71d44da64415b3440228e2a8b95c9c927a5adca8d2ff13bcc33fee528f45becd32c47e27ad261965
-
Filesize
19KB
MD513d677fdfbbf18bf7f6bec8eeddd0da9
SHA1fb7a3c48a80a50e49ad2968aa3c2b6c1e1de8bd6
SHA256c76d9551d24d6f76d42b166c1f37e6ae68019ad736d5f1433a8d95a5b65ab85d
SHA51245860ed78aca5202274ea0ff7c4f0ce3128c47c992150a5a540b9c33fc2d0c4a14dff995bc6c50ba4cdc8b7d5e6962b637476f4e8721b3c2b095a3fea7c7467f
-
Filesize
19KB
MD53622c511be30cecd015709be1a422d66
SHA1f5e0fe8e364b9f8ef0dcd76c2b35b4573c3bcf25
SHA256103316bad4429bdc06fe93fff6cd7fad3695cc6a8e0505c78ca01f45b8f2a12e
SHA5128c6190f79e164d68181c42a15dc5e3b19618681dea3ba5883c0c4a3fb9efd83da803aa2a24f918668f009585f9653c6ceb6c70b0eb24a5b222193d4a32b28073
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
40KB
-
Filesize
3.1MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
68KB
-
Filesize
384KB
-
Filesize
908KB
-
Filesize
700KB
-
Filesize
908KB
-
Filesize
464KB
-
Filesize
700KB
-
Filesize
384KB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
8KB
-
Filesize
700KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
148KB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
60KB
-
Filesize
880KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
524KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
148KB
-
Filesize
384KB
-
Filesize
68KB
-
Filesize
384KB
-
Filesize
68KB
-
Filesize
192KB
-
Filesize
148KB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
488KB
-
Filesize
384KB
-
Filesize
488KB
-
Filesize
384KB
-
Filesize
68KB
-
Filesize
488KB
-
Filesize
384KB
-
Filesize
68KB
-
Filesize
488KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
348KB
-
Filesize
348KB